X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=a520aa9b6d4ebdc43b5055772292c1efe4b2b822;hb=45d4e8bba034c22c317fbd20c629589e35d97683;hp=0c43af7d975088c06019c8a44e69b66f14cdf63a;hpb=a605ae954b9b9c378d6a0b21058f4b4b410f8ab7;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 0c43af7..a520aa9 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -1,7 +1,7 @@ /** * @file apply-default-acl.c * - * @brief The entire implementation. + * @brief The command-line interface. * */ @@ -9,84 +9,22 @@ #define _XOPEN_SOURCE 500 #define _GNU_SOURCE -#include -#include /* AT_FOO constants */ -#include /* nftw() et al. */ -#include -#include /* dirname() */ -#include /* PATH_MAX */ -#include -#include -#include -#include -#include -#include +#include /* EINVAL */ +#include /* AT_FOO constants */ +#include /* nftw() et al. */ +#include /* getopt_long() */ +#include /* the "bool" type */ +#include /* perror() */ +#include /* EXIT_FAILURE, EXIT_SUCCESS */ +#include /* faccessat() */ -/* ACLs */ -#include /* acl_get_perm, not portable */ -#include -#include +#include "libadacl.h" -/* Most of the libacl functions return 1 for success, 0 for failure, - and -1 on error */ -#define ACL_ERROR -1 -#define ACL_FAILURE 0 -#define ACL_SUCCESS 1 - - - -/** - * @brief Get the mode bits from the given path. - * - * @param path - * The path (file or directory) whose mode we want. - * - * @return A mode_t (st_mode) structure containing the mode bits. - * See sys/stat.h for details. - */ -mode_t get_mode(const char* path) { - if (path == NULL) { - errno = ENOENT; - return -1; - } - - struct stat s; - int result = stat(path, &s); - - if (result == 0) { - return s.st_mode; - } - else { - /* errno will be set already by stat() */ - return result; - } -} - - - -/** - * @brief Determine whether or not the given path is a regular file. - * - * @param path - * The path to test. - * - * @return true if @c path is a regular file, false otherwise. - */ -bool is_regular_file(const char* path) { - if (path == NULL) { - return false; - } - - struct stat s; - int result = stat(path, &s); - if (result == 0) { - return S_ISREG(s.st_mode); - } - else { - return false; - } -} +/* We exit with EXIT_FAILURE for small errors, but we need something + * else for big ones. */ +#define EXIT_ERROR 2 +#define NFTW_ERROR -1 /** @@ -113,9 +51,7 @@ bool path_accessible(const char* path) { /* If the path is relative, interpret it relative to the current working directory (just like the access() system call). */ - int result = faccessat(AT_FDCWD, path, F_OK, flags); - - if (result == 0) { + if (faccessat(AT_FDCWD, path, F_OK, flags) == 0) { return true; } else { @@ -124,706 +60,6 @@ bool path_accessible(const char* path) { } - -/** - * @brief Determine whether or not the given path is a directory. - * - * @param path - * The path to test. - * - * @return true if @c path is a directory, false otherwise. - */ -bool is_directory(const char* path) { - if (path == NULL) { - return false; - } - - struct stat s; - int result = stat(path, &s); - if (result == 0) { - return S_ISDIR(s.st_mode); - } - else { - return false; - } -} - - - -/** - * @brief Update (or create) an entry in an @b minimal ACL. - * - * This function will not work if @c aclp contains extended - * entries. This is fine for our purposes, since we call @c wipe_acls - * on each path before applying the default to it. - * - * The assumption that there are no extended entries makes things much - * simpler. For example, we only have to update the @c ACL_USER_OBJ, - * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply - * be created anew. This means we don't have to fool around comparing - * named-user/group entries. - * - * @param aclp - * A pointer to the acl_t structure whose entry we want to modify. - * - * @param entry - * The new entry. If @c entry contains a user/group/other entry, we - * update the existing one. Otherwise we create a new entry. - * - * @return If there is an unexpected library error, @c ACL_ERROR is - * returned. Otherwise, @c ACL_SUCCESS. - * - */ -int acl_set_entry(acl_t* aclp, - acl_entry_t entry) { - - acl_tag_t entry_tag; - int gt_result = acl_get_tag_type(entry, &entry_tag); - if (gt_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_tag_type)"); - return ACL_ERROR; - } - - acl_permset_t entry_permset; - int ps_result = acl_get_permset(entry, &entry_permset); - if (ps_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_permset)"); - return ACL_ERROR; - } - - acl_entry_t existing_entry; - /* Loop through the given ACL looking for matching entries. */ - int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry); - - while (result == ACL_SUCCESS) { - acl_tag_t existing_tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(existing_entry, &existing_tag); - - if (tag_result == ACL_ERROR) { - perror("set_acl_tag_permset (acl_get_tag_type)"); - return ACL_ERROR; - } - - if (existing_tag == entry_tag) { - if (entry_tag == ACL_USER_OBJ || - entry_tag == ACL_GROUP_OBJ || - entry_tag == ACL_OTHER) { - /* Only update for these three since all other tags will have - been wiped. These three are guaranteed to exist, so if we - match one of them, we're allowed to return ACL_SUCCESS - below and bypass the rest of the function. */ - acl_permset_t existing_permset; - int gep_result = acl_get_permset(existing_entry, &existing_permset); - if (gep_result == ACL_ERROR) { - perror("acl_set_entry (acl_get_permset)"); - return ACL_ERROR; - } - - int s_result = acl_set_permset(existing_entry, entry_permset); - if (s_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_permset)"); - return ACL_ERROR; - } - - return ACL_SUCCESS; - } - - } - - result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry); - } - - /* This catches both the initial acl_get_entry and the ones at the - end of the loop. */ - if (result == ACL_ERROR) { - perror("acl_set_entry (acl_get_entry)"); - return ACL_ERROR; - } - - /* If we've made it this far, we need to add a new entry to the - ACL. */ - acl_entry_t new_entry; - - /* We allocate memory here that we should release! */ - int c_result = acl_create_entry(aclp, &new_entry); - if (c_result == ACL_ERROR) { - perror("acl_set_entry (acl_create_entry)"); - return ACL_ERROR; - } - - int st_result = acl_set_tag_type(new_entry, entry_tag); - if (st_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_tag_type)"); - return ACL_ERROR; - } - - int s_result = acl_set_permset(new_entry, entry_permset); - if (s_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_permset)"); - return ACL_ERROR; - } - - if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) { - /* We need to set the qualifier too. */ - void* entry_qual = acl_get_qualifier(entry); - if (entry_qual == (void*)NULL) { - perror("acl_set_entry (acl_get_qualifier)"); - return ACL_ERROR; - } - - int sq_result = acl_set_qualifier(new_entry, entry_qual); - if (sq_result == ACL_ERROR) { - perror("acl_set_entry (acl_set_qualifier)"); - return ACL_ERROR; - } - } - - return ACL_SUCCESS; -} - - - -/** - * @brief Determine the number of entries in the given ACL. - * - * @param acl - * A pointer to an @c acl_t structure. - * - * @return Either the non-negative number of entries in @c acl, or - * @c ACL_ERROR on error. - */ -int acl_entry_count(acl_t* acl) { - - acl_entry_t entry; - int entry_count = 0; - int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry); - - while (result == ACL_SUCCESS) { - entry_count++; - result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry); - } - - if (result == ACL_ERROR) { - perror("acl_entry_count (acl_get_entry)"); - return ACL_ERROR; - } - - return entry_count; -} - - - -/** - * @brief Determine whether or not the given ACL is minimal. - * - * An ACL is minimal if it has fewer than four entries. - * - * @param acl - * A pointer to an acl_t structure. - * - * @return - * - @c ACL_SUCCESS - @c acl is minimal - * - @c ACL_FAILURE - @c acl is not minimal - * - @c ACL_ERROR - Unexpected library error - */ -int acl_is_minimal(acl_t* acl) { - - int ec = acl_entry_count(acl); - - if (ec == ACL_ERROR) { - perror("acl_is_minimal (acl_entry_count)"); - return ACL_ERROR; - } - - if (ec < 4) { - return ACL_SUCCESS; - } - else { - return ACL_FAILURE; - } -} - - - -/** - * @brief Determine whether the given path has an ACL whose mask - * denies execute. - * - * @param path - * The path to check. - * - * @return - * - @c ACL_SUCCESS - @c path has a mask which denies execute. - * - @c ACL_FAILURE - The ACL for @c path does not deny execute, - * or @c path has no extended ACL at all. - * - @c ACL_ERROR - Unexpected library error. - */ -int acl_execute_masked(const char* path) { - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("acl_execute_masked (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - - if (tag_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; - } - - if (tag == ACL_MASK) { - /* This is the mask entry, get its permissions, and see if - execute is specified. */ - acl_permset_t permset; - - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - int gp_result = acl_get_perm(permset, ACL_EXECUTE); - if (gp_result == ACL_ERROR) { - perror("acl_execute_masked (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - if (gp_result == ACL_FAILURE) { - /* No execute bit set in the mask; execute not allowed. */ - return ACL_SUCCESS; - } - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - cleanup: - acl_free(acl); - return result; -} - - - -/** - * @brief Determine whether @c path is