X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=45dfa56fecfdf2a160673cb412eda9690bef2f29;hb=86257934b1ac9a26a9582544801528bc4b50fcb3;hp=022e2b87a6cc97e3816f6b84cd23d4a4910d4c8c;hpb=916bcfd577de83186c26cd4e110b8f750e781054;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 022e2b8..45dfa56 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -13,8 +13,8 @@ #include /* AT_FOO constants */ #include /* nftw() et al. */ #include -#include /* dirname() */ -#include /* PATH_MAX */ +#include /* basename(), dirname() */ +#include /* PATH_MAX */ #include #include #include @@ -34,82 +34,97 @@ #define ACL_SUCCESS 1 +int safe_open_ex(int at_fd, char* pathname, int flags) { + if (pathname != NULL && strlen(pathname) == 0) { + /* Oops, went one level to deep with nothing to do. */ + return at_fd; + } + + char* firstslash = strchr(pathname, '/'); + if (firstslash == NULL) { + /* No more slashes, this is the base case. */ + int r = openat(at_fd, pathname, flags); + return r; + } + + /* Temporarily disable the slash, so that the subsequent call to + openat() opens only the next directory (and doesn't recurse). */ + *firstslash = '\0'; + int fd = safe_open_ex(at_fd, pathname, flags); + if (fd == -1) { + if (errno != ELOOP) { + /* Don't output anything if we ignore a symlink */ + perror("safe_open_ex (safe_open_ex)"); + } + return -1; + } + + /* The ++ is safe because there needs to be at least a null byte + after the first slash, even if it's the last real character in + the string. */ + int result = safe_open_ex(fd, firstslash+1, flags); + if (close(fd) == -1) { + perror("safe_open_ex (close)"); + return -1; + } + return result; +} -/** - * @brief Get the mode bits from the given path. - * - * @param path - * The path (file or directory) whose mode we want. - * - * @return A mode_t (st_mode) structure containing the mode bits. - * See sys/stat.h for details. - */ -mode_t get_mode(const char* path) { - if (path == NULL) { - errno = ENOENT; + +int safe_open(const char* pathname, int flags) { + if (pathname == NULL || strlen(pathname) == 0 || pathname[0] == '\0') { + /* error? */ return -1; } - struct stat s; - int result = lstat(path, &s); - - if (result == 0) { - return s.st_mode; + char abspath[PATH_MAX]; + int snprintf_result = 0; + if (strchr(pathname, '/') == pathname) { + /* pathname is already absolute; just copy it. */ + snprintf_result = snprintf(abspath, PATH_MAX, "%s", pathname); } else { - /* errno will be set already by lstat() */ - return result; - } -} - - + /* Concatenate the current working directory and pathname into an + * absolute path. We use realpath() ONLY on the cwd part, and not + * on the pathname part, because realpath() resolves symlinks. And + * the whole point of all this crap is to avoid following symlinks + * in the pathname. + * + * Using realpath() on the cwd lets us operate on relative paths + * while we're sitting in a directory that happens to have a + * symlink in it; for example: cd /var/run && apply-default-acl foo. + */ + char* cwd = get_current_dir_name(); + if (cwd == NULL) { + perror("safe_open (get_current_dir_name)"); + return -1; + } -/** - * @brief Determine if the given path might refer to an (unsafe) hard link. - * - * @param path - * The path to test. - * - * @return true if we are certain that @c path does not refer to a hard - * link, and false otherwise. In case of error, false is returned, - * because we are not sure that @c path is not a hard link. - */ -bool is_hardlink_safe(const char* path) { - if (path == NULL) { - return false; - } - struct stat s; - int result = lstat(path, &s); - if (result == 0) { - return (s.st_nlink == 1 || S_ISDIR(s.st_mode)); + char abs_cwd[PATH_MAX]; + if (realpath(cwd, abs_cwd) == NULL) { + perror("safe_open (realpath)"); + free(cwd); + return -1; + } + snprintf_result = snprintf(abspath, PATH_MAX, "%s/%s", abs_cwd, pathname); + free(cwd); } - else { - return false; + if (snprintf_result == -1 || snprintf_result > PATH_MAX) { + perror("safe_open (snprintf)"); + return -1; } -} - -/** - * @brief Determine whether or not the given path is a regular file. - * - * @param path - * The path to test. - * - * @return true if @c path is a regular file, false otherwise. - */ -bool is_regular_file(const char* path) { - if (path == NULL) { - return false; + int fd = open("/", flags); + if (strcmp(abspath, "/") == 0) { + return fd; } - struct stat s; - int result = lstat(path, &s); - if (result == 0) { - return S_ISREG(s.st_mode); - } - else { - return false; + int result = safe_open_ex(fd, abspath+1, flags); + if (close(fd) == -1) { + perror("safe_open (close)"); + return -1; } + return result; } @@ -138,9 +153,7 @@ bool path_accessible(const char* path) { /* If the path is relative, interpret it relative to the current working directory (just like the access() system call). */ - int result = faccessat(AT_FDCWD, path, F_OK, flags); - - if (result == 0) { + if (faccessat(AT_FDCWD, path, F_OK, flags) == 0) { return true; } else { @@ -150,31 +163,6 @@ bool path_accessible(const char* path) { -/** - * @brief Determine whether or not the given path is a directory. - * - * @param path - * The path to test. - * - * @return true if @c path is a directory, false otherwise. - */ -bool is_directory(const char* path) { - if (path == NULL) { - return false; - } - - struct stat s; - int result = lstat(path, &s); - if (result == 0) { - return S_ISDIR(s.st_mode); - } - else { - return false; - } -} - - - /** * @brief Update (or create) an entry in an @b minimal ACL. * @@ -199,19 +187,16 @@ bool is_directory(const char* path) { * returned. Otherwise, @c ACL_SUCCESS. * */ -int acl_set_entry(acl_t* aclp, - acl_entry_t entry) { +int acl_set_entry(acl_t* aclp, acl_entry_t entry) { acl_tag_t entry_tag; - int gt_result = acl_get_tag_type(entry, &entry_tag); - if (gt_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &entry_tag) == ACL_ERROR) { perror("acl_set_entry (acl_get_tag_type)"); return ACL_ERROR; } acl_permset_t entry_permset; - int ps_result = acl_get_permset(entry, &entry_permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_get_permset)"); return ACL_ERROR; } @@ -222,9 +207,8 @@ int acl_set_entry(acl_t* aclp, while (result == ACL_SUCCESS) { acl_tag_t existing_tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(existing_entry, &existing_tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(existing_entry, &existing_tag) == ACL_ERROR) { perror("set_acl_tag_permset (acl_get_tag_type)"); return ACL_ERROR; } @@ -238,14 +222,12 @@ int acl_set_entry(acl_t* aclp, match one of them, we're allowed to return ACL_SUCCESS below and bypass the rest of the function. */ acl_permset_t existing_permset; - int gep_result = acl_get_permset(existing_entry, &existing_permset); - if (gep_result == ACL_ERROR) { + if (acl_get_permset(existing_entry, &existing_permset) == ACL_ERROR) { perror("acl_set_entry (acl_get_permset)"); return ACL_ERROR; } - int s_result = acl_set_permset(existing_entry, entry_permset); - if (s_result == ACL_ERROR) { + if (acl_set_permset(existing_entry, entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_set_permset)"); return ACL_ERROR; } @@ -269,21 +251,24 @@ int acl_set_entry(acl_t* aclp, ACL. */ acl_entry_t new_entry; - /* We allocate memory here that we should release! */ - int c_result = acl_create_entry(aclp, &new_entry); - if (c_result == ACL_ERROR) { + /* The acl_create_entry() function can allocate new memory and/or + * change the location of the ACL structure entirely. When that + * happens, the value pointed to by aclp is updated, which means + * that a new acl_t gets "passed out" to our caller, eventually to + * be fed to acl_free(). In other words, we should still be freeing + * the right thing, even if the value pointed to by aclp changes. + */ + if (acl_create_entry(aclp, &new_entry) == ACL_ERROR) { perror("acl_set_entry (acl_create_entry)"); return ACL_ERROR; } - int st_result = acl_set_tag_type(new_entry, entry_tag); - if (st_result == ACL_ERROR) { + if (acl_set_tag_type(new_entry, entry_tag) == ACL_ERROR) { perror("acl_set_entry (acl_set_tag_type)"); return ACL_ERROR; } - int s_result = acl_set_permset(new_entry, entry_permset); - if (s_result == ACL_ERROR) { + if (acl_set_permset(new_entry, entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_set_permset)"); return ACL_ERROR; } @@ -296,8 +281,7 @@ int acl_set_entry(acl_t* aclp, return ACL_ERROR; } - int sq_result = acl_set_qualifier(new_entry, entry_qual); - if (sq_result == ACL_ERROR) { + if (acl_set_qualifier(new_entry, entry_qual) == ACL_ERROR) { perror("acl_set_entry (acl_set_qualifier)"); return ACL_ERROR; } @@ -388,9 +372,8 @@ int acl_execute_masked(acl_t acl) { while (ge_result == ACL_SUCCESS) { acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { perror("acl_execute_masked (acl_get_tag_type)"); return ACL_ERROR; } @@ -400,8 +383,7 @@ int acl_execute_masked(acl_t acl) { execute is specified. