X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=7989c985ab8bbf4a8329a64bedab1b7330336f71;hb=0e4810e0a4e3ca231c1c526729d74200d7fef031;hp=9c48b977d77adc90eb59306d12ed2549c24e6348;hpb=56883e0b8096b29cc545702f063f28619b593fe0;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 9c48b97..7989c98 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -1,114 +1,55 @@ /** * @file apply-default-acl.c * - * @brief The entire implementation. + * @brief The command-line interface. * */ -/* On Linux, ftw.h needs this special voodoo to work. */ -#define _XOPEN_SOURCE 500 -#define _GNU_SOURCE +#include /* EINVAL */ +#include /* AT_FOO constants */ +#include /* getopt_long() */ +#include /* the "bool" type */ +#include /* perror() */ +#include /* EXIT_FAILURE, EXIT_SUCCESS */ +#include /* faccessat() */ -#include -#include /* nftw() et al. */ -#include -#include /* dirname() */ -#include /* PATH_MAX */ -#include -#include -#include -#include -#include -#include +#include "libadacl.h" -/* ACLs */ -#include /* acl_get_perm, not portable */ -#include -#include - -/* Most of the libacl functions return 1 for success, 0 for failure, - and -1 on error */ -#define ACL_ERROR -1 -#define ACL_FAILURE 0 -#define ACL_SUCCESS 1 - - -/* Command-line options */ -static bool no_exec_mask = false; +/* We exit with EXIT_FAILURE for small errors, but we need something + * else for big ones. */ +#define EXIT_ERROR 2 +/* Prototypes */ +bool path_accessible(const char* path); +void usage(const char* program_name); /** - * @brief Get the mode bits from the given path. - * - * @param path - * The path (file or directory) whose mode we want. - * - * @return A mode_t (st_mode) structure containing the mode bits. - * See sys/stat.h for details. - */ -mode_t get_mode(const char* path) { - if (path == NULL) { - errno = ENOENT; - return -1; - } - - struct stat s; - int result = stat(path, &s); - - if (result == 0) { - return s.st_mode; - } - else { - /* errno will be set already by stat() */ - return result; - } -} - - - -/** - * @brief Determine whether or not the given path is a regular file. + * @brief Determine whether or not the given path is accessible. * * @param path * The path to test. * - * @return true if @c path is a regular file, false otherwise. + * @return true if @c path is accessible to the current effective + * user/group, false otherwise. */ -bool is_regular_file(const char* path) { +bool path_accessible(const char* path) { if (path == NULL) { return false; } - struct stat s; - int result = stat(path, &s); - if (result == 0) { - return S_ISREG(s.st_mode); - } - else { - return false; - } -} - + /* Test for access using the effective user and group rather than + the real one. */ + int flags = AT_EACCESS; + /* Don't follow symlinks when checking for a path's existence, + since we won't follow them to set its ACLs either. */ + flags |= AT_SYMLINK_NOFOLLOW; -/** - * @brief Determine whether or not the given path is a directory. - * - * @param path - * The path to test. - * - * @return true if @c path is a directory, false otherwise. - */ -bool is_directory(const char* path) { - if (path == NULL) { - return false; - } - - struct stat s; - int result = stat(path, &s); - if (result == 0) { - return S_ISDIR(s.st_mode); + /* If the path is relative, interpret it relative to the current + working directory (just like the access() system call). */ + if (faccessat(AT_FDCWD, path, F_OK, flags) == 0) { + return true; } else { return false; @@ -116,728 +57,54 @@ bool is_directory(const char* path) { } - -/** - * @brief Update (or create) an entry in an @b minimal ACL. - * - * This function will not work if @c aclp contains extended - * entries. This is fine for our purposes, since we call @c wipe_acls - * on each path before applying the default to it. - * - * The assumption that there are no extended entries makes things much - * simpler. For example, we only have to update the ACL_USER_OBJ, - * ACL_GROUP_OBJ, and ACL_OTHER entries -- all others can simply be - * created anew. This means we don't have to fool around comparing - * named-user/group entries. - * - * @param aclp - * A pointer to the acl_t structure whose