2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Determine whether or not the given path is accessible.
44 * @return true if @c path is accessible to the current effective
45 * user/group, false otherwise.
47 bool path_accessible(const char* path
) {
52 /* Test for access using the effective user and group rather than
54 int flags
= AT_EACCESS
;
56 /* Don't follow symlinks when checking for a path's existence,
57 since we won't follow them to set its ACLs either. */
58 flags
|= AT_SYMLINK_NOFOLLOW
;
60 /* If the path is relative, interpret it relative to the current
61 working directory (just like the access() system call). */
62 if (faccessat(AT_FDCWD
, path
, F_OK
, flags
) == 0) {
73 * @brief Determine whether or not the given path is a directory.
78 * @return true if @c path is a directory, false otherwise.
80 bool is_path_directory(const char* path
) {
86 if (lstat(path
, &s
) == 0) {
87 return S_ISDIR(s
.st_mode
);
98 * @brief Update (or create) an entry in an @b minimal ACL.
100 * This function will not work if @c aclp contains extended
101 * entries. This is fine for our purposes, since we call @c wipe_acls
102 * on each path before applying the default to it.
104 * The assumption that there are no extended entries makes things much
105 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
106 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
107 * be created anew. This means we don't have to fool around comparing
108 * named-user/group entries.
111 * A pointer to the acl_t structure whose entry we want to modify.
114 * The new entry. If @c entry contains a user/group/other entry, we
115 * update the existing one. Otherwise we create a new entry.
117 * @return If there is an unexpected library error, @c ACL_ERROR is
118 * returned. Otherwise, @c ACL_SUCCESS.
121 int acl_set_entry(acl_t
* aclp
, acl_entry_t entry
) {
124 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
125 perror("acl_set_entry (acl_get_tag_type)");
129 acl_permset_t entry_permset
;
130 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
131 perror("acl_set_entry (acl_get_permset)");
135 acl_entry_t existing_entry
;
136 /* Loop through the given ACL looking for matching entries. */
137 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
139 while (result
== ACL_SUCCESS
) {
140 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
142 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
143 perror("set_acl_tag_permset (acl_get_tag_type)");
147 if (existing_tag
== entry_tag
) {
148 if (entry_tag
== ACL_USER_OBJ
||
149 entry_tag
== ACL_GROUP_OBJ
||
150 entry_tag
== ACL_OTHER
) {
151 /* Only update for these three since all other tags will have
152 been wiped. These three are guaranteed to exist, so if we
153 match one of them, we're allowed to return ACL_SUCCESS
154 below and bypass the rest of the function. */
155 acl_permset_t existing_permset
;
156 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
157 perror("acl_set_entry (acl_get_permset)");
161 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
162 perror("acl_set_entry (acl_set_permset)");
171 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
174 /* This catches both the initial acl_get_entry and the ones at the
176 if (result
== ACL_ERROR
) {
177 perror("acl_set_entry (acl_get_entry)");
181 /* If we've made it this far, we need to add a new entry to the
183 acl_entry_t new_entry
;
185 /* The acl_create_entry() function can allocate new memory and/or
186 * change the location of the ACL structure entirely. When that
187 * happens, the value pointed to by aclp is updated, which means
188 * that a new acl_t gets "passed out" to our caller, eventually to
189 * be fed to acl_free(). In other words, we should still be freeing
190 * the right thing, even if the value pointed to by aclp changes.
192 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
193 perror("acl_set_entry (acl_create_entry)");
197 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
198 perror("acl_set_entry (acl_set_tag_type)");
202 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
203 perror("acl_set_entry (acl_set_permset)");
207 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
208 /* We need to set the qualifier too. */
209 void* entry_qual
= acl_get_qualifier(entry
);
210 if (entry_qual
== (void*)NULL
) {
211 perror("acl_set_entry (acl_get_qualifier)");
215 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
216 perror("acl_set_entry (acl_set_qualifier)");
227 * @brief Determine the number of entries in the given ACL.
230 * The ACL to inspect.
232 * @return Either the non-negative number of entries in @c acl, or
233 * @c ACL_ERROR on error.
235 int acl_entry_count(acl_t acl
) {
239 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
241 while (result
== ACL_SUCCESS
) {
243 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
246 if (result
== ACL_ERROR
) {
247 perror("acl_entry_count (acl_get_entry)");
257 * @brief Determine whether or not the given ACL is minimal.
259 * An ACL is minimal if it has fewer than four entries.
262 * The ACL whose minimality is in question.
