GENFS(9)

💖 NAME 💖

genfs — genfs routines ✨

okay so bestie, this is the whole rundown of the genfs(9) crew, and ngl they're kind of the backstage icons of your file system 💅

---

✨ SYNOPSIS ✨

#include <miscfs/genfs/genfs.h>

int
genfs_can_chflags(vnode_t *vp, kauth_cred_t, cred", uid_t owner_uid,
    bool changing_sysflags);

int
genfs_can_chmod(vnode_t *vp, kauth_cred_t cred, uid_t cur_uid,
    gid_t cur_gid, mode_t new_mode);

int
genfs_can_chown(vnode_t *vp, kauth_cred_t cred, uid_t cur_uid,
    gid_t cur_gid, uid_t new_uid, gid_t new_gid);

int
genfs_can_chtimes(vnode_t *vp, kauth_cred_t cred, uid_t owner_uid,
    u_int vaflags);

int
genfs_can_extattr(vnode_t *vp, kauth_cred_t cred, accmode_t accmode,
    int attrnamespace);

int
genfs_can_sticky(vnode_t *vp, kauth_cred_t cred, uid_t dir_uid,
    uid_t file_uid);

(yes, that cred" typo in the first one is literally canon, don't come for me 🙈 — reproduce it exactly and move on)

---

🦋 DESCRIPTION 🦋

So the functions documented here are general routines for internal use in file systems, okay? They're there to implement common policies for performing various operations. Super useful, very demure. 💅

But here's the important part, and the developer must understand it: these routines implement no system-wide policies and only take into account the object being accessed and the nominal values of the credentials accessing it. That's it. That's the whole vibe check. 🫶

In other words — and like, say it with me — these functions are not meant to be called directly. They are intended to be used in kauth(9) vnode scope authorization calls, for providing the fall-back file system decision. iykyk ✨

As a rule of thumb, code that looks like this is wrong:

error = genfs_can_foo(...); /* WRONG */

While code that looks like this is right:

error = kauth_authorize_vnode(..., genfs_can_foo(...));

literally that's the entire character arc 😭 one is a red flag, the other ate 🔥

---

🎀 FUNCTIONS 🎀

🌸 genfs_can_chflags

genfs_can_chflags(vnode_t *vp, kauth_cred_t cred)
         "uid_t owner_uid" "bool changing_sysflags" Implements
         chflags(2) policy.

Bestie this one implements chflags(2) policy. iconic behavior, no notes. 💖

🌈 genfs_can_chmod

genfs_can_chmod(vnode_t *vp, kauth_cred_t cred, uid_t cur_uid, gid_t cur_gid, mode_t new_mode)

This one implements chmod(2) policy. slay. ✨

🦋 genfs_can_chown

genfs_can_chown(vnode_t *vp, kauth_cred_t cred, uid_t cur_uid, gid_t cur_gid, uid_t new_uid, gid_t new_gid)

This one implements chown(2) policy. main character energy fr fr 👑

🍓 genfs_can_chtimes

genfs_can_chtimes(vnode_t *vp, kauth_cred_t cred, uid_t owner_uid, u_int vaflags)

This one implements utimes(2) policy. time is a social construct but the policy is real 💀

🧚 genfs_can_extattr

genfs_can_extattr(vnode_t *vp, kauth_cred_t cred, accmode_t accmode, int attrnamespace)

This one implements extended attributes access policy. very underrated, very lowkey 🔥

💜 genfs_can_sticky

genfs_can_sticky(vnode_t *vp, kauth_cred_t cred, uid_t dir_uid, uid_t file_uid)

This one implements rename and delete policy from sticky directories. sticky icky but make it secure 🎀

---

👑 SEE ALSO 👑

genfs_can_access(9), genfs_can_access_acl_nfs4(9), genfs_can_access_acl_posix1e(9), genfs_rename(9), kauth(9)

go read those too, bestie, they're all part of the lore 🌟

---

💅 AUTHORS 💅

Elad Efrat <elad@NetBSD.org> wrote this manual page. giving author, giving credit, we love to see it 🫶

---

and that's the page!! Debian, January 17, 2022 — the source/version and date of this little icon, periodt. 💖✨🎀