X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=7989c985ab8bbf4a8329a64bedab1b7330336f71;hb=HEAD;hp=2111e0eeda08b1b16335710b82a4936f2e353ae7;hpb=2ab9ebe178bc7ef6f1d65dc465712f4fe18b4b50;p=apply-default-acl.git

diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c
index 2111e0e..7989c98 100644
--- a/src/apply-default-acl.c
+++ b/src/apply-default-acl.c
@@ -1,76 +1,55 @@
-/* On Linux, ftw.h needs this special voodoo to work. */
-#define _XOPEN_SOURCE 500
-
-#include <errno.h>
-#include <ftw.h>    /* nftw() et al. */
-#include <getopt.h>
-#include <libgen.h> /* dirname()     */
-#include <limits.h> /* PATH_MAX      */
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-/* ACLs */
-#include <acl/libacl.h> /* acl_get_perm, not portable */
-#include <sys/types.h>
-#include <sys/acl.h>
-
-
-mode_t get_mode(const char* path) {
-  /*
-   * Get the mode bits from path.
-   */
-  if (path == NULL) {
-    errno = ENOENT;
-    return -1;
-  }
-
-  struct stat s;
-  int result = stat(path, &s);
-
-  if (result == 0) {
-    return s.st_mode;
-  }
-  else {
-    /* errno will be set already by stat() */
-    return result;
-  }
-}
-
-
-bool is_regular_file(const char* path) {
-  /*
-   * Returns true if path is a regular file, false otherwise.
-   */
+/**
+ * @file apply-default-acl.c
+ *
+ * @brief The command-line interface.
+ *
+ */
+
+#include <errno.h>   /* EINVAL */
+#include <fcntl.h>   /* AT_FOO constants */
+#include <getopt.h>  /* getopt_long() */
+#include <stdbool.h> /* the "bool" type */
+#include <stdio.h>   /* perror() */
+#include <stdlib.h>  /* EXIT_FAILURE, EXIT_SUCCESS */
+#include <unistd.h>  /* faccessat() */
+
+#include "libadacl.h"
+
+/* We exit with EXIT_FAILURE for small errors, but we need something
+ * else for big ones. */
+#define EXIT_ERROR 2
+
+/* Prototypes */
+bool path_accessible(const char* path);
+void usage(const char* program_name);
+
+
+/**
+ * @brief Determine whether or not the given path is accessible.
+ *
+ * @param path
+ *   The path to test.
+ *
+ * @return true if @c path is accessible to the current effective
+ *   user/group, false otherwise.
+ */
+bool path_accessible(const char* path) {
   if (path == NULL) {
     return false;
   }
 
-  struct stat s;
-  int result = stat(path, &s);
-  if (result == 0) {
-    return S_ISREG(s.st_mode);
-  }
-  else {
-    return false;
-  }
-}
+  /*  Test for access using the effective user and group rather than
+      the real one. */
+  int flags = AT_EACCESS;
 
-bool is_directory(const char* path) {
-  /*
-   * Returns true if path is a directory, false otherwise.
-   */
-  if (path == NULL) {
-    return false;
-  }
+  /* Don't follow symlinks when checking for a path's existence,
+     since we won't follow them to set its ACLs either. */
+  flags |= AT_SYMLINK_NOFOLLOW;
 
-  struct stat s;
-  int result = stat(path, &s);
-  if (result == 0) {
-    return S_ISDIR(s.st_mode);
+  /* If the path is relative, interpret it relative to the current
+     working directory (just like the access() system call). */
+  if (faccessat(AT_FDCWD, path, F_OK, flags) == 0) {
+    return true;
   }
   else {
     return false;
@@ -78,622 +57,48 @@ bool is_directory(const char* path) {
 }
 
