2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <ftw.h> /* nftw() et al. */
15 #include <libgen.h> /* dirname() */
16 #include <limits.h> /* PATH_MAX */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
36 /* Command-line options */
37 static bool no_exec_mask
= false;
42 * @brief Get the mode bits from the given path.
45 * The path (file or directory) whose mode we want.
47 * @return A mode_t (st_mode) structure containing the mode bits.
48 * See sys/stat.h for details.
50 mode_t
get_mode(const char* path
) {
57 int result
= stat(path
, &s
);
63 /* errno will be set already by stat() */
71 * @brief Determine whether or not the given path is a regular file.
76 * @return true if @c path is a regular file, false otherwise.
78 bool is_regular_file(const char* path
) {
84 int result
= stat(path
, &s
);
86 return S_ISREG(s
.st_mode
);
96 * @brief Determine whether or not the given path is a directory.
101 * @return true if @c path is a directory, false otherwise.
103 bool is_directory(const char* path
) {
109 int result
= stat(path
, &s
);
111 return S_ISDIR(s
.st_mode
);
121 * @brief Update (or create) an entry in an @b minimal ACL.
123 * This function will not work if @c aclp contains extended
124 * entries. This is fine for our purposes, since we call @c wipe_acls
125 * on each path before applying the default to it.
127 * The assumption that there are no extended entries makes things much
128 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
129 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
130 * be created anew. This means we don't have to fool around comparing
131 * named-user/group entries.
134 * A pointer to the acl_t structure whose entry we want to modify.
137 * The new entry. If @c entry contains a user/group/other entry, we
138 * update the existing one. Otherwise we create a new entry.
140 * @return If there is an unexpected library error, @c ACL_ERROR is
141 * returned. Otherwise, @c ACL_SUCCESS.
144 int acl_set_entry(acl_t
* aclp
,
148 int gt_result
= acl_get_tag_type(entry
, &entry_tag
);
149 if (gt_result
== ACL_ERROR
) {
150 perror("acl_set_entry (acl_get_tag_type)");
154 acl_permset_t entry_permset
;
155 int ps_result
= acl_get_permset(entry
, &entry_permset
);
156 if (ps_result
== ACL_ERROR
) {
157 perror("acl_set_entry (acl_get_permset)");
161 acl_entry_t existing_entry
;
162 /* Loop through the given ACL looking for matching entries. */
163 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
165 while (result
== ACL_SUCCESS
) {
166 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
167 int tag_result
= acl_get_tag_type(existing_entry
, &existing_tag
);
169 if (tag_result
== ACL_ERROR
) {
170 perror("set_acl_tag_permset (acl_get_tag_type)");
174 if (existing_tag
== entry_tag
) {
175 if (entry_tag
== ACL_USER_OBJ
||
176 entry_tag
== ACL_GROUP_OBJ
||
177 entry_tag
== ACL_OTHER
) {
178 /* Only update for these three since all other tags will have
179 been wiped. These three are guaranteed to exist, so if we
180 match one of them, we're allowed to return ACL_SUCCESS
181 below and bypass the rest of the function. */
182 acl_permset_t existing_permset
;
183 int gep_result
= acl_get_permset(existing_entry
, &existing_permset
);
184 if (gep_result
== ACL_ERROR
) {
185 perror("acl_set_entry (acl_get_permset)");
189 int s_result
= acl_set_permset(existing_entry
, entry_permset
);
190 if (s_result
== ACL_ERROR
) {
191 perror("acl_set_entry (acl_set_permset)");
200 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
203 /* This catches both the initial acl_get_entry and the ones at the
205 if (result
== ACL_ERROR
) {
206 perror("acl_set_entry (acl_get_entry)");
210 /* If we've made it this far, we need to add a new entry to the
212 acl_entry_t new_entry
;
214 /* We allocate memory here that we should release! */
215 int c_result
= acl_create_entry(aclp
, &new_entry
);
216 if (c_result
== ACL_ERROR
) {
217 perror("acl_set_entry (acl_create_entry)");
221 int st_result
= acl_set_tag_type(new_entry
, entry_tag
);
222 if (st_result
== ACL_ERROR
) {
223 perror("acl_set_entry (acl_set_tag_type)");
227 int s_result
= acl_set_permset(new_entry
, entry_permset
);
228 if (s_result
== ACL_ERROR
) {
229 perror("acl_set_entry (acl_set_permset)");
233 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
234 /* We need to set the qualifier too. */
235 void* entry_qual
= acl_get_qualifier(entry
);
236 if (entry_qual
== (void*)NULL
) {
237 perror("acl_set_entry (acl_get_qualifier)");
241 int sq_result
= acl_set_qualifier(new_entry
, entry_qual
);
242 if (sq_result
== ACL_ERROR
) {
243 perror("acl_set_entry (acl_set_qualifier)");
254 * @brief Determine the number of entries in the given ACL.