entry we want to modify. - * - * @param entry - * The new entry. If @c entry contains a user/group/other entry, we - * update the existing one. Otherwise we create a new entry. - * - * @return If there is an unexpected library error, ACL_ERROR is - * returned. Otherwise, ACL_SUCCESS. - * - */ -int acl_set_entry(acl_t* aclp, - acl_entry_t entry) { - - acl_tag_t entry_tag; - int gt_result = acl_get_tag_type(entry, &entry_tag); - if (gt_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_tag_type)"); - return ACL_ERROR; - } - - acl_permset_t entry_permset; - int ps_result = acl_get_permset(entry, &entry_permset); - if (ps_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_permset)"); - return ACL_ERROR; - } - - acl_entry_t existing_entry; - /* Loop through the given ACL looking for matching entries. */ - int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry); - - while (result == ACL_SUCCESS) { - acl_tag_t existing_tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(existing_entry, &existing_tag); - - if (tag_result == ACL_ERROR) { - perror("set_acl_tag_permset (acl_get_tag_type)"); - return ACL_ERROR; - } - - if (existing_tag == entry_tag) { - if (entry_tag == ACL_USER_OBJ || - entry_tag == ACL_GROUP_OBJ || - entry_tag == ACL_OTHER) { - /* Only update for these three since all other tags will have - been wiped. These three are guaranteed to exist, so if we - match one of them, we're allowed to return ACL_SUCCESS - below and bypass the rest of the function. */ - acl_permset_t existing_permset; - int gep_result = acl_get_permset(existing_entry, &existing_permset); - if (gep_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_permset)"); - return ACL_ERROR; - } - - int s_result = acl_set_permset(existing_entry, entry_permset); - if (s_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_permset)"); - return ACL_ERROR; - } - - return ACL_SUCCESS; - } - - } - - result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry); - } - - /* This catches both the initial acl_get_entry and the ones at the - end of the loop. */ - if (result == ACL_ERROR) { - perror("acl_set_entry (acl_get_entry)"); - return ACL_ERROR; - } - - /* If we've made it this far, we need to add a new entry to the - ACL. */ - acl_entry_t new_entry; - - /* We allocate memory here that we should release! */ - int c_result = acl_create_entry(aclp, &new_entry); - if (c_result == ACL_ERROR) { - perror("acl_set_entry (acl_create_entry)"); - return ACL_ERROR; - } - - int st_result = acl_set_tag_type(new_entry, entry_tag); - if (st_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_tag_type)"); - return ACL_ERROR; - } - - int s_result = acl_set_permset(new_entry, entry_permset); - if (s_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_permset)"); - return ACL_ERROR; - } - - if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) { - /* We need to set the qualifier too. */ - void* entry_qual = acl_get_qualifier(entry); - if (entry_qual == (void*)NULL) { - perror("acl_set_entry (acl_get_qualifier)"); - return ACL_ERROR; - } - - int sq_result = acl_set_qualifier(new_entry, entry_qual); - if (sq_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_qualifier)"); - return ACL_ERROR; - } - } - - return ACL_SUCCESS; -} - - - -/** - * @brief Determine the number of entries in the given ACL. - * - * @param acl - * A pointer to an acl_t structure. - * - * @return Either the non-negative number of entries in @c acl, or - * ACL_ERROR on error. - */ -int acl_entry_count(acl_t* acl) { - - acl_entry_t entry; - int entry_count = 0; - int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry); - - while (result == ACL_SUCCESS) { - entry_count++; - result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry); - } - - if (result == ACL_ERROR) { - perror("acl_entry_count (acl_get_entry)"); - return ACL_ERROR; - } - - return entry_count; -} - - - -/** - * @brief Determine whether or not the given ACL is minimal. - * - * An ACL is minimal if it has fewer than four entries. - * - * @param acl - * A pointer to an acl_t structure. - * - * @return - * - ACL_SUCCESS - @c acl is minimal - * - ACL_FAILURE - @c acl is not minimal - * - ACL_ERROR - Unexpected library error - */ -int acl_is_minimal(acl_t* acl) { - - int ec = acl_entry_count(acl); - - if (ec == ACL_ERROR) { - perror("acl_is_minimal (acl_entry_count)"); - return ACL_ERROR; - } - - if (ec < 4) { - return ACL_SUCCESS; - } - else { - return ACL_FAILURE; - } -} - - - -/** - * @brief Determine whether the given path has an ACL whose mask - * denies execute. - * - * @param path - * The path to check. - * - * @return - * - ACL_SUCCESS - @c path has a mask which denies execute. - * - ACL_FAILURE - The ACL for @c path does not deny execute, - * or @c path has no extended ACL at all. - * - ACL_ERROR - Unexpected library error. - */ -int acl_execute_masked(const char* path) { - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("acl_execute_masked (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - - if (tag_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; - } - - if (tag == ACL_MASK) { - /* This is the mask entry, get its permissions, and see if - execute is specified. */ - acl_permset_t permset; - - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - int gp_result = acl_get_perm(permset, ACL_EXECUTE); - if (gp_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - if (gp_result == ACL_FAILURE) { - /* No execute bit set in the mask; execute not allowed. */ - return ACL_SUCCESS; - } - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - cleanup: - acl_free(acl); - return result; -} - - -/** - * @brief Determine whether @c path is executable (by anyone) or a - * directory. - * - * This is used as part of the heuristic to determine whether or not - * we should mask the execute bit when inheriting an ACL. If @c path - * is a directory, the answer is a clear-cut yes. This behavior is - * modeled after the capital 'X' perms of setfacl. - * - * If @c path is a file, we check the @a effective permissions, - * contrary to what setfacl does. - * - * @param path - * The path to check. - * - * @return - * - ACL_SUCCESS - @c path is a directory, or someone has effective - execute permissions. - * - ACL_FAILURE - @c path is a regular file and nobody can execute it. - * - ACL_ERROR - Unexpected library error. - */ -int any_can_execute_or_dir(const char* path) { - - if (is_directory(path)) { - /* That was easy... */ - return ACL_SUCCESS; - } - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("any_can_execute_or_dir (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; - - if (acl_is_minimal(&acl)) { - mode_t mode = get_mode(path); - if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { - result = ACL_SUCCESS; - goto cleanup; - } - else { - result = ACL_FAILURE; - goto cleanup; - } - } - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - acl_permset_t permset; - - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - int gp_result = acl_get_perm(permset, ACL_EXECUTE); - if (gp_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - if (gp_result == ACL_SUCCESS) { - /* Only return one if this execute bit is not masked. */ - if (acl_execute_masked(path) != ACL_SUCCESS) { - result = ACL_SUCCESS; - goto cleanup; - } - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - if (ge_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(acl); - return result; -} - - - /** - * @brief Inherit the default ACL from @c parent to @c path. - * - * The @c parent parameter does not necessarily need to be the parent - * of @c path, although that will usually be the case. This overwrites - * any existing default ACL on @c path. - * - * @param parent - * The parent directory whose ACL we want to inherit. + * @brief Display program usage information. * - * @param path - * The target directory whose ACL we wish to overwrite (or create). + * @param program_name + * The program name to use in the output. * - * @return - * - ACL_SUCCESS - The default ACL was inherited successfully. - * - ACL_FAILURE - Either @c parent or @c path is not a directory. - * - ACL_ERROR - Unexpected library error. */ -int inherit_default_acl(const char* path, const char* parent) { - /* Inherit the default ACL from parent to path. This overwrites any - * existing default ACL. Returns 1 for success, 0 for