 
-
-int acl_set_entry(acl_t* aclp,
-		  acl_entry_t entry) {
-  /*
-   * Update or create the given entry.
-   */
-
-  acl_tag_t entry_tag;
-  int gt_result = acl_get_tag_type(entry, &entry_tag);
-  if (gt_result == -1) {
-    perror("acl_set_entry (acl_get_tag_type)");
-    return -1;
-  }
-
-  acl_permset_t entry_permset;
-  int ps_result = acl_get_permset(entry, &entry_permset);
-  if (ps_result == -1) {
-    perror("acl_set_entry (acl_get_permset)");
-    return -1;
-  }
-
-  acl_entry_t existing_entry;
-  /* Loop through the given ACL looking for matching entries. */
-  int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);
-
-  while (result == 1) {
-    acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
-    int tag_result = acl_get_tag_type(existing_entry, &existing_tag);
-
-    if (tag_result == -1) {
-       perror("set_acl_tag_permset (acl_get_tag_type)");
-       return -1;
-    }
-
-    if (existing_tag == entry_tag) {
-      if (entry_tag == ACL_USER_OBJ ||
-	  entry_tag == ACL_GROUP_OBJ ||
-	  entry_tag == ACL_OTHER) {
-	/* Only update for these three since all other tags will have
-	   been wiped. */
-	acl_permset_t existing_permset;
-	int gep_result = acl_get_permset(existing_entry, &existing_permset);
-	if (gep_result == -1) {
-	  perror("acl_set_entry (acl_get_permset)");
-	  return -1;
-	}
-
-	int s_result = acl_set_permset(existing_entry, entry_permset);
-	if (s_result == -1) {
-	  perror("acl_set_entry (acl_set_permset)");
-	  return -1;
-	}
-
-	return 1;
-      }
-
-    }
-
-    result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
-  }
-
-  /* This catches both the initial acl_get_entry and the ones at the
-     end of the loop. */
-  if (result == -1) {
-    perror("acl_set_entry (acl_get_entry)");
-    return -1;
-  }
-
-  /* If we've made it this far, we need to add a new entry to the
-     ACL. */
-  acl_entry_t new_entry;
-
-  /* We allocate memory here that we should release! */
-  int c_result = acl_create_entry(aclp, &new_entry);
-  if (c_result == -1) {
-    perror("acl_set_entry (acl_create_entry)");
-    return -1;
-  }
-
-  int st_result = acl_set_tag_type(new_entry, entry_tag);
-  if (st_result == -1) {
-    perror("acl_set_entry (acl_set_tag_type)");
-    return -1;
-  }
-
-  int s_result = acl_set_permset(new_entry, entry_permset);
-  if (s_result == -1) {
-    perror("acl_set_entry (acl_set_permset)");
-    return -1;
-  }
-
-  if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
-    /* We need to set the qualifier too. */
-    void* entry_qual = acl_get_qualifier(entry);
-    if (entry_qual == (void*)NULL) {
-      perror("acl_set_entry (acl_get_qualifier)");
-      return -1;
-    }
-
-    int sq_result = acl_set_qualifier(new_entry, entry_qual);
-    if (sq_result == -1) {
-      perror("acl_set_entry (acl_set_qualifier)");
-      return -1;
-    }
-  }
-
-  return 1;
-}
-
-
-
-int acl_entry_count(acl_t* acl) {
-  /*
-   * Return the number of entries in acl, or -1 on error.
-   */
-  acl_entry_t entry;
-  int entry_count = 0;
-  int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry);
-
-  while (result == 1) {
-    entry_count++;
-    result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry);
-  }
-
-  if (result == -1) {
-    perror("acl_is_minimal (acl_get_entry)");
-    return -1;
-  }
-
-  return entry_count;
-}
-
-
-int acl_is_minimal(acl_t* acl) {
-  /* An ACL is minimal if it has fewer than four entries. Return 0 for
-   * false, 1 for true, and -1 on error.
-   */
-
-  int ec = acl_entry_count(acl);
-  if (ec == -1) {
-    perror("acl_is_minimal (acl_entry_count)");
-    return -1;
-  }
-
-  if (ec < 4) {
-    return 1;
-  }
-  else {
-    return 0;
-  }
-}
-
-
-int acl_execute_masked(const char* path) {
-  /* Returns 1 i the given path has an ACL mask which denies
-     execute. Returns 0 if it does not (or if it has no ACL/mask at
-     all), and -1 on error. */
-
-  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
-
-  if (acl == (acl_t)NULL) {
-    return 0;
-  }
-
-  /* Our return value. */
-  int result = 0;
-
-  acl_entry_t entry;
-  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
-
-  while (ge_result == 1) {
-    acl_tag_t tag = ACL_UNDEFINED_TAG;
-    int tag_result = acl_get_tag_type(entry, &tag);
-
-    if (tag_result == -1) {
-       perror("acl_execute_masked (acl_get_tag_type)");
-       result = -1;
-       goto cleanup;
-    }
-
-    if (tag == ACL_MASK) {
-      /* This is the mask entry, get its permissions, and see if
-	 execute is specified. */
-      acl_permset_t permset;
-
-      int ps_result = acl_get_permset(entry, &permset);
-      if (ps_result == -1) {
-	perror("acl_execute_masked (acl_get_permset)");
-	result = -1;
-	goto cleanup;
-      }
-
-      int gp_result = acl_get_perm(permset, ACL_EXECUTE);
-      if (gp_result == -1) {
-	perror("acl_execute_masked (acl_get_perm)");
-	result = -1;
-	goto cleanup;
-      }
-