executable (by anyone) or a - * directory. - * - * This is used as part of the heuristic to determine whether or not - * we should mask the execute bit when inheriting an ACL. If @c path - * is a directory, the answer is a clear-cut yes. This behavior is - * modeled after the capital 'X' perms of setfacl. - * - * If @c path is a file, we check the @a effective permissions, - * contrary to what setfacl does. - * - * @param path - * The path to check. - * - * @return - * - @c ACL_SUCCESS - @c path is a directory, or someone has effective - execute permissions. - * - @c ACL_FAILURE - @c path is a regular file and nobody can execute - it. - * - @c ACL_ERROR - Unexpected library error. - */ -int any_can_execute_or_dir(const char* path) { - - if (is_directory(path)) { - /* That was easy... */ - return ACL_SUCCESS; - } - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("any_can_execute_or_dir (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; - - if (acl_is_minimal(&acl)) { - mode_t mode = get_mode(path); - if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { - result = ACL_SUCCESS; - goto cleanup; - } - else { - result = ACL_FAILURE; - goto cleanup; - } - } - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - /* The first thing we do is check to see if this is a mask - entry. If it is, we skip it entirely. */ - acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - - if (tag_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; - } - - if (tag == ACL_MASK) { - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - continue; - } - - /* Ok, so it's not a mask entry. Check the execute perms. */ - acl_permset_t permset; - - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - int gp_result = acl_get_perm(permset, ACL_EXECUTE); - if (gp_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - if (gp_result == ACL_SUCCESS) { - /* Only return ACL_SUCCESS if this execute bit is not masked. */ - if (acl_execute_masked(path) != ACL_SUCCESS) { - result = ACL_SUCCESS; - goto cleanup; - } - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - if (ge_result == ACL_ERROR) { - perror("any_can_execute_or_dir (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(acl); - return result; -} - - - -/** - * @brief Inherit the default ACL from @c parent to @c path. - * - * The @c parent parameter does not necessarily need to be the parent - * of @c path, although that will usually be the case. This overwrites - * any existing default ACL on @c path. - * - * @param parent - * The parent directory whose ACL we want to inherit. - * - * @param path - * The target directory whose ACL we wish to overwrite (or create). - * - * @return - * - @c ACL_SUCCESS - The default ACL was inherited successfully. - * - @c ACL_FAILURE - Either @c parent or @c path is not a directory. - * - @c ACL_ERROR - Unexpected library error. - */ -int inherit_default_acl(const char* path, const char* parent) { - - /* Our return value. */ - int result = ACL_SUCCESS; - - if (path == NULL) { - errno = ENOENT; - return ACL_ERROR; - } - - if (!is_directory(path) || !is_directory(parent)) { - return ACL_FAILURE; - } - - acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT); - if (parent_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - acl_t path_acl = acl_dup(parent_acl); - - if (path_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_dup)"); - acl_free(parent_acl); - return ACL_ERROR; - } - - int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl); - if (sf_result == -1) { - perror("inherit_default_acl (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(path_acl); - return result; -} - - - -/** - * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries - * from the given path. - * - * @param path - * The path whose ACLs we want to wipe. - * - * @return - * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none - * existed in the first place. - * - @c ACL_ERROR - Unexpected library error. - */ -int wipe_acls(const char* path) { - - if (path == NULL) { - errno = ENOENT; - return ACL_ERROR; - } - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("wipe_acls (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_SUCCESS; - - acl_entry_t entry; - int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - int d_result = acl_delete_entry(acl, entry); - if (d_result == ACL_ERROR) { - perror("wipe_acls (acl_delete_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); - } - - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("wipe_acls (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("wipe_acls (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(acl); - return result; -} - - - -/** - * @brief Apply parent default ACL to a path. - * - * This overwrites any existing ACLs on @c