X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Flibadacl.c;h=1411536ea8e4963f2fe951058daac69b2715f5dd;hb=0e4810e0a4e3ca231c1c526729d74200d7fef031;hp=38e362e5066fdeb4f086ba19774fd65faae78c99;hpb=8373437e3e99e776f99ae592f2a0f2560317cc0a;p=apply-default-acl.git

diff --git a/src/libadacl.c b/src/libadacl.c
index 38e362e..1411536 100644
--- a/src/libadacl.c
+++ b/src/libadacl.c
@@ -5,16 +5,17 @@
  *
  */
 
-/* Enables get_current_dir_name() in unistd.h and the O_PATH flag. */
+/* Enables get_current_dir_name() in unistd.h, the O_PATH flag, and
+ * the asprintf() function.
+*/
 #define _GNU_SOURCE
 
 #include <dirent.h>     /* readdir(), etc. */
 #include <errno.h>      /* EINVAL, ELOOP, ENOTDIR, etc. */
 #include <fcntl.h>      /* openat() */
 #include <libgen.h>     /* basename(), dirname() */
-#include <limits.h>     /* PATH_MAX */
 #include <stdbool.h>    /* the "bool" type */
-#include <stdio.h>      /* perror(), snprintf() */
+#include <stdio.h>      /* perror(), asprintf() */
 #include <stdlib.h>     /* free() */
 #include <string.h>     /* strdup() */
 #include <sys/stat.h>   /* fstat() */
@@ -36,11 +37,29 @@
  */
 #define CLOSE_ERROR -1
 #define OPEN_ERROR -1
-#define SNPRINTF_ERROR -1
+#define ASPRINTF_ERROR -1
 #define STAT_ERROR -1
 #define XATTR_ERROR -1
 
 
+/* Prototypes */
+int safe_open_ex(int at_fd, char* pathname, int flags);
+int safe_open(const char* pathname, int flags);
+int acl_update_entry(acl_t aclp, acl_entry_t entry);
+int acl_entry_count(acl_t acl);
+int acl_is_minimal(acl_t acl);
+int acl_execute_masked(acl_t acl);
+int any_can_execute(int fd, const struct stat* sp);
+int acl_copy_xattr(int src_fd,
+                   acl_type_t src_type,
+                   int dst_fd,
+                   acl_type_t dst_type);
+int has_default_acl_fd(int fd);
+int apply_default_acl_fds(int parent_fd, int fd, bool recursive);
+int apply_default_acl(const char* path, bool recursive);
+
+
+
 /**
  * @brief The recursive portion of the @c safe_open function, used to
  *   open a file descriptor in a symlink-safe way when combined with
@@ -134,11 +153,11 @@ int safe_open(const char* pathname, int flags) {
     return OPEN_ERROR;
   }
 
-  char abspath[PATH_MAX];
-  int snprintf_result = 0;
+  char* abspath = NULL;
+  int asprintf_result = 0;
   if (strchr(pathname, '/') == pathname) {
     /* pathname is already absolute; just copy it. */
-    snprintf_result = snprintf(abspath, PATH_MAX, "%s", pathname);
+    asprintf_result = asprintf(&abspath, "%s", pathname);
   }
   else {
     /* Concatenate the current working directory and pathname into an
@@ -163,14 +182,17 @@ int safe_open(const char* pathname, int flags) {
       free(cwd);
       return OPEN_ERROR;
     }
-    snprintf_result = snprintf(abspath, PATH_MAX, "%s/%s", abs_cwd, pathname);
+    asprintf_result = asprintf(&abspath, "%s/%s", abs_cwd, pathname);
     free(cwd);
   }
-  if (snprintf_result == SNPRINTF_ERROR || snprintf_result > PATH_MAX) {
-    perror("safe_open (snprintf)");
+  if (asprintf_result == ASPRINTF_ERROR) {
+    perror("safe_open (asprintf)");
     return OPEN_ERROR;
   }
 
+  /* Beyond here, asprintf() worked, and we need to free abspath. */
+  int result = OPEN_ERROR;
+
   bool abspath_is_root = (strcmp(abspath, "/") == 0);
   int rootflags = flags | O_DIRECTORY;
   if (!abspath_is_root) {
@@ -180,18 +202,24 @@ int safe_open(const char* pathname, int flags) {
   int rootfd = open("/", rootflags);
   if (rootfd == OPEN_ERROR) {
     perror("safe_open (open)");
-    return OPEN_ERROR;
+    result = OPEN_ERROR;
+    goto cleanup;
   }
 
   if (abspath_is_root) {
-    return rootfd;
+    result = rootfd;
+    goto cleanup;
   }
 
