| 601 | } |
| 602 | |
| 603 | static int |
| 604 | zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval, |
| 605 | cred_t *cr) |
| 606 | { |
| 607 | char *strval; |
| 608 | |
| 609 | /* |
| 610 | * Check permissions for special properties. |
| 611 | */ |
| 612 | switch (prop) { |
| 613 | default: |
| 614 | break; |
| 615 | case ZFS_PROP_ZONED: |
| 616 | /* |
| 617 | * Disallow setting of 'zoned' from within a local zone. |
| 618 | */ |
| 619 | if (!INGLOBALZONE(curproc)) |
| 620 | return (SET_ERROR(EPERM)); |
| 621 | break; |
| 622 | |
| 623 | case ZFS_PROP_QUOTA: |
| 624 | case ZFS_PROP_FILESYSTEM_LIMIT: |
| 625 | case ZFS_PROP_SNAPSHOT_LIMIT: |
| 626 | if (!INGLOBALZONE(curproc)) { |
| 627 | uint64_t zoned; |
| 628 | char setpoint[ZFS_MAX_DATASET_NAME_LEN]; |
| 629 | /* |
| 630 | * Unprivileged users are allowed to modify the |
| 631 | * limit on things *under* (ie. contained by) |
| 632 | * the thing they own. |
| 633 | */ |
| 634 | if (dsl_prop_get_integer(dsname, |
| 635 | zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, setpoint)) |
| 636 | return (SET_ERROR(EPERM)); |
| 637 | if (!zoned || strlen(dsname) <= strlen(setpoint)) |
| 638 | return (SET_ERROR(EPERM)); |
| 639 | } |
| 640 | break; |
| 641 | |
| 642 | case ZFS_PROP_MLSLABEL: |
| 643 | if (!is_system_labeled()) |
| 644 | return (SET_ERROR(EPERM)); |
| 645 | |
| 646 | if (nvpair_value_string(propval, &strval) == 0) { |
| 647 | int err; |
| 648 | |
| 649 | err = zfs_set_slabel_policy(dsname, strval, CRED()); |
| 650 | if (err != 0) |
| 651 | return (err); |
| 652 | } |
| 653 | break; |
| 654 | } |
| 655 | |
| 656 | return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr)); |
| 657 | } |
| 658 | |
| 659 | /* ARGSUSED */ |
| 660 | static int |
no test coverage detected