path. - * - * @param path - * The path whose ACL we would like to reset to its default. - * - * @param no_exec_mask - * The value (either true or false) of the --no-exec-mask flag. - * - * @return - * - @c ACL_SUCCESS - The parent default ACL was inherited successfully. - * - @c ACL_FAILURE - The target path is not a regular file/directory, - * or the parent of @c path is not a directory. - * - @c ACL_ERROR - Unexpected library error. - */ -int apply_default_acl(const char* path, bool no_exec_mask) { - - if (path == NULL) { - errno = ENOENT; - return ACL_ERROR; - } - - if (!is_regular_file(path) && !is_directory(path)) { - return ACL_FAILURE; - } - - /* dirname mangles its argument */ - char path_copy[PATH_MAX]; - strncpy(path_copy, path, PATH_MAX-1); - path_copy[PATH_MAX-1] = 0; - - char* parent = dirname(path_copy); - if (!is_directory(parent)) { - /* Make sure dirname() did what we think it did. */ - return ACL_FAILURE; - } - - /* Default to not masking the exec bit; i.e. applying the default - ACL literally. If --no-exec-mask was not specified, then we try - to "guess" whether or not to mask the exec bit. */ - bool allow_exec = true; - - if (!no_exec_mask) { - int ace_result = any_can_execute_or_dir(path); - - if (ace_result == ACL_ERROR) { - perror("apply_default_acl (any_can_execute_or_dir)"); - return ACL_ERROR; - } - - allow_exec = (bool)ace_result; - } - - acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); - - if (defacl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_SUCCESS; - - int wipe_result = wipe_acls(path); - if (wipe_result == ACL_ERROR) { - perror("apply_default_acl (wipe_acls)"); - result = ACL_ERROR; - goto cleanup; - } - - /* Do this after wipe_acls(), otherwise we'll overwrite the wiped - ACL with this one. */ - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - if (acl == (acl_t)NULL) { - perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - /* If it's a directory, inherit the parent's default. */ - int inherit_result = inherit_default_acl(path, parent); - if (inherit_result == ACL_ERROR) { - perror("apply_default_acl (inherit_acls)"); - result = ACL_ERROR; - goto cleanup; - } - - acl_entry_t entry; - int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry); - - while (ge_result == ACL_SUCCESS) { - acl_tag_t tag = ACL_UNDEFINED_TAG; - int tag_result = acl_get_tag_type(entry, &tag); - - if (tag_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; - } - - - /* We've got an entry/tag from the default ACL. Get its permset. */ - acl_permset_t permset; - int ps_result = acl_get_permset(entry, &permset); - if (ps_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; - } - - /* If this is a default mask, fix it up. */ - if (tag == ACL_MASK || - tag == ACL_USER_OBJ || - tag == ACL_GROUP_OBJ || - tag == ACL_OTHER) { - - if (!allow_exec) { - /* The mask doesn't affect acl_user_obj, acl_group_obj (in - minimal ACLs) or acl_other entries, so if execute should be - masked, we have to do it manually. */ - int d_result = acl_delete_perm(permset, ACL_EXECUTE); - if (d_result == ACL_ERROR) { - perror("apply_default_acl (acl_delete_perm)"); - result = ACL_ERROR; - goto cleanup; - } - - int sp_result = acl_set_permset(entry, permset); - if (sp_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_permset)"); - result = ACL_ERROR; - goto cleanup; - } - } - } - - /* Finally, add the permset to the access ACL. */ - int set_result = acl_set_entry(&acl, entry); - if (set_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry); - } - - /* Catches the first acl_get_entry as well as the ones at the end of - the loop. */ - if (ge_result == ACL_ERROR) { - perror("apply_default_acl (acl_get_entry)"); - result = ACL_ERROR; - goto cleanup; - } - - int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl); - if (sf_result == ACL_ERROR) { - perror("apply_default_acl (acl_set_file)"); - result = ACL_ERROR; - goto cleanup; - } - - cleanup: - acl_free(defacl); - return result; -} - - - /** * @brief Display program usage information. * @@ -832,10 +68,15 @@ int apply_default_acl(const char* path, bool no_exec_mask) { * */ void usage(const char* program_name) { + if (program_name == NULL) { + /* ??? */ + return; + } + printf("Apply any applicable default ACLs to the given files or " - "directories.\n\n"); + "directories.\n\n"); printf("Usage: %s [flags] [ [ ...]]