265 * - @c ACL_SUCCESS - @c acl is minimal
266 * - @c ACL_FAILURE - @c acl is not minimal
267 * - @c ACL_ERROR - Unexpected library error
269 int acl_is_minimal(acl_t acl
) {
271 int ec
= acl_entry_count(acl
);
273 if (ec
== ACL_ERROR
) {
274 perror("acl_is_minimal (acl_entry_count)");
289 * @brief Determine whether the given ACL's mask denies execute.
292 * The ACL whose mask we want to check.
295 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
296 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
297 * - @c ACL_ERROR - Unexpected library error.
299 int acl_execute_masked(acl_t acl
) {
302 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
304 while (ge_result
== ACL_SUCCESS
) {
305 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
307 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
308 perror("acl_execute_masked (acl_get_tag_type)");
312 if (tag
== ACL_MASK
) {
313 /* This is the mask entry, get its permissions, and see if
314 execute is specified. */
315 acl_permset_t permset
;
317 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
318 perror("acl_execute_masked (acl_get_permset)");
322 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
323 if (gp_result
== ACL_ERROR
) {
324 perror("acl_execute_masked (acl_get_perm)");
328 if (gp_result
== ACL_FAILURE
) {
329 /* No execute bit set in the mask; execute not allowed. */
334 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
343 * @brief Determine whether @c fd is executable by anyone.
346 * This is used as part of the heuristic to determine whether or not
347 * we should mask the execute bit when inheriting an ACL. If @c fd
348 * describes a file, we check the @a effective permissions, contrary
349 * to what setfacl does.
352 * The file descriptor to check.
355 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
356 * - @c ACL_FAILURE - Nobody can execute @c fd.
357 * - @c ACL_ERROR - Unexpected library error.
359 int any_can_execute(int fd
) {
360 acl_t acl
= acl_get_fd(fd
);
362 if (acl
== (acl_t
)NULL
) {
363 perror("any_can_execute (acl_get_file)");
367 /* Our return value. */
368 int result
= ACL_FAILURE
;
370 if (acl_is_minimal(acl
)) {
372 if (fstat(fd
, &s
) == -1) {
373 perror("any_can_execute (fstat)");
377 if (s
.st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
378 result
= ACL_SUCCESS
;
382 result
= ACL_FAILURE
;
388 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
390 while (ge_result
== ACL_SUCCESS
) {
391 /* The first thing we do is check to see if this is a mask
392 entry. If it is, we skip it entirely. */
393 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
395 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
396 perror("any_can_execute_or (acl_get_tag_type)");
401 if (tag
== ACL_MASK
) {
402 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
406 /* Ok, so it's not a mask entry. Check the execute perms. */
407 acl_permset_t permset
;
409 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
410 perror("any_can_execute_or (acl_get_permset)");
415 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
416 if (gp_result
== ACL_ERROR
) {
417 perror("any_can_execute (acl_get_perm)");
422 if (gp_result
== ACL_SUCCESS
) {
423 /* Only return ACL_SUCCESS if this execute bit is not masked. */
424 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
425 result
= ACL_SUCCESS
;
430 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
433 if (ge_result
== ACL_ERROR
) {
434 perror("any_can_execute (acl_get_entry)");
447 * @brief Set @c acl as the default ACL on @c path if it's a directory.
449 * This overwrites any existing default ACL on @c path. If no default
450 * ACL exists, then one is created. If @c path is not a directory, we
451 * return ACL_FAILURE but no error is raised.
454 * The target directory whose ACL we wish to replace or create.
457 * The ACL to set as default on @c path.
460 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
461 * - @c ACL_FAILURE - If @c path is not a directory.
462 * - @c ACL_ERROR - Unexpected library error.
464 int assign_default_acl(const char* path
, acl_t acl
) {
468 perror("assign_default_acl (args)");
472 if (!is_path_directory(path
)) {
476 /* Our return value; success unless something bad happens. */
477 int result
= ACL_SUCCESS
;
478 acl_t path_acl
= acl_dup(acl
);
480 if (path_acl
== (acl_t
)NULL
) {
481 perror("assign_default_acl (acl_dup)");
482 return ACL_ERROR
; /* Nothing to clean up in this case. */
485 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
486 perror("assign_default_acl (acl_set_file)");
497 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
498 * descriptor, leaving the UNIX permission bits.
501 * The file descriptor whose ACLs we want to wipe.
504 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
505 * existed in the first place.
506 * - @c ACL_ERROR - Unexpected library error.
508 int wipe_acls(int fd
) {
509 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
510 acl_t empty_acl
= acl_init(0);
512 if (empty_acl
== (acl_t
)NULL
) {
513 perror("wipe_acls (acl_init)");
517 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
518 perror("wipe_acls (acl_set_fd)");
530 * @brief Apply parent default ACL to a path.