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &permset) == ACL_ERROR) { perror("acl_execute_masked (acl_get_permset)"); return ACL_ERROR; } @@ -427,38 +409,30 @@ int acl_execute_masked(acl_t acl) { /** - * @brief Determine whether @c path is executable (by anyone) or a - * directory. + * @brief Determine whether @c fd is executable by anyone. + * * * This is used as part of the heuristic to determine whether or not - * we should mask the execute bit when inheriting an ACL. If @c path - * is a directory, the answer is a clear-cut yes. This behavior is - * modeled after the capital 'X' perms of setfacl. + * we should mask the execute bit when inheriting an ACL. If @c fd + * describes a file, we check the @a effective permissions, contrary + * to what setfacl does. * - * If @c path is a file, we check the @a effective permissions, - * contrary to what setfacl does. + * @param fd + * The file descriptor to check. * - * @param path - * The path to check. + * @param sp + * A pointer to a stat structure for @c fd. * * @return - * - @c ACL_SUCCESS - @c path is a directory, or someone has effective - execute permissions. - * - @c ACL_FAILURE - @c path is a regular file and nobody can execute - it. + * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd. + * - @c ACL_FAILURE - Nobody can execute @c fd. * - @c ACL_ERROR - Unexpected library error. */ -int any_can_execute_or_dir(const char* path) { - - if (is_directory(path)) { - /* That was easy... */ - return ACL_SUCCESS; - } - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); +int any_can_execute(int fd, const struct stat* sp) { + acl_t acl = acl_get_fd(fd); if (acl == (acl_t)NULL) { - perror("any_can_execute_or_dir (acl_get_file)"); + perror("any_can_execute (acl_get_file)"); return ACL_ERROR; } @@ -466,8 +440,7 @@ int any_can_execute_or_dir(const char* path) { int result = ACL_FAILURE; if (acl_is_minimal(acl)) { - mode_t mode = get_mode(path); - if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { + if (sp->st_mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { result = ACL_SUCCESS; goto cleanup; } @@ -484,10 +457,9 @@ int any_can_execute_or_dir(const char* path) { /* The first thing we do is check to see if this is a mask entry. If it is, we skip it entirely. */ acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - if (tag_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_tag_type)"); + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { + perror("any_can_execute_or (acl_get_tag_type)"); result = ACL_ERROR; goto cleanup; } @@ -500,16 +472,15 @@ int any_can_execute_or_dir(const char* path) { /* Ok, so it's not a mask entry. Check the execute perms. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_permset)"); + if (acl_get_permset(entry, &permset) == ACL_ERROR) { + perror("any_can_execute_or (acl_get_permset)"); result = ACL_ERROR; goto cleanup; } int gp_result = acl_get_perm(permset, ACL_EXECUTE); if (gp_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_perm)"); + perror("any_can_execute (acl_get_perm)"); result = ACL_ERROR; goto cleanup; } @@ -526,7 +497,7 @@ int any_can_execute_or_dir(const char* path) { } if (ge_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_entry)"); + perror("any_can_execute (acl_get_entry)"); result = ACL_ERROR; goto cleanup; } @@ -539,11 +510,10 @@ int any_can_execute_or_dir(const char* path) { /** - * @brief Set @c acl as the default ACL on @c path if it's a directory. + * @brief Set @c acl as the default ACL on @c path. * - * This overwrites any existing default ACL on @c path. If no default - * ACL exists, then one is created. If @c path is not a directory, we - * return ACL_FAILURE but no error is raised. + * This overwrites any existing default ACL on @c path. If @c path is + * not a directory, we return ACL_ERROR and @c errno is set. * * @param path * The target directory whose ACL we wish to replace or create. @@ -553,32 +523,27 @@ int any_can_execute_or_dir(const char* path) { * * @return * - @c ACL_SUCCESS - The default ACL was assigned