-      if (gp_result == 0) {
-	/* No execute bit set in the mask; execute not allowed. */
-	return 1;
-      }
-    }
-
-    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
-  }
-
- cleanup:
-  acl_free(acl);
-  return result;
-}
-
-
-int any_can_execute_or_dir(const char* path) {
-  /* If the given path is a directory, returns 1. Otherwise, returns 1
-   * if any ACL entry has EFFECTIVE execute access, 0 if none do, and
-   * -1 on error.
-   *
-   * This is meant to somewhat mimic setfacl's handling of the capital
-   * 'X' perm, which allows execute access if the target is a
-   * directory or someone can already execute it. We differ in that we
-   * check the effective execute rather than just the execute bits.
-   */
-
-  if (is_directory(path)) {
-    /* That was easy... */
-    return 1;
-  }
-
-  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
-
-  if (acl == (acl_t)NULL) {
-    return 0;
-  }
-
-  /* Our return value. */
-  int result = 0;
-
-  if (acl_is_minimal(&acl)) {
-    mode_t mode = get_mode(path);
-    if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
-      result = 1;
-      goto cleanup;
-    }
-    else {
-      result = 0;
-      goto cleanup;
-    }
-  }
-
-  acl_entry_t entry;
-  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
-
-  while (ge_result == 1) {
-    acl_permset_t permset;
-
-    int ps_result = acl_get_permset(entry, &permset);
-    if (ps_result == -1) {
-      perror("any_can_execute_or_dir (acl_get_permset)");
-      result = -1;
-      goto cleanup;
-    }
-
-    int gp_result = acl_get_perm(permset, ACL_EXECUTE);
-    if (gp_result == -1) {
-      perror("any_can_execute_or_dir (acl_get_perm)");
-      result = -1;
-      goto cleanup;
-    }
-
-    if (gp_result == 1) {
-      /* Only return one if this execute bit is not masked. */
-      if (acl_execute_masked(path) != 1) {
-	result = 1;
-	goto cleanup;
-      }
-    }
-
-    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
-  }
-
-  if (ge_result == -1) {
-    perror("any_can_execute_or_dir (acl_get_entry)");
-    result = -1;
-    goto cleanup;
-  }
-
- cleanup:
-  acl_free(acl);
-  return result;
-}
-
-
-int inherit_default_acl(const char* path, const char* parent) {
-  /* Inherit the default ACL from parent to path. This overwrites any
-   * existing default ACL. Returns 1 for success, 0 for failure, and
-   * -1 on error.
-   */
-
-  /* Our return value. */
-  int result = 1;
-
-  if (path == NULL) {
-    errno = ENOENT;
-    return -1;
-  }
-
-  if (!is_directory(path) || !is_directory(parent)) {
-    return 0;
-  }
-
-  acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT);
-  if (parent_acl == (acl_t)NULL) {
-    return 0;
-  }
-
-  acl_t path_acl = acl_dup(parent_acl);
-
-  if (path_acl == (acl_t)NULL) {
-    perror("inherit_default_acl (acl_dup)");
-    acl_free(parent_acl);
-    return -1;
-  }
-
-  int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
-  if (sf_result == -1) {
-    perror("inherit_default_acl (acl_set_file)");
-    result = -1;
-    goto cleanup;
-  }
-
- cleanup:
-  acl_free(path_acl);
-  return result;
-}
-
-
-int wipe_acls(const char* path) {
-  /* Remove ACL_USER, ACL_GROUP, and ACL_MASK entries from
-     path. Returns 1 for success, 0 for failure, and -1 on error. */
-
-  if (path == NULL) {
-    errno = ENOENT;
-    return -1;
-  }
-
-  /* Finally, remove individual named/mask entries. */
-  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
-  if (acl == (acl_t)NULL) {
-    perror("wipe_acls (acl_get_file)");
-    return -1;
-  }
-
-  /* Our return value. */
-  int result = 1;
-
-  acl_entry_t entry;
-  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
-
-  while (ge_result == 1) {
-    int d_result = acl_delete_entry(acl, entry);
-    if (d_result == -1) {
-      perror("wipe_acls (acl_delete_entry)");
-      result = -1;
-      goto cleanup;
-    }
-
-    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
-  }
-
-  /* Catches the first acl_get_entry as well as the ones at the end of
-     the loop. */
-  if (ge_result == -1) {
-    perror("wipe_acls (acl_get_entry)");
-    result = -1;
-    goto cleanup;
-  }
-
-  int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
-  if (sf_result == -1) {
-    perror("wipe_acls (acl_set_file)");
-    result = -1;
-    goto cleanup;
-  }
-
- cleanup:
-  acl_free(acl);
-  return result;
-}
-
-
-int apply_default_acl(const char* path) {
-  /* Really apply the default ACL by looping through it. Returns one
-   * for success, zero for failure (i.e. no ACL), and -1 on unexpected
-   * errors.
-   */
-  if (path == NULL) {
-    return 0;
-  }
-
-  if (!is_regular_file(path) && !is_directory(path)) {
-    return 0;
+/**
+ * @brief Display program usage information.
+ *
+ * @param program_name
+ *   The program name to use in the output.
+ *
+ */
+void usage(const char* program_name) {
+  if (program_name == NULL) {
+    /* ??? */
+    return;
   }
 