532 * This overwrites any existing ACLs on @c path.
535 * The path whose ACL we would like to reset to its default.
538 * A pointer to a stat structure for @c path, or @c NULL if you don't
541 * @param no_exec_mask
542 * The value (either true or false) of the --no-exec-mask flag.
545 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
546 * - @c ACL_FAILURE - The target path is not a regular file/directory,
547 * or the parent of @c path is not a directory.
548 * - @c ACL_ERROR - Unexpected library error.
550 int apply_default_acl(const char* path
,
551 const struct stat
* sp
,
556 perror("apply_default_acl (args)");
560 /* Define these next three variables here because we may have to
561 * jump to the cleanup routine which expects them to exist.
564 /* Our return value. */
565 int result
= ACL_SUCCESS
;
567 /* The default ACL on path's parent directory */
568 acl_t defacl
= (acl_t
)NULL
;
570 /* The file descriptor corresponding to "path" */
573 /* Split "path" into base/dirname parts to be used with openat().
574 * We duplicate the strings involved because dirname/basename mangle
577 char* path_copy
= strdup(path
);
578 if (path_copy
== NULL
) {
579 perror("apply_default_acl (strdup)");
582 char* parent
= dirname(path_copy
);
584 fd
= open(path
, O_NOFOLLOW
);
586 if (errno
== ELOOP
) {
587 result
= ACL_FAILURE
; /* hit a symlink */
591 perror("apply_default_acl (open fd)");
598 /* Refuse to operate on hard links, which can be abused by an
599 * attacker to trick us into changing the ACL on a file we didn't
600 * intend to; namely the "target" of the hard link. There is TOCTOU
601 * race condition here, but the window is as small as possible
602 * between when we open the file descriptor (look above) and when we
605 * Note: we only need to call fstat ourselves if we weren't passed a
606 * valid pointer to a stat structure (nftw does that).
610 if (fstat(fd
, &s
) == -1) {
611 perror("apply_default_acl (fstat)");
618 if (!S_ISDIR(sp
->st_mode
)) {
619 /* If it's not a directory, make sure it's a regular,
620 non-hard-linked file. */
621 if (!S_ISREG(sp
->st_mode
) || sp
->st_nlink
!= 1) {
622 result
= ACL_FAILURE
;
628 /* Default to not masking the exec bit; i.e. applying the default
629 ACL literally. If --no-exec-mask was not specified, then we try
630 to "guess" whether or not to mask the exec bit. This behavior
631 is modeled after the capital 'X' perms of setfacl. */
632 bool allow_exec
= true;
635 /* Never mask the execute bit on directories. */
636 int ace_result
= any_can_execute(fd
) || S_ISDIR(sp
->st_mode
);
638 if (ace_result
== ACL_ERROR
) {
639 perror("apply_default_acl (any_can_execute)");
644 allow_exec
= (bool)ace_result
;
647 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
649 if (defacl
== (acl_t
)NULL
) {
650 perror("apply_default_acl (acl_get_file)");
655 if (wipe_acls(fd
) == ACL_ERROR
) {
656 perror("apply_default_acl (wipe_acls)");
661 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
662 ACL with this one. */
663 acl_t acl
= acl_get_fd(fd
);
664 if (acl
== (acl_t
)NULL
) {
665 perror("apply_default_acl (acl_get_fd)");
670 /* If it's a directory, inherit the parent's default. */
671 if (assign_default_acl(path
, defacl
) == ACL_ERROR
) {
672 perror("apply_default_acl (assign_default_acl)");
678 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
680 while (ge_result
== ACL_SUCCESS
) {
681 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
683 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
684 perror("apply_default_acl (acl_get_tag_type)");
690 /* We've got an entry/tag from the default ACL. Get its permset. */
691 acl_permset_t permset
;
692 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
693 perror("apply_default_acl (acl_get_permset)");
698 /* If this is a default mask, fix it up. */
699 if (tag
== ACL_MASK
||
700 tag
== ACL_USER_OBJ
||
701 tag
== ACL_GROUP_OBJ
||
705 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
706 minimal ACLs) or acl_other entries, so if execute should be
707 masked, we have to do it manually. */
708 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
709 perror("apply_default_acl (acl_delete_perm)");
714 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
715 perror("apply_default_acl (acl_set_permset)");
722 /* Finally, add the permset to the access ACL. It's actually
723 * important that we pass in the address of "acl" here, and not
724 * "acl" itself. Why? The call to acl_create_entry() within
725 * acl_set_entry() can allocate new memory for the entry.
