X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=993b1f7649e14c50300174da1f5d87fcb534d20a;hb=f22034c7b75b7096e6ef26de7a5bc8e12a3f0b07;hp=9c48b977d77adc90eb59306d12ed2549c24e6348;hpb=56883e0b8096b29cc545702f063f28619b593fe0;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 9c48b97..993b1f7 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -10,10 +10,10 @@ #define _GNU_SOURCE #include +#include /* AT_FOO constants */ #include /* nftw() et al. */ #include -#include /* dirname() */ -#include /* PATH_MAX */ +#include /* basename(), dirname() */ #include #include #include @@ -33,34 +33,31 @@ #define ACL_SUCCESS 1 -/* Command-line options */ -static bool no_exec_mask = false; - - /** - * @brief Get the mode bits from the given path. + * @brief Get the mode bits from the given file descriptor. * - * @param path - * The path (file or directory) whose mode we want. + * @param fd + * The file descriptor (which may reference a directory) whose + * mode we want. * * @return A mode_t (st_mode) structure containing the mode bits. * See sys/stat.h for details. */ -mode_t get_mode(const char* path) { - if (path == NULL) { +mode_t get_mode(int fd) { + if (fd <= 0) { errno = ENOENT; - return -1; + return ACL_ERROR; } struct stat s; - int result = stat(path, &s); + int result = fstat(fd, &s); if (result == 0) { return s.st_mode; } else { - /* errno will be set already by stat() */ + /* errno will be set already by lstat() */ return result; } } @@ -68,22 +65,81 @@ mode_t get_mode(const char* path) { /** - * @brief Determine whether or not the given path is a regular file. + * @brief Determine if the given file descriptor might refer to an + * (unsafe) hard link. + * + * @param fd + * The file descriptor whose link count we want to investigate. + * + * @return true if we are certain that @c fd does not describe a hard + * link, and false otherwise. In case of error, false is returned, + * because we are not sure that @c fd is not a hard link. + */ +bool is_hardlink_safe(int fd) { + if (fd <= 0) { + return false; + } + struct stat s; + if (fstat(fd, &s) == 0) { + return (s.st_nlink == 1 || S_ISDIR(s.st_mode)); + } + else { + return false; + } +} + + +/** + * @brief Determine whether or not the given file descriptor is for + * a regular file. + * + * @param fd + * The file descriptor to test for regular-fileness. + * + * @return true if @c fd describes a regular file, and false otherwise. + */ +bool is_regular_file(int fd) { + if (fd <= 0) { + return false; + } + + struct stat s; + if (fstat(fd, &s) == 0) { + return S_ISREG(s.st_mode); + } + else { + return false; + } +} + + + +/** + * @brief Determine whether or not the given path is accessible. * * @param path * The path to test. * - * @return true if @c path is a regular file, false otherwise. + * @return true if @c path is accessible to the current effective + * user/group, false otherwise. */ -bool is_regular_file(const char* path) { +bool path_accessible(const char* path) { if (path == NULL) { return false; } - struct stat s; - int result = stat(path, &s); - if (result == 0) { - return S_ISREG(s.st_mode); + /* Test for access using the effective user and group rather than + the real one. */ + int flags = AT_EACCESS; + + /* Don't follow symlinks when checking for a path's existence, + since we won't follow them to set its ACLs either. */ + flags |= AT_SYMLINK_NOFOLLOW; + + /* If the path is relative, interpret it relative to the current + working directory (just like the access() system call). */ + if (faccessat(AT_FDCWD, path, F_OK, flags) == 0) { + return true; } else { return false; @@ -100,14 +156,37 @@ bool is_regular_file(const char* path) { * * @return true if @c path is a directory, false otherwise. */ -bool is_directory(const char* path) { +bool is_path_directory(const char* path) { if (path == NULL) { return false; } struct stat s; - int result = stat(path, &s); - if (result == 0) { + if (lstat(path, &s) == 0) { + return S_ISDIR(s.st_mode); + } + else { + return false; + } +} + + +/** + * @brief Determine whether or not the given file descriptor is for + * a directory. + * + * @param fd + * The file descriptor whose directoryness is in question. + * + * @return true if @c fd describes a directory, and false otherwise. + */ +bool is_directory(int fd) { + if (fd <= 0) { + return false; + } + + struct stat s; + if (fstat(fd, &s) == 0) { return S_ISDIR(s.st_mode); } else { @@ -125,9 +204,9 @@ bool is_directory(const char* path) { * on each path before applying the default