failure, and - * -1 on error. - */ - - /* Our return value. */ - int result = ACL_SUCCESS; - - if (path == NULL) { - errno = ENOENT; - return ACL_ERROR; - } - - if (!is_directory(path) || !is_directory(parent)) { - return ACL_FAILURE; - } - - acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT); - if (parent_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - acl_t path_acl = acl_dup(parent_acl); - - if (path_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_dup)"); - acl_free(parent_acl); - return ACL_ERROR; - } - - int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl); - if (sf_result == -1) { - perror("inherit_default_acl (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(path_acl); - return result; -} - - -int wipe_acls(const char* path) { - /* Remove ACL_USER, ACL_GROUP, and ACL_MASK entries from - path. Returns 1 for success, 0 for failure, and -1 on error. */ - - if (path == NULL) { - errno = ENOENT; - return ACL_ERROR; - } - - /* Finally, remove individual named/mask entries. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("wipe_acls (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_SUCCESS; - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - int d_result = acl_delete_entry(acl, entry); - if (d_result == ACL_ERROR) { - perror("wipe_acls (acl_delete_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("wipe_acls (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("wipe_acls (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(acl); - return result; -} - - -int apply_default_acl(const char* path) { - /* Really apply the default ACL by looping through it. Returns one - * for success, zero for failure (i.e. no ACL), and -1 on unexpected - * errors. - - */ - if (path == NULL) { - return ACL_FAILURE; - } - - if (!is_regular_file(path) && !is_directory(path)) { - return ACL_FAILURE; - } - - /* dirname mangles its argument */ - char path_copy[PATH_MAX]; - strncpy(path_copy, path, PATH_MAX-1); - path_copy[PATH_MAX-1] = 0; - - char* parent = dirname(path_copy); - if (!is_directory(parent)) { - /* Make sure dirname() did what we think it did. */ - return ACL_FAILURE; - } - - /* Default to not masking the exec bit; i.e. applying the default - ACL literally. If --no-exec-mask was not specified, then we try - to "guess" whether or not to mask the exec bit. */ - bool allow_exec = true; - - if (!no_exec_mask) { - int ace_result = any_can_execute_or_dir(path); - - if (ace_result == ACL_ERROR) { - perror("apply_default_acl (any_can_execute_or_dir)"); - return ACL_ERROR; - } - allow_exec = (bool)ace_result; - } - - acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); - - if (defacl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_SUCCESS; - - int wipe_result = wipe_acls(path); - if (wipe_result == ACL_ERROR) { - perror("apply_default_acl (wipe_acls)"); - result = ACL_ERROR; - goto cleanup; - } - - /* Do this after wipe_acls(), otherwise we'll overwrite the wiped - ACL with this one. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - /* If it's a directory, inherit the parent's default. */ - int inherit_result = inherit_default_acl(path, parent); - if (inherit_result == ACL_ERROR) { - perror("apply_default_acl (inherit_acls)"); - result = ACL_ERROR; - goto cleanup; - } - - acl_entry_t entry; - int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - - if (tag_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; - } - - - /* We've got an entry/tag from the default ACL. Get its permset. */ - acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - /* If this is a default mask, fix it up. */ - if (tag == ACL_MASK || - tag == ACL_USER_OBJ || - tag == ACL_GROUP_OBJ || - tag == ACL_OTHER) { - - if (!allow_exec) { - /* The mask doesn't affect acl_user_obj, acl_group_obj (in - minimal ACLs) or acl_other entries, so if execute should be - masked, we have to do it manually. */ - int d_result = acl_delete_perm(permset, ACL_EXECUTE); - if (d_result == ACL_ERROR) { - perror("apply_default_acl (acl_delete_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - int sp_result = acl_set_permset(entry, permset); - if (sp_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_permset)"); - result = ACL_ERROR; - goto cleanup; - } - } - } - - /* Finally, add the permset to the access ACL. */ - int set_result = acl_set_entry(&acl, entry); - if (set_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry); +void usage(const char* program_name) { + if (program_name == NULL) { + /* ??? */ + return; } - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(defacl); - return result; -} - - -void usage(char* program_name) { - /* - * Print usage information. - */ printf("Apply any applicable default ACLs to the given files or " - "directories.