257 * A pointer to an @c acl_t structure.
259 * @return Either the non-negative number of entries in @c acl, or
260 * @c ACL_ERROR on error.
262 int acl_entry_count(acl_t
* acl
) {
266 int result
= acl_get_entry(*acl
, ACL_FIRST_ENTRY
, &entry
);
268 while (result
== ACL_SUCCESS
) {
270 result
= acl_get_entry(*acl
, ACL_NEXT_ENTRY
, &entry
);
273 if (result
== ACL_ERROR
) {
274 perror("acl_entry_count (acl_get_entry)");
284 * @brief Determine whether or not the given ACL is minimal.
286 * An ACL is minimal if it has fewer than four entries.
289 * A pointer to an acl_t structure.
292 * - @c ACL_SUCCESS - @c acl is minimal
293 * - @c ACL_FAILURE - @c acl is not minimal
294 * - @c ACL_ERROR - Unexpected library error
296 int acl_is_minimal(acl_t
* acl
) {
298 int ec
= acl_entry_count(acl
);
300 if (ec
== ACL_ERROR
) {
301 perror("acl_is_minimal (acl_entry_count)");
316 * @brief Determine whether the given path has an ACL whose mask
323 * - @c ACL_SUCCESS - @c path has a mask which denies execute.
324 * - @c ACL_FAILURE - The ACL for @c path does not deny execute,
325 * or @c path has no extended ACL at all.
326 * - @c ACL_ERROR - Unexpected library error.
328 int acl_execute_masked(const char* path
) {
330 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
332 if (acl
== (acl_t
)NULL
) {
333 perror("acl_execute_masked (acl_get_file)");
337 /* Our return value. */
338 int result
= ACL_FAILURE
;
341 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
343 while (ge_result
== ACL_SUCCESS
) {
344 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
345 int tag_result
= acl_get_tag_type(entry
, &tag
);
347 if (tag_result
== ACL_ERROR
) {
348 perror("acl_execute_masked (acl_get_tag_type)");
353 if (tag
== ACL_MASK
) {
354 /* This is the mask entry, get its permissions, and see if
355 execute is specified. */
356 acl_permset_t permset
;
358 int ps_result
= acl_get_permset(entry
, &permset
);
359 if (ps_result
== ACL_ERROR
) {
360 perror("acl_execute_masked (acl_get_permset)");
365 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
366 if (gp_result
== ACL_ERROR
) {
367 perror("acl_execute_masked (acl_get_perm)");
372 if (gp_result
== ACL_FAILURE
) {
373 /* No execute bit set in the mask; execute not allowed. */
378 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
388 * @brief Determine whether @c path is executable (by anyone) or a
391 * This is used as part of the heuristic to determine whether or not
392 * we should mask the execute bit when inheriting an ACL. If @c path
393 * is a directory, the answer is a clear-cut yes. This behavior is
394 * modeled after the capital 'X' perms of setfacl.
396 * If @c path is a file, we check the @a effective permissions,
397 * contrary to what setfacl does.
403 * - @c ACL_SUCCESS - @c path is a directory, or someone has effective
405 * - @c ACL_FAILURE - @c path is a regular file and nobody can execute
407 * - @c ACL_ERROR - Unexpected library error.
409 int any_can_execute_or_dir(const char* path
) {
411 if (is_directory(path
)) {
412 /* That was easy... */
416 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
418 if (acl
== (acl_t
)NULL
) {
419 perror("any_can_execute_or_dir (acl_get_file)");
423 /* Our return value. */
424 int result
= ACL_FAILURE
;
426 if (acl_is_minimal(&acl
)) {
427 mode_t mode
= get_mode(path
);
428 if (mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
429 result
= ACL_SUCCESS
;
433 result
= ACL_FAILURE
;
439 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
441 while (ge_result
== ACL_SUCCESS
) {
442 acl_permset_t permset
;
444 int ps_result
= acl_get_permset(entry
, &permset
);
445 if (ps_result
== ACL_ERROR
) {
446 perror("any_can_execute_or_dir (acl_get_permset)");
451 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
452 if (gp_result
== ACL_ERROR
) {
453 perror("any_can_execute_or_dir (acl_get_perm)");
458 if (gp_result
== ACL_SUCCESS
) {
459 /* Only return one if this execute bit is not masked. */
460 if (acl_execute_masked(path
) != ACL_SUCCESS
) {
461 result
= ACL_SUCCESS
;
466 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
469 if (ge_result
== ACL_ERROR
) {
470 perror("any_can_execute_or_dir (acl_get_entry)");
483 * @brief Inherit the default ACL from @c parent to @c path.