to it. * * The assumption that there are no extended entries makes things much - * simpler. For example, we only have to update the ACL_USER_OBJ, - * ACL_GROUP_OBJ, and ACL_OTHER entries -- all others can simply be - * created anew. This means we don't have to fool around comparing + * simpler. For example, we only have to update the @c ACL_USER_OBJ, + * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply + * be created anew. This means we don't have to fool around comparing * named-user/group entries. * * @param aclp @@ -137,23 +216,21 @@ bool is_directory(const char* path) { * The new entry. If @c entry contains a user/group/other entry, we * update the existing one. Otherwise we create a new entry. * - * @return If there is an unexpected library error, ACL_ERROR is - * returned. Otherwise, ACL_SUCCESS. + * @return If there is an unexpected library error, @c ACL_ERROR is + * returned. Otherwise, @c ACL_SUCCESS. * */ int acl_set_entry(acl_t* aclp, acl_entry_t entry) { acl_tag_t entry_tag; - int gt_result = acl_get_tag_type(entry, &entry_tag); - if (gt_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &entry_tag) == ACL_ERROR) { perror("acl_set_entry (acl_get_tag_type)"); return ACL_ERROR; } acl_permset_t entry_permset; - int ps_result = acl_get_permset(entry, &entry_permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_get_permset)"); return ACL_ERROR; } @@ -164,9 +241,8 @@ int acl_set_entry(acl_t* aclp, while (result == ACL_SUCCESS) { acl_tag_t existing_tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(existing_entry, &existing_tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(existing_entry, &existing_tag) == ACL_ERROR) { perror("set_acl_tag_permset (acl_get_tag_type)"); return ACL_ERROR; } @@ -180,14 +256,12 @@ int acl_set_entry(acl_t* aclp, match one of them, we're allowed to return ACL_SUCCESS below and bypass the rest of the function. */ acl_permset_t existing_permset; - int gep_result = acl_get_permset(existing_entry, &existing_permset); - if (gep_result == ACL_ERROR) { + if (acl_get_permset(existing_entry, &existing_permset) == ACL_ERROR) { perror("acl_set_entry (acl_get_permset)"); return ACL_ERROR; } - int s_result = acl_set_permset(existing_entry, entry_permset); - if (s_result == ACL_ERROR) { + if (acl_set_permset(existing_entry, entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_set_permset)"); return ACL_ERROR; } @@ -211,21 +285,24 @@ int acl_set_entry(acl_t* aclp, ACL. */ acl_entry_t new_entry; - /* We allocate memory here that we should release! */ - int c_result = acl_create_entry(aclp, &new_entry); - if (c_result == ACL_ERROR) { + /* The acl_create_entry() function can allocate new memory and/or + * change the location of the ACL structure entirely. When that + * happens, the value pointed to by aclp is updated, which means + * that a new acl_t gets "passed out" to our caller, eventually to + * be fed to acl_free(). In other words, we should still be freeing + * the right thing, even if the value pointed to by aclp changes. + */ + if (acl_create_entry(aclp, &new_entry) == ACL_ERROR) { perror("acl_set_entry (acl_create_entry)"); return ACL_ERROR; } - int st_result = acl_set_tag_type(new_entry, entry_tag); - if (st_result == ACL_ERROR) { + if (acl_set_tag_type(new_entry, entry_tag) == ACL_ERROR) { perror("acl_set_entry (acl_set_tag_type)"); return ACL_ERROR; } - int s_result = acl_set_permset(new_entry, entry_permset); - if (s_result == ACL_ERROR) { + if (acl_set_permset(new_entry, entry_permset) == ACL_ERROR) { perror("acl_set_entry (acl_set_permset)"); return ACL_ERROR; } @@ -238,8 +315,7 @@ int acl_set_entry(acl_t* aclp, return ACL_ERROR; } - int sq_result = acl_set_qualifier(new_entry, entry_qual); - if (sq_result == ACL_ERROR) { + if (acl_set_qualifier(new_entry, entry_qual) == ACL_ERROR) { perror("acl_set_entry (acl_set_qualifier)"); return ACL_ERROR; } @@ -254,20 +330,20 @@ int acl_set_entry(acl_t* aclp, * @brief Determine the number of entries in the given ACL. * * @param acl - * A pointer to an acl_t structure. + * The ACL to inspect. * * @return Either the non-negative number of entries in @c acl, or - * ACL_ERROR on error. + * @c ACL_ERROR on error. */ -int acl_entry_count(acl_t* acl) { +int acl_entry_count(acl_t acl) { acl_entry_t entry; int entry_count = 0; - int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry); + int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); while (result == ACL_SUCCESS) { entry_count++; - result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry); + result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); } if (result == ACL_ERROR) { @@ -286,14 +362,14 @@ int acl_entry_count(acl_t* acl) { * An ACL is minimal if it has fewer than four entries. * * @param acl - * A pointer to an acl_t structure. + * The ACL whose minimality is in question. * * @return - * - ACL_SUCCESS - @c acl is minimal - * - ACL_FAILURE - @c acl is not minimal - * - ACL_ERROR - Unexpected library error + * - @c ACL_SUCCESS - @c acl is minimal + * - @c ACL_FAILURE - @c acl is not minimal + * - @c ACL_ERROR - Unexpected library error */ -int acl_is_minimal(acl_t* acl) { +int acl_is_minimal(acl_t acl) { int ec = acl_entry_count(acl); @@ -313,41 +389,27 @@ int acl_is_minimal(acl_t* acl) { /** - * @brief Determine whether the given path has an ACL whose mask - * denies execute. + * @brief Determine whether the given ACL's mask denies execute. * - * @param path - * The path to check. + * @param acl + * The ACL whose mask we want to check. * * @return - * - ACL_SUCCESS - @c path has a mask which denies execute. - * - ACL_FAILURE - The ACL for @c path does not deny execute, - * or @c path has no extended ACL at all. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_SUCCESS - The @c acl has a mask which denies execute. + * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute. + * - @c ACL_ERROR - Unexpected library error. */ -int acl_execute_masked(const char* path) { - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("acl_execute_masked (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; +int acl_execute_masked(acl_t acl) { acl_entry_t entry; int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); while (ge_result == ACL_SUCCESS) { acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { perror("acl_execute_masked (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } if (tag == ACL_MASK) { @@ -355,18 +417,15 @@ int acl_execute_masked(const char* path) { execute is specified. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &permset) == ACL_ERROR) { perror("acl_execute_masked (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } int gp_result = acl_get_perm(permset, ACL_EXECUTE); if (gp_result == ACL_ERROR) { perror("acl_execute_masked (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } if (gp_result == ACL_FAILURE) { @@ -378,41 +437,41 @@ int acl_execute_masked(const char* path) { ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); } - cleanup: - acl_free(acl); - return result; + return ACL_FAILURE; } + /** - * @brief Determine whether @c path is executable (by anyone) or a + * @brief Determine whether @c fd is executable (by anyone) or a * directory. * * This is used as part of the heuristic to determine whether or not - * we should mask the execute bit when inheriting an ACL. If @c path - * is a directory, the answer is a clear-cut yes. This behavior is - * modeled after the capital 'X' perms of setfacl. + * we should mask the execute bit when inheriting an ACL. If @c fd + * describes a directory, the answer is a clear-cut yes. This behavior + * is modeled after the capital 'X' perms of setfacl. * - * If @c path is a file, we check the @a effective permissions, + * If @c fd describes a file, we check the @a effective permissions, * contrary to what setfacl does. * - * @param path - * The path to check. + * @param fd + * The file descriptor to check. * * @return - * - ACL_SUCCESS - @c path is a directory, or someone has effective + * - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective execute permissions. - * - ACL_FAILURE - @c path is a regular file and nobody can execute it. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute + it. + * - @c ACL_ERROR - Unexpected library error. */ -int any_can_execute_or_dir(const char* path) { +int any_can_execute_or_dir(int fd) { - if (is_directory(path)) { + if (is_directory(fd)) { /* That was easy... */ return ACL_SUCCESS; } - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); + acl_t acl = acl_get_fd(fd); if (acl == (acl_t)NULL) { perror("any_can_execute_or_dir (acl_get_file)"); @@ -422,8 +481,8 @@ int any_can_execute_or_dir(const char* path) { /* Our return value. */ int result = ACL_FAILURE; - if (acl_is_minimal(&acl)) { - mode_t mode = get_mode(path); + if (acl_is_minimal(acl)) { + mode_t mode = get_mode(fd); if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { result = ACL_SUCCESS; goto cleanup; @@ -438,10 +497,25 @@ int any_can_execute_or_dir(const char* path) { int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); while (ge_result == ACL_SUCCESS) { + /* The first thing we do is check to see if this is a mask + entry. If it is, we skip it entirely. */ + acl_tag_t tag = ACL_UNDEFINED_TAG; + + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { + perror("any_can_execute_or_dir (acl_get_tag_type)"); + result = ACL_ERROR; + goto cleanup; + } + + if (tag == ACL_MASK) { + ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); + continue; + } + + /* Ok, so it's not a mask entry. Check the execute perms. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &permset) == ACL_ERROR) { perror("any_can_execute_or_dir (acl_get_permset)"); result = ACL_ERROR; goto cleanup; @@ -455,8 +529,8 @@ int any_can_execute_or_dir(const char* path) { } if (gp_result == ACL_SUCCESS) { - /* Only return one if this execute bit is not masked. */ - if (acl_execute_masked(path) != ACL_SUCCESS) { + /* Only return ACL_SUCCESS if this execute bit is not masked. */ + if (acl_execute_masked(acl) != ACL_SUCCESS) { result = ACL_SUCCESS; goto cleanup; } @@ -479,145 +553,164 @@ int any_can_execute_or_dir(const char* path) { /** - * @brief Inherit the default ACL from @c parent to @c path. - * - * The @c parent parameter does not necessarily need to be the parent - * of @c path, although that will usually be the case. This overwrites - * any existing default ACL on @c path. + * @brief Set @c acl as the default ACL on @c path if it's a directory. * - * @param parent - * The parent directory whose ACL we want to inherit. + * This overwrites any existing default ACL on @c path. If no default + * ACL exists, then one is created. If @c path is not a directory, we + * return ACL_FAILURE but no error is raised. * * @param path - * The target directory whose ACL we wish to overwrite (or create). + * The target directory whose ACL we wish to replace or create. + * + * @param acl + * The ACL to set as default on @c path. * * @return - * - ACL_SUCCESS - The default ACL was inherited successfully. - * - ACL_FAILURE - Either @c parent or @c path is not a directory. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_SUCCESS - The default ACL was assigned successfully. + * - @c ACL_FAILURE - If @c path is not a directory. + * - @c ACL_ERROR - Unexpected library error. */ -int inherit_default_acl(const char* path, const char* parent) { - /* Inherit the default ACL from parent to path. This overwrites any - * existing default ACL. Returns 1 for success, 0 for failure, and - * -1 on error. - */ - - /* Our return value. */ - int result = ACL_SUCCESS; +int assign_default_acl(const char* path, acl_t acl) { if (path == NULL) { errno = ENOENT; return ACL_ERROR; } - if (!is_directory(path) || !is_directory(parent)) { + if (!is_path_directory(path)) { return ACL_FAILURE; } - acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT); - if (parent_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - acl_t path_acl = acl_dup(parent_acl); + /* Our return value; success unless something bad happens. */ + int result = ACL_SUCCESS; + acl_t path_acl = acl_dup(acl); if (path_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_dup)"); - acl_free(parent_acl); - return ACL_ERROR; + perror("assign_default_acl (acl_dup)"); + return ACL_ERROR; /* Nothing to clean up in this case. */ } - int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl); - if (sf_result == -1) { - perror("inherit_default_acl (acl_set_file)"); + if (acl_set_file(path, ACL_TYPE_DEFAULT, path_acl) == ACL_ERROR) { + perror("assign_default_acl (acl_set_file)"); result = ACL_ERROR; - goto cleanup; } - cleanup: acl_free(path_acl); return result; } -int wipe_acls(const char* path) { - /* Remove ACL_USER, ACL_GROUP, and ACL_MASK entries from - path. Returns 1 for success, 0 for failure, and -1 on error. */ - if (path == NULL) { - errno = ENOENT; +/** + * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file + * descriptor, leaving the UNIX permission bits. + * + * @param fd + * The file descriptor whose ACLs we want to wipe. + * + * @return + * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none + * existed in the first place. + * - @c ACL_ERROR - Unexpected library error. + */ +int wipe_acls(int fd) { + /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */ + acl_t empty_acl = acl_init(0); + + if (empty_acl == (acl_t)NULL) { + perror("wipe_acls (acl_init)"); return ACL_ERROR; } - /* Finally, remove individual named/mask entries. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("wipe_acls (acl_get_file)"); + if (acl_set_fd(fd, empty_acl) == ACL_ERROR) { + perror("wipe_acls (acl_set_fd)"); + acl_free(empty_acl); return ACL_ERROR; } - /* Our return value. */ - int result = ACL_SUCCESS; + acl_free(empty_acl); + return ACL_SUCCESS; +} - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - while (ge_result == ACL_SUCCESS) { - int d_result = acl_delete_entry(acl, entry); - if (d_result == ACL_ERROR) { - perror("wipe_acls (acl_delete_entry)"); - result = ACL_ERROR; - goto cleanup; - } - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } +/** + * @brief Apply parent default ACL to a path. + * + * This overwrites any existing ACLs on @c path. + * + * @param path + * The path whose ACL we would like to reset to its default. + * + * @param no_exec_mask + * The value (either true or false) of the --no-exec-mask flag. + * + * @return + * - @c ACL_SUCCESS - The parent default ACL was inherited successfully. + * - @c ACL_FAILURE - The target path is not a regular file/directory, + * or the parent of @c path is not a directory. + * - @c ACL_ERROR - Unexpected library error. + */ +int apply_default_acl(const char* path, bool no_exec_mask) { - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("wipe_acls (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; + if (path == NULL) { + errno = ENOENT; + return ACL_ERROR; } - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("wipe_acls (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } + /* Define these next three variables here because we may have to + * jump to the cleanup routine which expects them to exist. + */ - cleanup: - acl_free(acl); - return result; -} + /* Our return value. */ + int result = ACL_SUCCESS; + /* The default ACL on path's parent directory */ + acl_t defacl = (acl_t)NULL; -int apply_default_acl(const char* path) { - /* Really apply the default ACL by looping through it. Returns one - * for success, zero for failure (i.e. no ACL), and -1 on unexpected - * errors. + /* The file descriptor corresponding to "path" */ + int fd = 0; + /* Split "path" into base/dirname parts to be used with openat(). + * We duplicate the strings involved because dirname/basename mangle + * their arguments. */ - if (path == NULL) { - return ACL_FAILURE; + char* path_copy = strdup(path); + if (path_copy == NULL) { + perror("apply_default_acl (strdup)"); + return ACL_ERROR; } + char* parent = dirname(path_copy); - if (!is_regular_file(path) && !is_directory(path)) { - return ACL_FAILURE; + fd = open(path, O_NOFOLLOW); + if (fd == -1) { + if (errno == ELOOP) { + result = ACL_FAILURE; /* hit a symlink */ + goto cleanup; + } + else { + perror("apply_default_acl (open fd)"); + result = ACL_ERROR; + goto cleanup; + } } - /* dirname mangles its argument */ - char path_copy[PATH_MAX]; - strncpy(path_copy, path, PATH_MAX-1); - path_copy[PATH_MAX-1] = 0; - char* parent = dirname(path_copy); - if (!is_directory(parent)) { - /* Make sure dirname() did what we think it did. */ - return ACL_FAILURE; + /* Refuse to operate on hard links, which can be abused by an + * attacker to trick us into changing the ACL on a file we didn't + * intend to; namely the "target" of the hard link. There is TOCTOU + * race condition here, but the window is as small as possible + * between when we open the file descriptor (look above) and when we + * fstat it. + */ + if (!is_hardlink_safe(fd)) { + result = ACL_FAILURE; + goto cleanup; + } + + if (!is_regular_file(fd) && !is_directory(fd)) { + result = ACL_FAILURE; + goto cleanup; } /* Default to not masking the exec bit; i.e. applying the default @@ -626,27 +719,26 @@ int apply_default_acl(const char* path) { bool allow_exec = true; if (!no_exec_mask) { - int ace_result = any_can_execute_or_dir(path); + int ace_result = any_can_execute_or_dir(fd); if (ace_result == ACL_ERROR) { - perror("apply_default_acl (any_can_execute_or_dir)"); - return ACL_ERROR; - } + perror("apply_default_acl (any_can_execute_or_dir)"); + result = ACL_ERROR; + goto cleanup; + } + allow_exec = (bool)ace_result; } - acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); + defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); if (defacl == (acl_t)NULL) { perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; + result = ACL_ERROR; + goto cleanup; } - /* Our return value. */ - int result = ACL_SUCCESS; - - int wipe_result = wipe_acls(path); - if (wipe_result == ACL_ERROR) { + if (wipe_acls(fd) == ACL_ERROR) { perror("apply_default_acl (wipe_acls)"); result = ACL_ERROR; goto cleanup; @@ -654,16 +746,16 @@ int apply_default_acl(const char* path) { /* Do this after wipe_acls(), otherwise we'll overwrite the wiped ACL with this one. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); + acl_t acl = acl_get_fd(fd); if (acl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; + perror("apply_default_acl (acl_get_fd)"); + result = ACL_ERROR; + goto cleanup; } /* If it's a directory, inherit the parent's default. */ - int inherit_result = inherit_default_acl(path, parent); - if (inherit_result == ACL_ERROR) { - perror("apply_default_acl (inherit_acls)"); + if (assign_default_acl(path, defacl) == ACL_ERROR) { + perror("apply_default_acl (assign_default_acl)"); result = ACL_ERROR; goto cleanup; } @@ -673,9 +765,8 @@ int apply_default_acl(const char* path) { while (ge_result == ACL_SUCCESS) { acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - if (tag_result == ACL_ERROR) { + if (acl_get_tag_type(entry, &tag) == ACL_ERROR) { perror("apply_default_acl (acl_get_tag_type)"); result = ACL_ERROR; goto cleanup; @@ -684,8 +775,7 @@ int apply_default_acl(const char* path) { /* We've got an entry/tag from the default ACL. Get its permset. */ acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { + if (acl_get_permset(entry, &permset) == ACL_ERROR) { perror("apply_default_acl (acl_get_permset)"); result = ACL_ERROR; goto cleanup; @@ -701,15 +791,13 @@ int apply_default_acl(const char* path) { /* The mask doesn't affect acl_user_obj, acl_group_obj (in minimal ACLs) or acl_other entries, so if execute should be masked, we have to do it manually. */ - int d_result = acl_delete_perm(permset, ACL_EXECUTE); - if (d_result == ACL_ERROR) { + if (acl_delete_perm(permset, ACL_EXECUTE) == ACL_ERROR) { perror("apply_default_acl (acl_delete_perm)"); result = ACL_ERROR; goto cleanup; } - int sp_result = acl_set_permset(entry, permset); - if (sp_result == ACL_ERROR) { + if (acl_set_permset(entry, permset) == ACL_ERROR) { perror("apply_default_acl (acl_set_permset)"); result = ACL_ERROR; goto cleanup; @@ -717,9 +805,23 @@ int apply_default_acl(const char* path) { } } - /* Finally, add the permset to the access ACL. */ - int set_result = acl_set_entry(&acl, entry); - if (set_result == ACL_ERROR) { + /* Finally, add the permset to the access ACL. It's actually + * important that we pass in the address of "acl" here, and not + * "acl" itself. Why? The call to acl_create_entry() within + * acl_set_entry() can allocate new memory for the entry. + * Sometimes that can be done in-place, in which case everything + * is cool and the new memory gets released when we call + * acl_free(acl). + * + * But occasionally, the whole ACL structure will have to be moved + * in order to allocate the extra space. When that happens, + * acl_create_entry() modifies the pointer it was passed (in this + * case, &acl) to point to the new location. We want to call + * acl_free() on the new location, and since acl_free() gets + * called right here, we need acl_create_entry() to update the + * value of "acl". To do that, it needs the address of "acl". + */ + if (acl_set_entry(&acl, entry) == ACL_ERROR) { perror("apply_default_acl (acl_set_entry)"); result = ACL_ERROR; goto cleanup; @@ -736,23 +838,34 @@ int apply_default_acl(const char* path) { goto cleanup; } - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_file)"); + if (acl_set_fd(fd, acl) == ACL_ERROR) { + perror("apply_default_acl (acl_set_fd)"); result = ACL_ERROR; goto cleanup; } cleanup: - acl_free(defacl); + free(path_copy); + if (defacl != (acl_t)NULL) { + acl_free(defacl); + } + if (fd >= 0 && close(fd) == -1) { + perror("apply_default_acl (close)"); + result = ACL_ERROR; + } return result; } -void usage(char* program_name) { - /* - * Print usage information. - */ + +/** + * @brief Display program usage information. + * + * @param program_name + * The program name to use in the output. + * + */ +void usage(const char* program_name) { printf("Apply any applicable default ACLs to the given files or " "directories.\n\n"); printf("Usage: %s [flags] [ [ ...]]