-  /* dirname mangles its argument */
-  char path_copy[PATH_MAX];
-  strncpy(path_copy, path, PATH_MAX-1);
-  path_copy[PATH_MAX-1] = 0;
-
-  char* parent = dirname(path_copy);
-  if (!is_directory(parent)) {
-    /* Make sure dirname() did what we think it did. */
-    return 0;
-  }
-
-  int ace_result = any_can_execute_or_dir(path);
-  if (ace_result == -1) {
-    perror("apply_default_acl (any_can_execute_or_dir)");
-    return -1;
-  }
-
-  bool allow_exec = (bool)ace_result;
-
-  acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);
-
-  if (defacl == (acl_t)NULL) {
-    perror("apply_default_acl (acl_get_file)");
-    return -1;
-  }
-
-  /* Our return value. */
-  int result = 1;
-
-  int wipe_result = wipe_acls(path);
-  if (wipe_result == -1) {
-    perror("apply_default_acl (wipe_acls)");
-    result = -1;
-    goto cleanup;
-  }
-
-  /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
-     ACL with this one. */
-  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
-  if (acl == (acl_t)NULL) {
-    perror("apply_default_acl (acl_get_file)");
-    return -1;
-  }
-
-  /* If it's a directory, inherit the parent's default. */
-  int inherit_result = inherit_default_acl(path, parent);
-  if (inherit_result == -1) {
-    perror("apply_default_acl (inherit_acls)");
-    result = -1;
-    goto cleanup;
-  }
-
-  acl_entry_t entry;
-  int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
-
-  while (ge_result == 1) {
-    acl_tag_t tag = ACL_UNDEFINED_TAG;
-    int tag_result = acl_get_tag_type(entry, &tag);
-
-    if (tag_result == -1) {
-       perror("apply_default_acl (acl_get_tag_type)");
-       result = -1;
-       goto cleanup;
-    }
-
-
-    /* We've got an entry/tag from the default ACL. Get its permset. */
-    acl_permset_t permset;
-    int ps_result = acl_get_permset(entry, &permset);
-    if (ps_result == -1) {
-      perror("apply_default_acl (acl_get_permset)");
-      result = -1;
-      goto cleanup;
-    }
-
-    /* If this is a default mask, fix it up. */
-    if (tag == ACL_MASK ||
-	tag == ACL_USER_OBJ ||
-	tag == ACL_GROUP_OBJ ||
-	tag == ACL_OTHER) {
-      if (!allow_exec) {
-	/* The mask doesn't affect acl_user_obj, acl_group_obj (in
-	   minimal ACLs) or acl_other entries, so if execute should be
-	   masked, we have to do it manually. */
-	int d_result = acl_delete_perm(permset, ACL_EXECUTE);
-	if (d_result == -1) {
-	  perror("apply_default_acl (acl_delete_perm)");
-	  result = -1;
-	  goto cleanup;
-	}
-
-	int sp_result = acl_set_permset(entry, permset);
-	if (sp_result == -1) {
-	  perror("apply_default_acl (acl_set_permset)");
-	  result = -1;
-	  goto cleanup;
-	}
-      }
-    }
-
-    /* Finally, add the permset to the access ACL. */
-    int set_result = acl_set_entry(&acl, entry);
-    if (set_result == -1) {
-      perror("apply_default_acl (acl_set_entry)");
-      result = -1;
-      goto cleanup;
-    }
-
-    ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
-  }
-
-  /* Catches the first acl_get_entry as well as the ones at the end of
-     the loop. */
-  if (ge_result == -1) {
-    perror("apply_default_acl (acl_get_entry)");
-    result = -1;
-    goto cleanup;
-  }
-
-  int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
-  if (sf_result == -1) {
-    perror("apply_default_acl (acl_set_file)");
-    result = -1;
-    goto cleanup;
-  }
-
- cleanup:
-  acl_free(defacl);
-  return result;
-}
-
-
-void usage(char* program_name) {
-  /*
-   * Print usage information.
-   */
   printf("Apply any applicable default ACLs to the given files or "
-	 "directories.\n\n");
+         "directories.\n\n");
   printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
-	 program_name);
+         program_name);
   printf("Flags:\n");
   printf(" -h, --help         Print this help message\n");
   printf(" -r, --recursive    Act on any given directories recursively\n");
-}
 