\n\n"); + "directories.\n\n"); printf("Usage: %s [flags] [ [ ...]]\n\n", - program_name); + program_name); printf("Flags:\n"); printf(" -h, --help Print this help message\n"); printf(" -r, --recursive Act on any given directories recursively\n"); - printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n"); return; } -int apply_default_acl_nftw(const char *target, - const struct stat *s, - int info, - struct FTW *ftw) { - /* A wrapper around the apply_default_acl() function for use with - * nftw(). We need to adjust the return value so that nftw() doesn't - * think we've failed. - */ - bool reapp_result = apply_default_acl(target); - if (reapp_result) { - return FTW_CONTINUE; - } - else { - return FTW_STOP; - } -} - - -bool apply_default_acl_recursive(const char *target) { - /* Attempt to apply default ACLs recursively. If target is a - * directory, we recurse through its entries. If not, we just - * apply the default ACL to target. - * - * We ignore symlinks for consistency with chmod -r. - * - */ - if (!is_directory(target)) { - return apply_default_acl(target); - } - - int max_levels = 256; - int flags = FTW_PHYS; /* Don't follow links. */ - - int nftw_result = nftw(target, - apply_default_acl_nftw, - max_levels, - flags); - - if (nftw_result == 0) { - /* Success */ - return true; - } - - /* nftw will return -1 on error, or if the supplied function - * (apply_default_acl_nftw) returns a non-zero result, nftw will - * return that. - */ - if (nftw_result == -1) { - perror("apply_default_acl_recursive (nftw)"); - } - - return false; -} +/** + * @brief Call apply_default_acl (possibly recursively) on each + * command-line argument. + * + * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything + * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return + * @c EXIT_FAILURE. + */ int main(int argc, char* argv[]) { - /* - * Call apply_default_acl on each command-line argument. - */ + if (argc < 2) { usage(argv[0]); return EXIT_FAILURE; } bool recursive = false; - /* bool no_exec_mask is declared static/global */ struct option long_options[] = { /* These options set a flag. */ {"help", no_argument, NULL, 'h'}, {"recursive", no_argument, NULL, 'r'}, - {"no-exec-mask", no_argument, NULL, 'x'}, {NULL, 0, NULL, 0} }; @@ -851,9 +118,6 @@ int main(int argc, char* argv[]) { case 'r': recursive = true; break; - case 'x': - no_exec_mask = true; - break; default: usage(argv[0]); return EXIT_FAILURE; @@ -863,21 +127,31 @@ int main(int argc, char* argv[]) { int result = EXIT_SUCCESS; int arg_index = 1; + int reapp_result = ACL_SUCCESS; for (arg_index = optind; arg_index < argc; arg_index++) { const char* target = argv[arg_index]; - bool reapp_result = false; - if (recursive) { - reapp_result = apply_default_acl_recursive(target); - } - else { - /* It's either normal file, or we're not operating recursively. */ - reapp_result = apply_default_acl(target); + /* Make sure we can access the given path before we go out of our + * way to please it. Doing this check outside of + * apply_default_acl() lets us spit out a better error message for + * typos, too. + */ + if (!path_accessible(target)) { + perror(target); + result = EXIT_FAILURE; + continue; } - if (!reapp_result) { + reapp_result = apply_default_acl(target, recursive); + + if (result == EXIT_SUCCESS && reapp_result == ACL_FAILURE) { + /* We don't want to turn an error into a (less-severe) failure. */ result = EXIT_FAILURE; } + if (reapp_result == ACL_ERROR) { + /* Turn both success and failure into an error, if we encounter one. */ + result = EXIT_ERROR; + } } return result;