successfully. - * - @c ACL_FAILURE - If @c path is not a directory. * - @c ACL_ERROR - Unexpected library error. */ int assign_default_acl(const char* path, acl_t acl) { if (path == NULL) { - errno = ENOENT; + errno = EINVAL; + perror("assign_default_acl (args)"); return ACL_ERROR; } - if (!is_directory(path)) { - return ACL_FAILURE; - } - - /* Our return value; success unless something bad happens. */ + /* Our return value; success unless something bad happens. */ int result = ACL_SUCCESS; acl_t path_acl = acl_dup(acl); if (path_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_dup)"); + perror("assign_default_acl (acl_dup)"); return ACL_ERROR; /* Nothing to clean up in this case. */ } - int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl); - if (sf_result == -1) { - perror("inherit_default_acl (acl_set_file)"); + if (acl_set_file(path, ACL_TYPE_DEFAULT, path_acl) == ACL_ERROR) { + perror("assign_default_acl (acl_set_file)"); result = ACL_ERROR; } @@ -589,65 +554,34 @@ int assign_default_acl(const char* path, acl_t acl) { /** - * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries - * from the given path. + * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file + * descriptor, leaving the UNIX permission bits. * - * @param path - * The path whose ACLs we want to wipe. + * @param fd + * The file descriptor whose ACLs we want to wipe. * * @return * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none * existed in the first place. * - @c ACL_ERROR - Unexpected library error. */ -int wipe_acls(const char* path) { +int wipe_acls(int fd) { + /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */ + acl_t empty_acl = acl_init(0); - if (path == NULL) { - errno = ENOENT; + if (empty_acl == (acl_t)NULL) { + perror("wipe_acls (acl_init)"); return ACL_ERROR; } - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("wipe_acls (acl_get_file)"); + if (acl_set_fd(fd, empty_acl) == ACL_ERROR) { + perror("wipe_acls (acl_set_fd)"); + acl_free(empty_acl); return ACL_ERROR; } - /* Our return value. */ - int result = ACL_SUCCESS; - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - int d_result = acl_delete_entry(acl, entry); - if (d_result == ACL_ERROR) { - perror("wipe_acls (acl_delete_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("wipe_acls (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("wipe_acls (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(acl); - return result; + acl_free(empty_acl); + return ACL_SUCCESS; } @@ -660,6 +594,10 @@ int wipe_acls(const char* path) { * @param path * The path whose ACL we would like to reset to its default. * + * @param sp + * A pointer to a stat structure for @c path, or @c NULL if you don't + * have one handy. + * * @param no_exec_mask * The value (either true or false) of the --no-exec-mask flag. * @@ -669,82 +607,111 @@ int wipe_acls(const char* path) { * or the parent of @c path is not a directory. * - @c ACL_ERROR - Unexpected library error. */ -int apply_default_acl(const char* path, bool no_exec_mask) { +int apply_default_acl(const char* path, + const struct stat* sp, + bool no_exec_mask) { if (path == NULL) { - errno = ENOENT; + errno = EINVAL; + perror("apply_default_acl (args)"); + return ACL_ERROR; + } + + /* Define these next three variables here because we may have to + * jump to the cleanup routine which expects them to exist. + */ + + /* Our return value. */ + int result = ACL_SUCCESS; + + /* The default ACL on path's parent directory */ + acl_t defacl = (acl_t)NULL; + + /* The file descriptor corresponding to "path" */ + int fd = 0; + + /* Get the parent directory of "path" with dirname(), which happens + * to murder its argument and necessitates a path_copy. + */ + char* path_copy = strdup(path); + if (path_copy == NULL) { + perror("apply_default_acl (strdup)"); return ACL_ERROR; } + char* parent = dirname(path_copy); + + fd = safe_open(path, O_NOFOLLOW); + if (fd == -1) { + if (errno == ELOOP) { + result = ACL_FAILURE; /* hit a symlink */ + goto cleanup; + } + else { + perror("apply_default_acl (open fd)"); + result = ACL_ERROR; + goto cleanup; + } + } + /* Refuse to operate on hard links, which can be abused by an * attacker to trick us into changing the ACL on a file we didn't - * intend to; namely the "target" of the hard link. To truly prevent - * that