-  int result = safe_open_ex(rootfd, abspath+1, flags);
+  result = safe_open_ex(rootfd, abspath+1, flags);
   if (close(rootfd) == CLOSE_ERROR) {
     perror("safe_open (close)");
-    return OPEN_ERROR;
+    result = OPEN_ERROR;
+    goto cleanup;
   }
+
+ cleanup:
+  free(abspath);
   return result;
 }
 
@@ -644,9 +672,6 @@ int has_default_acl_fd(int fd) {
  * @param fd
  *   The file descriptor that should inherit its parent's default ACL.
  *
- * @param no_exec_mask
- *   The value (either true or false) of the --no-exec-mask flag.
- *
  * @param recursive
  *   Should we recurse into subdirectories?
  *
@@ -657,7 +682,6 @@ int has_default_acl_fd(int fd) {
  */
 int apply_default_acl_fds(int parent_fd,
                           int fd,
-                          bool no_exec_mask,
                           bool recursive) {
   int result = ACL_SUCCESS;
 
@@ -708,24 +732,20 @@ int apply_default_acl_fds(int parent_fd,
   }
 
 
-  /* Default to not masking the exec bit; i.e. applying the default
-     ACL literally. If --no-exec-mask was not specified, then we try
-     to "guess" whether or not to mask the exec bit. This behavior
-     is modeled after the capital 'X' perms of setfacl. */
-  bool allow_exec = true;
+  /* Next We try to guess whether or not to strip the execute bits.
+   * This behavior is modeled after the capital 'X' perms of setfacl.
+  */
+  int ace_result = any_can_execute(fd, &s);
 
-  if (!no_exec_mask) {
-    /* Never mask the execute bit on directories. */
-    int ace_result = any_can_execute(fd,&s) || S_ISDIR(s.st_mode);
+  if (ace_result == ACL_ERROR) {
+    perror("apply_default_acl_fds (any_can_execute)");
+    result = ACL_ERROR;
+    goto cleanup;
+  }
 
-    if (ace_result == ACL_ERROR) {
-      perror("apply_default_acl_fds (any_can_execute)");
-      result = ACL_ERROR;
-      goto cleanup;
-    }
+  /* Never mask the execute bit on directories. */
+  bool allow_exec = (bool)ace_result || S_ISDIR(s.st_mode);
 
-    allow_exec = (bool)ace_result;
-  }
 
   /* If it's a directory, inherit the parent's default.  */
   if (S_ISDIR(s.st_mode)) {
@@ -807,6 +827,8 @@ int apply_default_acl_fds(int parent_fd,
       goto cleanup;
     }
 
+    /* To mimic what the kernel does, I think we could drop
+       ACL_GROUP_OBJ from the list below? */
     if (tag == ACL_MASK ||
         tag == ACL_USER_OBJ ||
         tag == ACL_GROUP_OBJ ||
@@ -893,12 +915,13 @@ int apply_default_acl_fds(int parent_fd,
           continue;
         }
       }
-      switch (apply_default_acl_fds(fd, new_fd, no_exec_mask, recursive)) {
+      switch (apply_default_acl_fds(fd, new_fd, recursive)) {
         /* Don't overwrite an error result with success/failure. */
         case ACL_FAILURE:
           if (result == ACL_SUCCESS) {
             result = ACL_FAILURE;
           }
+          break;
         case ACL_ERROR:
           result = ACL_ERROR;
         default:
@@ -927,9 +950,6 @@ int apply_default_acl_fds(int parent_fd,
  * @param path
  *   The path whose ACL we would like to reset to its default.
  *
- * @param no_exec_mask
- *   The value (either true or false) of the --no-exec-mask flag.
- *
  * @param recursive
  *   Should we recurse into subdirectories?
  *
@@ -938,7 +958,7 @@ int apply_default_acl_fds(int parent_fd,
  *   - @c ACL_FAILURE - If symlinks or hard links are encountered.
  *   - @c ACL_ERROR - Unexpected library error.
  */
-int apply_default_acl(const char* path, bool no_exec_mask, bool recursive) {
+int apply_default_acl(const char* path, bool recursive) {
 
   if (path == NULL) {
     errno = EINVAL;
@@ -1011,7 +1031,7 @@ int apply_default_acl(const char* path, bool no_exec_mask, bool recursive) {
     }
   }
 
-  result = apply_default_acl_fds(parent_fd, fd, no_exec_mask, recursive);
+  result = apply_default_acl_fds(parent_fd, fd, recursive);
 
  cleanup:
   free(dirname_path_copy);