485 * The @c parent parameter does not necessarily need to be the parent
486 * of @c path, although that will usually be the case. This overwrites
487 * any existing default ACL on @c path.
490 * The parent directory whose ACL we want to inherit.
493 * The target directory whose ACL we wish to overwrite (or create).
496 * - @c ACL_SUCCESS - The default ACL was inherited successfully.
497 * - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
498 * - @c ACL_ERROR - Unexpected library error.
500 int inherit_default_acl(const char* path
, const char* parent
) {
502 /* Our return value. */
503 int result
= ACL_SUCCESS
;
510 if (!is_directory(path
) || !is_directory(parent
)) {
514 acl_t parent_acl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
515 if (parent_acl
== (acl_t
)NULL
) {
516 perror("inherit_default_acl (acl_get_file)");
520 acl_t path_acl
= acl_dup(parent_acl
);
522 if (path_acl
== (acl_t
)NULL
) {
523 perror("inherit_default_acl (acl_dup)");
524 acl_free(parent_acl
);
528 int sf_result
= acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
);
529 if (sf_result
== -1) {
530 perror("inherit_default_acl (acl_set_file)");
543 * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
544 * from the given path.
547 * The path whose ACLs we want to wipe.
550 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
551 * existed in the first place.
552 * - @c ACL_ERROR - Unexpected library error.
554 int wipe_acls(const char* path
) {
561 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
562 if (acl
== (acl_t
)NULL
) {
563 perror("wipe_acls (acl_get_file)");
567 /* Our return value. */
568 int result
= ACL_SUCCESS
;
571 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
573 while (ge_result
== ACL_SUCCESS
) {
574 int d_result
= acl_delete_entry(acl
, entry
);
575 if (d_result
== ACL_ERROR
) {
576 perror("wipe_acls (acl_delete_entry)");
581 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
584 /* Catches the first acl_get_entry as well as the ones at the end of
586 if (ge_result
== ACL_ERROR
) {
587 perror("wipe_acls (acl_get_entry)");
592 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
593 if (sf_result
== ACL_ERROR
) {
594 perror("wipe_acls (acl_set_file)");
607 * @brief Apply parent default ACL to a path.
609 * This overwrites any existing ACLs on @c path.
612 * The path whose ACL we would like to reset to its default.
615 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
616 * - @c ACL_FAILURE - The target path is not a regular file/directory,
617 * or the parent of @c path is not a directory.
618 * - @c ACL_ERROR - Unexpected library error.
620 int apply_default_acl(const char* path
) {
627 if (!is_regular_file(path
) && !is_directory(path
)) {
631 /* dirname mangles its argument */
632 char path_copy
[PATH_MAX
];
633 strncpy(path_copy
, path
, PATH_MAX
-1);
634 path_copy
[PATH_MAX
-1] = 0;
636 char* parent
= dirname(path_copy
);
637 if (!is_directory(parent
)) {
638 /* Make sure dirname() did what we think it did. */
642 /* Default to not masking the exec bit; i.e. applying the default
643 ACL literally. If --no-exec-mask was not specified, then we try
644 to "guess" whether or not to mask the exec bit. */
645 bool allow_exec
= true;
648 int ace_result
= any_can_execute_or_dir(path
);
650 if (ace_result
== ACL_ERROR
) {
651 perror("apply_default_acl (any_can_execute_or_dir)");
655 allow_exec
= (bool)ace_result
;
658 acl_t defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
660 if (defacl
== (acl_t
)NULL
) {
661 perror("apply_default_acl (acl_get_file)");
665 /* Our return value. */
666 int result
= ACL_SUCCESS
;
668 int wipe_result
= wipe_acls(path
);
669 if (wipe_result
== ACL_ERROR
) {
670 perror("apply_default_acl (wipe_acls)");
675 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
676 ACL with this one. */
677 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
678 if (acl
== (acl_t
)NULL
) {
679 perror("apply_default_acl (acl_get_file)");
683 /* If it's a directory, inherit the parent's default. */
684 int inherit_result
= inherit_default_acl(path
, parent
);
685 if (inherit_result
== ACL_ERROR
) {
686 perror("apply_default_acl (inherit_acls)");
692 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
694 while (ge_result
== ACL_SUCCESS
) {
695 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
696 int tag_result
= acl_get_tag_type(entry
, &tag
);
698 if (tag_result
== ACL_ERROR
) {
699 perror("apply_default_acl (acl_get_tag_type)");