sort of mischief, we should be using file descriptors for - * the target and its parent directory. Then modulo a tiny race - * condition, we would be sure that "path" and "parent" don't change - * their nature between the time that we test them and when we - * utilize them. For contrast, the same attacker is free to replace - * "path" with a hard link after is_hardlink_safe() has returned - * "true" below. - * - * Unfortunately, our API is lacking in this area. For example, - * acl_set_fd() is only capable of setting the ACL_TYPE_ACCESS list, - * and not the ACL_TYPE_DEFAULT. Apparently the only way to operate - * on default ACLs is through the path name, which is inherently - * unreliable since the acl_*_file() calls themselves might follow - * links (both hard and symbolic). + * intend to; namely the "target" of the hard link. There is TOCTOU + * race condition here, but the window is as small as possible + * between when we open the file descriptor (look above) and when we + * fstat it. * - * Some improvement could still be made by using descriptors where - * possible -- this would shrink the exploit window -- but for now - * we use a naive implementation that only keeps honest men honest. + * Note: we only need to call fstat ourselves if we weren't passed a + * valid pointer to a stat structure (nftw does that). */ - if (!is_hardlink_safe(path)) { - return ACL_FAILURE; - } + if (sp == NULL) { + struct stat s; + if (fstat(fd, &s) == -1) { + perror("apply_default_acl (fstat)"); + goto cleanup; + } - if (!is_regular_file(path) && !is_directory(path)) { - return ACL_FAILURE; + sp = &s; } - /* dirname mangles its argument */ - char path_copy[PATH_MAX]; - strncpy(path_copy, path, PATH_MAX-1); - path_copy[PATH_MAX-1] = 0; - - char* parent = dirname(path_copy); - if (!is_directory(parent)) { - /* Make sure dirname() did what we think it did. */ - return ACL_FAILURE; + if (!S_ISDIR(sp->st_mode)) { + /* If it's not a directory, make sure it's a regular, + non-hard-linked file. */ + if (!S_ISREG(sp->st_mode) || sp->st_nlink != 1) { + result = ACL_FAILURE; + goto cleanup; + } } + /* Default to not masking the exec bit; i.e. applying the default ACL literally. If --no-exec-mask was not specified, then we try - to "guess" whether or not to mask the exec bit. */ + to "guess" whether or not to mask the exec bit. This behavior + is modeled after the capital 'X' perms of setfacl. */ bool allow_exec = true; if (!no_exec_mask) { - int ace_result = any_can_execute_or_dir(path); + /* Never mask the execute bit on directories. */ + int ace_result = any_can_execute(fd,sp) || S_ISDIR(sp->st_mode); if (ace_result == ACL_ERROR) { - perror("apply_default_acl (any_can_execute_or_dir)"); - return ACL_ERROR; + perror("apply_default_acl (any_can_execute)"); + result = ACL_ERROR; + goto cleanup; } allow_exec = (bool)ace_result; } - acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); + defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); if (defacl == (acl_t)NULL) { perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; + result = ACL_ERROR; + goto cleanup; } - /* Our return value. */ - int result = ACL_SUCCESS; - - int wipe_result = wipe_acls(path); - if (wipe_result == ACL_ERROR) { + if (wipe_acls(fd) == ACL_ERROR) { perror("apply_default_acl (wipe_acls)"); result = ACL_ERROR; goto cleanup; @@ -752,16 +719,21 @@ int apply_default_acl(const char* path, bool no_exec_mask) { /* Do this after wipe_acls(), otherwise we'll overwrite the wiped ACL with this one. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); + acl_t acl = acl_get_fd(fd); if (acl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; + perror("apply_default_acl (acl_get_fd)"); + result = ACL_ERROR; + goto cleanup; } - /* If it's a directory, inherit the parent's default. */ - int inherit_result = assign_default_acl(path, defacl); - if (inherit_result == ACL_ERROR) { - perror("apply_default_acl (inherit_acls)"); + /* If it's a directory, inherit the parent's default. We sure hope + * that "path" still points to the same thing that "fd" and this + * "sp" describe. If not, we may wind up trying to set a default ACL + * on a file, and this will throw an error. I guess that's what we + * want to do? + */ + if (S_ISDIR(sp->st_mode) && assign_default_acl(path, defacl) == ACL_ERROR) { + perror("apply_default_acl (assign_default_acl)"); result = ACL_ERROR; goto cleanup; } @@ -771,9 +743,8 @@ int apply_default_acl(const char* path, bool no_exec_mask) { while (ge_result == ACL_SUCCESS) { acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { perror("apply_default_acl (acl_get_tag_type)"); result = ACL_ERROR; goto cleanup; @@ -782,8 +753,7 @@ int apply_default_acl(const char* path, bool no_exec_mask) { /* We've got an entry/tag from the default ACL. Get its permset. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &permset) == ACL_ERROR) { perror("apply_default_acl (acl_get_permset)"); result = ACL_ERROR; goto cleanup; @@ -799,15 +769,13 @@ int apply_default_acl(const char* path, bool no_exec_mask) { /* The mask doesn't affect acl_user_obj, acl_group_obj (in minimal ACLs) or acl_other entries, so if execute should be masked, we have to do it manually. */ - int d_result = acl_delete_perm(permset, ACL_EXECUTE); - if (d_result == ACL_ERROR) { + if (acl_delete_perm(permset, ACL_EXECUTE) == ACL_ERROR) { perror("apply_default_acl (acl_delete_perm)"); result = ACL_ERROR; goto cleanup; } - int sp_result = acl_set_permset(entry, permset); - if (sp_result == ACL_ERROR) { + if (acl_set_permset(entry, permset) == ACL_ERROR) { perror("apply_default_acl (acl_set_permset)"); result = ACL_ERROR; goto cleanup; @@ -815,9 +783,23 @@ int apply_default_acl(const char* path, bool no_exec_mask) { } } - /* Finally, add the permset to the access ACL. */ - int set_result = acl_set_entry(&acl, entry); - if (set_result == ACL_ERROR) { + /* Finally, add the permset to the access ACL. It's actually + * important that we pass in the address of "acl" here, and not + * "acl" itself. Why? The call to acl_create_entry() within + * acl_set_entry() can allocate new memory for the entry. + * Sometimes that can be done in-place, in which case everything + * is cool and the new memory gets released when we call + * acl_free(acl). + * + * But occasionally, the whole ACL structure will have to be moved + * in order to allocate the extra space. When that happens, + * acl_create_entry() modifies the pointer it was passed (in this + * case, &acl) to point to the new location. We want to call + * acl_free() on the new location, and since acl_free() gets + * called right here, we need acl_create_entry() to update the + * value of "acl". To do that, it needs the address of "acl". + */ + if (acl_set_entry(&acl, entry) == ACL_ERROR) { perror("apply_default_acl (acl_set_entry)"); result = ACL_ERROR; goto cleanup; @@ -834,15 +816,21 @@ int apply_default_acl(const char* path, bool no_exec_mask) { goto cleanup; } - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_file)"); + if (acl_set_fd(fd, acl) == ACL_ERROR) { + perror("apply_default_acl (acl_set_fd)"); result = ACL_ERROR; goto cleanup; } cleanup: - acl_free(defacl); + free(path_copy); + if (defacl != (acl_t)NULL) { + acl_free(defacl); + } + if (fd >= 0 && close(fd) == -1) { + perror("apply_default_acl (close)"); + result = ACL_ERROR; + } return result; } @@ -881,12 +869,11 @@ void usage(const char* program_name) { * */ int apply_default_acl_nftw(const char *target, - const struct stat *s, + const struct stat *sp, int info, struct FTW *ftw) { - bool app_result = apply_default_acl(target, false); - if (app_result) { + if (apply_default_acl(target, sp, false)) { return FTW_CONTINUE; } else { @@ -904,12 +891,11 @@ int apply_default_acl_nftw(const char *target, * */ int apply_default_acl_nftw_x(const char *target, - const struct stat *s, + const struct stat *sp, int info, struct FTW *ftw) { - bool app_result = apply_default_acl(target, true); - if (app_result) { + if (apply_default_acl(target, sp, true)) { return FTW_CONTINUE; } else { @@ -944,11 +930,6 @@ int apply_default_acl_nftw_x(const char *target, * we still return @c false. */ bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { - - if (!is_directory(target)) { - return apply_default_acl(target, no_exec_mask); - } - int max_levels = 256; int flags = FTW_PHYS; /* Don't follow links. */ @@ -1048,7 +1029,7 @@ int main(int argc, char* argv[]) { } else { /* It's either a normal file, or we're not operating recursively. */ - reapp_result = apply_default_acl(target, no_exec_mask); + reapp_result = apply_default_acl(target, NULL, no_exec_mask); } if (!reapp_result) {