\n\n", @@ -766,16 +879,23 @@ void usage(char* program_name) { } +/** + * @brief Wrapper around @c apply_default_acl() for use with @c nftw(). + * + * For parameter information, see the @c nftw man page. + * + * @return If the ACL was applied to @c target successfully, we return + * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto + * the next file or directory. Otherwise, we return @c FTW_STOP to + * signal failure. + * + */ int apply_default_acl_nftw(const char *target, const struct stat *s, int info, struct FTW *ftw) { - /* A wrapper around the apply_default_acl() function for use with - * nftw(). We need to adjust the return value so that nftw() doesn't - * think we've failed. - */ - bool reapp_result = apply_default_acl(target); - if (reapp_result) { + + if (apply_default_acl(target, false)) { return FTW_CONTINUE; } else { @@ -784,25 +904,71 @@ int apply_default_acl_nftw(const char *target, } -bool apply_default_acl_recursive(const char *target) { - /* Attempt to apply default ACLs recursively. If target is a - * directory, we recurse through its entries. If not, we just - * apply the default ACL to target. - * - * We ignore symlinks for consistency with chmod -r. - * - */ - if (!is_directory(target)) { - return apply_default_acl(target); + +/** + * @brief Wrapper around @c apply_default_acl() for use with @c nftw(). + * + * This is identical to @c apply_default_acl_nftw(), except it passes + * @c true to @c apply_default_acl() as its no_exec_mask argument. + * + */ +int apply_default_acl_nftw_x(const char *target, + const struct stat *s, + int info, + struct FTW *ftw) { + + if (apply_default_acl(target, true)) { + return FTW_CONTINUE; + } + else { + return FTW_STOP; + } +} + + + +/** + * @brief Recursive version of @c apply_default_acl(). + * + * If @c target is a directory, we use @c nftw() to call @c + * apply_default_acl() recursively on all of its children. Otherwise, + * we just delegate to @c apply_default_acl(). + * + * We ignore symlinks for consistency with chmod -r. + * + * @param target + * The root (path) of the recursive application. + * + * @param no_exec_mask + * The value (either true or false) of the --no-exec-mask flag. + * + * @return + * If @c target is not a directory, we return the result of + * calling @c apply_default_acl() on @c target. Otherwise, we convert + * the return value of @c nftw(). If @c nftw() succeeds (returns 0), + * then we return @c true. Otherwise, we return @c false. + * \n\n + * If there is an error, it will be reported via @c perror, but + * we still return @c false. + */ +bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { + + if (!is_path_directory(target)) { + return apply_default_acl(target, no_exec_mask); } int max_levels = 256; int flags = FTW_PHYS; /* Don't follow links. */ - int nftw_result = nftw(target, - apply_default_acl_nftw, - max_levels, - flags); + /* There are two separate functions that could be passed to + nftw(). One passes no_exec_mask = true to apply_default_acl(), + and the other passes no_exec_mask = false. Since the function we + pass to nftw() cannot have parameters, we have to create separate + options and make the decision here. */ + int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL; + fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw; + + int nftw_result = nftw(target, fn, max_levels, flags); if (nftw_result == 0) { /* Success */ @@ -821,17 +987,24 @@ bool apply_default_acl_recursive(const char *target) { } + +/** + * @brief Call apply_default_acl (possibly recursively) on each + * command-line argument. + * + * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything + * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return + * @c EXIT_FAILURE. + */ int main(int argc, char* argv[]) { - /* - * Call apply_default_acl on each command-line argument. - */ + if (argc < 2) { usage(argv[0]); return EXIT_FAILURE; } bool recursive = false; - /* bool no_exec_mask is declared static/global */ + bool no_exec_mask = false; struct option long_options[] = { /* These options set a flag. */ @@ -867,12 +1040,23 @@ int main(int argc, char* argv[]) { const char* target = argv[arg_index]; bool reapp_result = false; + /* Make sure we can access the given path before we go out of our + * way to please it. Doing this check outside of + * apply_default_acl() lets us spit out a better error message for + * typos, too. + */ + if (!path_accessible(target)) { + fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target); + result = EXIT_FAILURE; + continue; + } + if (recursive) { - reapp_result = apply_default_acl_recursive(target); + reapp_result = apply_default_acl_recursive(target, no_exec_mask); } else { - /* It's either normal file, or we're not operating recursively. */ - reapp_result = apply_default_acl(target); + /* It's either a normal file, or we're not operating recursively. */ + reapp_result = apply_default_acl(target, no_exec_mask); } if (!reapp_result) {