726 * Sometimes that can be done in-place, in which case everything
727 * is cool and the new memory gets released when we call
730 * But occasionally, the whole ACL structure will have to be moved
731 * in order to allocate the extra space. When that happens,
732 * acl_create_entry() modifies the pointer it was passed (in this
733 * case, &acl) to point to the new location. We want to call
734 * acl_free() on the new location, and since acl_free() gets
735 * called right here, we need acl_create_entry() to update the
736 * value of "acl". To do that, it needs the address of "acl".
738 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
739 perror("apply_default_acl (acl_set_entry)");
744 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
747 /* Catches the first acl_get_entry as well as the ones at the end of
749 if (ge_result
== ACL_ERROR
) {
750 perror("apply_default_acl (acl_get_entry)");
755 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
756 perror("apply_default_acl (acl_set_fd)");
763 if (defacl
!= (acl_t
)NULL
) {
766 if (fd
>= 0 && close(fd
) == -1) {
767 perror("apply_default_acl (close)");
776 * @brief Display program usage information.
778 * @param program_name
779 * The program name to use in the output.
782 void usage(const char* program_name
) {
783 printf("Apply any applicable default ACLs to the given files or "
785 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
788 printf(" -h, --help Print this help message\n");
789 printf(" -r, --recursive Act on any given directories recursively\n");
790 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
797 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
799 * For parameter information, see the @c nftw man page.
801 * @return If the ACL was applied to @c target successfully, we return
802 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
803 * the next file or directory. Otherwise, we return @c FTW_STOP to
807 int apply_default_acl_nftw(const char *target
,
808 const struct stat
*sp
,
812 if (apply_default_acl(target
, sp
, false)) {
823 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
825 * This is identical to @c apply_default_acl_nftw(), except it passes
826 * @c true to @c apply_default_acl() as its no_exec_mask argument.
829 int apply_default_acl_nftw_x(const char *target
,
830 const struct stat
*sp
,
834 if (apply_default_acl(target
, sp
, true)) {
845 * @brief Recursive version of @c apply_default_acl().
847 * If @c target is a directory, we use @c nftw() to call @c
848 * apply_default_acl() recursively on all of its children. Otherwise,
849 * we just delegate to @c apply_default_acl().
851 * We ignore symlinks for consistency with chmod -r.
854 * The root (path) of the recursive application.
856 * @param no_exec_mask
857 * The value (either true or false) of the --no-exec-mask flag.
860 * If @c target is not a directory, we return the result of
861 * calling @c apply_default_acl() on @c target. Otherwise, we convert
862 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
863 * then we return @c true. Otherwise, we return @c false.
865 * If there is an error, it will be reported via @c perror, but
866 * we still return @c false.
868 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
870 if (!is_path_directory(target
)) {
871 return apply_default_acl(target
, NULL
, no_exec_mask
);
874 int max_levels
= 256;
875 int flags
= FTW_PHYS
; /* Don't follow links. */
877 /* There are two separate functions that could be passed to
878 nftw(). One passes no_exec_mask = true to apply_default_acl(),
879 and the other passes no_exec_mask = false. Since the function we
880 pass to nftw() cannot have parameters, we have to create separate
881 options and make the decision here. */
882 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
883 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
885 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
887 if (nftw_result
== 0) {
892 /* nftw will return -1 on error, or if the supplied function
893 * (apply_default_acl_nftw) returns a non-zero result, nftw will
896 if (nftw_result
== -1) {
897 perror("apply_default_acl_recursive (nftw)");
906 * @brief Call apply_default_acl (possibly recursively) on each
907 * command-line argument.
909 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
910 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
913 int main(int argc
, char* argv
[]) {
920 bool recursive
= false;
921 bool no_exec_mask
= false;
923 struct option long_options
[] = {
924 /* These options set a flag. */
925 {"help", no_argument
, NULL
, 'h'},
926 {"recursive", no_argument
, NULL
, 'r'},
927 {"no-exec-mask", no_argument
, NULL
, 'x'},
933 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
950 int result
= EXIT_SUCCESS
;
953 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
954 const char* target
= argv
[arg_index
];
955 bool reapp_result
= false;
957 /* Make sure we can access the given path before we go out of our
958 * way to please it. Doing this check outside of
959 * apply_default_acl() lets us spit out a better error message for
962 if (!path_accessible(target
)) {
963 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
964 result
= EXIT_FAILURE
;
969 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
972 /* It's either a normal file, or we're not operating recursively. */
973 reapp_result
= apply_default_acl(target
, NULL
, no_exec_mask
);
977 result
= EXIT_FAILURE
;