-
-int apply_default_acl_nftw(const char *target,
-			     const struct stat *s,
-			     int info,
-			     struct FTW *ftw) {
-  /* A wrapper around the apply_default_acl() function for use with
-   * nftw(). We need to adjust the return value so that nftw() doesn't
-   * think we've failed.
-   */
-  bool reapp_result = apply_default_acl(target);
-  if (reapp_result) {
-    return 0;
-  }
-  else {
-    return 1;
-  }
+  return;
 }
 
 
-bool apply_default_acl_recursive(const char *target) {
-  /* Attempt to apply default ACLs recursively. If target is a
-   * directory, we recurse through its entries. If not, we just
-   * apply the default ACL to target.
-   *
-   * We ignore symlinks for consistency with chmod -r.
-   *
-   */
-  if (!is_directory(target)) {
-    return apply_default_acl(target);
-  }
-
-  int max_levels = 256;
-  int flags = FTW_PHYS; /* Don't follow links. */
-
-  int nftw_result = nftw(target,
-			 apply_default_acl_nftw,
-			 max_levels,
-			 flags);
-
-  if (nftw_result == 0) {
-    /* Success */
-    return true;
-  }
-
-  /* nftw will return -1 on error, or if the supplied function
-   * (apply_default_acl_nftw) returns a non-zero result, nftw will
-   * return that.
-   */
-  if (nftw_result == -1) {
-    perror("apply_default_acl_recursive (nftw)");
-  }
-
-  return false;
-}
 
 
+/**
+ * @brief Call apply_default_acl (possibly recursively) on each
+ * command-line argument.
+ *
+ * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
+ *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
+ *   @c EXIT_FAILURE.
+ */
 int main(int argc, char* argv[]) {
-  /*
-   * Call apply_default_acl on each command-line argument.
-   */
+
   if (argc < 2) {
     usage(argv[0]);
     return EXIT_FAILURE;
   }
 
-
   bool recursive = false;
 
   struct option long_options[] = {
@@ -705,7 +110,7 @@ int main(int argc, char* argv[]) {
 
   int opt = 0;
 
-  while ((opt = getopt_long(argc, argv, "hr", long_options, NULL)) != -1) {
+  while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
     switch (opt) {
     case 'h':
       usage(argv[0]);
@@ -722,21 +127,31 @@ int main(int argc, char* argv[]) {
   int result = EXIT_SUCCESS;
 
   int arg_index = 1;
+  int reapp_result = ACL_SUCCESS;
   for (arg_index = optind; arg_index < argc; arg_index++) {
     const char* target = argv[arg_index];
-    bool reapp_result = false;
 
-    if (recursive) {
-      reapp_result = apply_default_acl_recursive(target);
-    }
-    else {
-      /* It's either normal file, or we're not operating recursively. */
-      reapp_result = apply_default_acl(target);
+    /* Make sure we can access the given path before we go out of our
+     * way to please it. Doing this check outside of
+     * apply_default_acl() lets us spit out a better error message for
+     * typos, too.
+     */
+    if (!path_accessible(target)) {
+      perror(target);
+      result = EXIT_FAILURE;
+      continue;
     }
 
-    if (!reapp_result) {
+    reapp_result = apply_default_acl(target, recursive);
+
+    if (result == EXIT_SUCCESS && reapp_result == ACL_FAILURE) {
+      /* We don't want to turn an error into a (less-severe) failure. */
       result = EXIT_FAILURE;
     }
+    if (reapp_result == ACL_ERROR) {
+      /* Turn both success and failure into an error, if we encounter one. */
+      result = EXIT_ERROR;
+    }
   }
 
   return result;