705 /* We've got an entry/tag from the default ACL. Get its permset. */
706 acl_permset_t permset
;
707 int ps_result
= acl_get_permset(entry
, &permset
);
708 if (ps_result
== ACL_ERROR
) {
709 perror("apply_default_acl (acl_get_permset)");
714 /* If this is a default mask, fix it up. */
715 if (tag
== ACL_MASK
||
716 tag
== ACL_USER_OBJ
||
717 tag
== ACL_GROUP_OBJ
||
721 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
722 minimal ACLs) or acl_other entries, so if execute should be
723 masked, we have to do it manually. */
724 int d_result
= acl_delete_perm(permset
, ACL_EXECUTE
);
725 if (d_result
== ACL_ERROR
) {
726 perror("apply_default_acl (acl_delete_perm)");
731 int sp_result
= acl_set_permset(entry
, permset
);
732 if (sp_result
== ACL_ERROR
) {
733 perror("apply_default_acl (acl_set_permset)");
740 /* Finally, add the permset to the access ACL. */
741 int set_result
= acl_set_entry(&acl
, entry
);
742 if (set_result
== ACL_ERROR
) {
743 perror("apply_default_acl (acl_set_entry)");
748 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
751 /* Catches the first acl_get_entry as well as the ones at the end of
753 if (ge_result
== ACL_ERROR
) {
754 perror("apply_default_acl (acl_get_entry)");
759 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
760 if (sf_result
== ACL_ERROR
) {
761 perror("apply_default_acl (acl_set_file)");
774 * @brief Display program usage information.
776 * @param program_name
777 * The program name to use in the output.
780 void usage(char* program_name
) {
781 printf("Apply any applicable default ACLs to the given files or "
783 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
786 printf(" -h, --help Print this help message\n");
787 printf(" -r, --recursive Act on any given directories recursively\n");
788 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
795 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
797 * For parameter information, see the @c nftw man page.
799 * @return If the ACL was applied to @c target successfully, we return
800 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
801 * the next file or directory. Otherwise, we return @c FTW_STOP to
805 int apply_default_acl_nftw(const char *target
,
806 const struct stat
*s
,
810 bool app_result
= apply_default_acl(target
);
822 * @brief Recursive version of @c apply_default_acl().
824 * If @c target is a directory, we use @c nftw() to call @c
825 * apply_default_acl() recursively on all of its children. Otherwise,
826 * we just delegate to @c apply_default_acl().
828 * We ignore symlinks for consistency with chmod -r.
831 * If @c target is not a directory, we return the result of
832 * calling @c apply_default_acl() on @c target. Otherwise, we convert
833 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
834 * then we return @c true. Otherwise, we return @c false.
836 * If there is an error, it will be reported via @c perror, but
837 * we still return @c false.
839 bool apply_default_acl_recursive(const char *target
) {
841 if (!is_directory(target
)) {
842 return apply_default_acl(target
);
845 int max_levels
= 256;
846 int flags
= FTW_PHYS
; /* Don't follow links. */
848 int nftw_result
= nftw(target
,
849 apply_default_acl_nftw
,
853 if (nftw_result
== 0) {
858 /* nftw will return -1 on error, or if the supplied function
859 * (apply_default_acl_nftw) returns a non-zero result, nftw will
862 if (nftw_result
== -1) {
863 perror("apply_default_acl_recursive (nftw)");
872 * @brief Call apply_default_acl (possibly recursively) on each
873 * command-line argument.
875 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
876 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
879 int main(int argc
, char* argv
[]) {
886 bool recursive
= false;
887 /* bool no_exec_mask is declared static/global */
889 struct option long_options
[] = {
890 /* These options set a flag. */
891 {"help", no_argument
, NULL
, 'h'},
892 {"recursive", no_argument
, NULL
, 'r'},
893 {"no-exec-mask", no_argument
, NULL
, 'x'},
899 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
916 int result
= EXIT_SUCCESS
;
919 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
920 const char* target
= argv
[arg_index
];
921 bool reapp_result
= false;
924 reapp_result
= apply_default_acl_recursive(target
);
927 /* It's either normal file, or we're not operating recursively. */
928 reapp_result
= apply_default_acl(target
);
932 result
= EXIT_FAILURE
;