\n\n", - program_name); + program_name); printf("Flags:\n"); printf(" -h, --help Print this help message\n"); printf(" -r, --recursive Act on any given directories recursively\n"); @@ -857,17 +98,24 @@ void usage(const char* program_name) { * */ int apply_default_acl_nftw(const char *target, - const struct stat *s, - int info, - struct FTW *ftw) { + const struct stat *sp, + int info, + struct FTW *ftw) { - bool app_result = apply_default_acl(target, false); - if (app_result) { - return FTW_CONTINUE; + if (target == NULL) { + errno = EINVAL; + perror("apply_default_acl_nftw (args)"); + return ACL_ERROR; } - else { - return FTW_STOP; + + + if (apply_default_acl_ex(target, sp, false) == ACL_ERROR) { + /* I guess we do want to bail out for serious/unexpected errors? */ + return ACL_ERROR; } + + /* We don't want to kill the tree walk because we it a symlink. */ + return 0; } @@ -880,17 +128,23 @@ int apply_default_acl_nftw(const char *target, * */ int apply_default_acl_nftw_x(const char *target, - const struct stat *s, - int info, - struct FTW *ftw) { + const struct stat *sp, + int info, + struct FTW *ftw) { - bool app_result = apply_default_acl(target, true); - if (app_result) { - return FTW_CONTINUE; + if (target == NULL) { + errno = EINVAL; + perror("apply_default_acl_nftw_x (args)"); + return ACL_ERROR; } - else { - return FTW_STOP; + + if (apply_default_acl_ex(target, sp, true) == ACL_ERROR) { + /* I guess we do want to bail out for serious/unexpected errors? */ + return ACL_ERROR; } + + /* We don't want to kill the tree walk because we it a symlink. */ + return 0; } @@ -902,8 +156,6 @@ int apply_default_acl_nftw_x(const char *target, * apply_default_acl() recursively on all of its children. Otherwise, * we just delegate to @c apply_default_acl(). * - * We ignore symlinks for consistency with chmod -r. - * * @param target * The root (path) of the recursive application. * @@ -911,22 +163,18 @@ int apply_default_acl_nftw_x(const char *target, * The value (either true or false) of the --no-exec-mask flag. * * @return - * If @c target is not a directory, we return the result of - * calling @c apply_default_acl() on @c target. Otherwise, we convert - * the return value of @c nftw(). If @c nftw() succeeds (returns 0), - * then we return @c true. Otherwise, we return @c false. - * \n\n - * If there is an error, it will be reported via @c perror, but - * we still return @c false. + * If @c nftw() fails with a serious error (returns NFTW_ERROR), + * then we return @c ACL_ERROR. Otherwise, we return @c ACL_SUCCESS. */ -bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { - - if (!is_directory(target)) { - return apply_default_acl(target, no_exec_mask); +int apply_default_acl_recursive(const char *target, bool no_exec_mask) { + if (target == NULL) { + errno = EINVAL; + perror("apply_default_acl_recursive (args)"); + return ACL_ERROR; } int max_levels = 256; - int flags = FTW_PHYS; /* Don't follow links. */ + int flags = FTW_MOUNT | FTW_PHYS; /* There are two separate functions that could be passed to nftw(). One passes no_exec_mask = true to apply_default_acl(), @@ -938,20 +186,16 @@ bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { int nftw_result = nftw(target, fn, max_levels, flags); - if (nftw_result == 0) { - /* Success */ - return true; - } - - /* nftw will return -1 on error, or if the supplied function - * (apply_default_acl_nftw) returns a non-zero result, nftw will - * return that. - */ - if (nftw_result == -1) { + /* nftw will itself return NFTW_ERROR on errors like malloc failure, + and since the only non-success value that "fn" can return us + ACL_ERROR == NFTW_ERROR, this covers all error cases. */ + if (nftw_result == NFTW_ERROR) { perror("apply_default_acl_recursive (nftw)"); + return ACL_ERROR; } - return false; + /* Beware: nftw indicates success with 0, but ACL_SUCCESS != 0. */ + return ACL_SUCCESS; } @@ -1006,7 +250,6 @@ int main(int argc, char* argv[]) { int arg_index = 1; for (arg_index = optind; arg_index < argc; arg_index++) { const char* target = argv[arg_index]; - bool reapp_result = false; /* Make sure we can access the given path before we go out of our * way to please it. Doing this check outside of @@ -1014,22 +257,23 @@ int main(int argc, char* argv[]) { * typos, too. */ if (!path_accessible(target)) { - fprintf(stderr, "%s: %s: no such file or directory\n", argv[0], target); + perror(target); result = EXIT_FAILURE; continue; } - if (recursive) { - reapp_result = apply_default_acl_recursive(target, no_exec_mask); - } - else { - /* It's either a normal file, or we're not operating recursively. */ - reapp_result = apply_default_acl(target, no_exec_mask); - } + int (*f)(const char *, bool) = recursive ? apply_default_acl_recursive + : apply_default_acl; + int reapp_result = f(target, no_exec_mask); - if (!reapp_result) { + if (result == EXIT_SUCCESS && reapp_result == ACL_FAILURE) { + /* We don't want to turn an error into a (less-severe) failure. */ result = EXIT_FAILURE; } + if (reapp_result == ACL_ERROR) { + /* Turn both success and failure into an error, if we encounter one. */ + result = EXIT_ERROR; + } } return result;