2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* dirname() */
17 #include <limits.h> /* PATH_MAX */
26 #include <acl/libacl.h> /* acl_get_perm, not portable */
27 #include <sys/types.h>
30 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Get the mode bits from the given path.
42 * The path (file or directory) whose mode we want.
44 * @return A mode_t (st_mode) structure containing the mode bits.
45 * See sys/stat.h for details.
47 mode_t
get_mode(const char* path
) {
54 int result
= lstat(path
, &s
);
60 /* errno will be set already by lstat() */
68 * @brief Determine if the given path might refer to an (unsafe) hard link.
73 * @return true if we are certain that @c path does not refer to a hard
74 * link, and false otherwise. In case of error, false is returned,
75 * because we are not sure that @c path is not a hard link.
77 bool is_hardlink_safe(const char* path
) {
82 int result
= lstat(path
, &s
);
84 return (s
.st_nlink
== 1 || S_ISDIR(s
.st_mode
));
93 * @brief Determine whether or not the given path is a regular file.
98 * @return true if @c path is a regular file, false otherwise.
100 bool is_regular_file(const char* path
) {
106 int result
= lstat(path
, &s
);
108 return S_ISREG(s
.st_mode
);
118 * @brief Determine whether or not the given path is accessible.
123 * @return true if @c path is accessible to the current effective
124 * user/group, false otherwise.
126 bool path_accessible(const char* path
) {
131 /* Test for access using the effective user and group rather than
133 int flags
= AT_EACCESS
;
135 /* Don't follow symlinks when checking for a path's existence,
136 since we won't follow them to set its ACLs either. */
137 flags
|= AT_SYMLINK_NOFOLLOW
;
139 /* If the path is relative, interpret it relative to the current
140 working directory (just like the access() system call). */
141 int result
= faccessat(AT_FDCWD
, path
, F_OK
, flags
);
154 * @brief Determine whether or not the given path is a directory.
159 * @return true if @c path is a directory, false otherwise.
161 bool is_directory(const char* path
) {
167 int result
= lstat(path
, &s
);
169 return S_ISDIR(s
.st_mode
);
179 * @brief Update (or create) an entry in an @b minimal ACL.
181 * This function will not work if @c aclp contains extended
182 * entries. This is fine for our purposes, since we call @c wipe_acls
183 * on each path before applying the default to it.
185 * The assumption that there are no extended entries makes things much
186 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
187 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
188 * be created anew. This means we don't have to fool around comparing
189 * named-user/group entries.
192 * A pointer to the acl_t structure whose entry we want to modify.
195 * The new entry. If @c entry contains a user/group/other entry, we
196 * update the existing one. Otherwise we create a new entry.
198 * @return If there is an unexpected library error, @c ACL_ERROR is
199 * returned. Otherwise, @c ACL_SUCCESS.
202 int acl_set_entry(acl_t
* aclp
,
206 int gt_result
= acl_get_tag_type(entry
, &entry_tag
);
207 if (gt_result
== ACL_ERROR
) {
208 perror("acl_set_entry (acl_get_tag_type)");
212 acl_permset_t entry_permset
;
213 int ps_result
= acl_get_permset(entry
, &entry_permset
);
214 if (ps_result
== ACL_ERROR
) {
215 perror("acl_set_entry (acl_get_permset)");
219 acl_entry_t existing_entry
;
220 /* Loop through the given ACL looking for matching entries. */
221 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
223 while (result
== ACL_SUCCESS
) {
224 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
225 int tag_result
= acl_get_tag_type(existing_entry
, &existing_tag
);
227 if (tag_result
== ACL_ERROR
) {
228 perror("set_acl_tag_permset (acl_get_tag_type)");
232 if (existing_tag
== entry_tag
) {
233 if (entry_tag
== ACL_USER_OBJ
||
234 entry_tag
== ACL_GROUP_OBJ
||
235 entry_tag
== ACL_OTHER
) {
236 /* Only update for these three since all other tags will have
237 been wiped. These three are guaranteed to exist, so if we
238 match one of them, we're allowed to return ACL_SUCCESS
239 below and bypass the rest of the function. */
240 acl_permset_t existing_permset
;
241 int gep_result
= acl_get_permset(existing_entry
, &existing_permset
);
242 if (gep_result
== ACL_ERROR
) {
243 perror("acl_set_entry (acl_get_permset)");
247 int s_result
= acl_set_permset(existing_entry
, entry_permset
);
248 if (s_result
== ACL_ERROR
) {
249 perror("acl_set_entry (acl_set_permset)");
258 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
261 /* This catches both the initial acl_get_entry and the ones at the
263 if (result
== ACL_ERROR
) {
264 perror("acl_set_entry (acl_get_entry)");
268 /* If we've made it this far, we need to add a new entry to the
270 acl_entry_t new_entry
;
272 /* We allocate memory here that we should release! */
273 int c_result
= acl_create_entry(aclp
, &new_entry
);
274 if (c_result
== ACL_ERROR
) {
275 perror("acl_set_entry (acl_create_entry)");
279 int st_result
= acl_set_tag_type(new_entry
, entry_tag
);
280 if (st_result
== ACL_ERROR
) {
281 perror("acl_set_entry (acl_set_tag_type)");
285 int s_result
= acl_set_permset(new_entry
, entry_permset
);
286 if (s_result
== ACL_ERROR
) {
287 perror("acl_set_entry (acl_set_permset)");
291 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
292 /* We need to set the qualifier too. */
293 void* entry_qual
= acl_get_qualifier(entry
);
294 if (entry_qual
== (void*)NULL
) {
295 perror("acl_set_entry (acl_get_qualifier)");
299 int sq_result
= acl_set_qualifier(new_entry
, entry_qual
);
300 if (sq_result
== ACL_ERROR
) {
301 perror("acl_set_entry (acl_set_qualifier)");
312 * @brief Determine the number of entries in the given ACL.
315 * A pointer to an @c acl_t structure.
317 * @return Either the non-negative number of entries in @c acl, or
318 * @c ACL_ERROR on error.
320 int acl_entry_count(acl_t
* acl
) {
324 int result
= acl_get_entry(*acl
, ACL_FIRST_ENTRY
, &entry
);
326 while (result
== ACL_SUCCESS
) {
328 result
= acl_get_entry(*acl
, ACL_NEXT_ENTRY
, &entry
);
331 if (result
== ACL_ERROR
) {
332 perror("acl_entry_count (acl_get_entry)");
342 * @brief Determine whether or not the given ACL is minimal.
344 * An ACL is minimal if it has fewer than four entries.
347 * A pointer to an acl_t structure.
350 * - @c ACL_SUCCESS - @c acl is minimal
351 * - @c ACL_FAILURE - @c acl is not minimal
352 * - @c ACL_ERROR - Unexpected library error
354 int acl_is_minimal(acl_t
* acl
) {
356 int ec
= acl_entry_count(acl
);
358 if (ec
== ACL_ERROR
) {
359 perror("acl_is_minimal (acl_entry_count)");
374 * @brief Determine whether the given path has an ACL whose mask
381 * - @c ACL_SUCCESS - @c path has a mask which denies execute.
382 * - @c ACL_FAILURE - The ACL for @c path does not deny execute,
383 * or @c path has no extended ACL at all.
384 * - @c ACL_ERROR - Unexpected library error.
386 int acl_execute_masked(const char* path
) {
388 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
390 if (acl
== (acl_t
)NULL
) {
391 perror("acl_execute_masked (acl_get_file)");
395 /* Our return value. */
396 int result
= ACL_FAILURE
;
399 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
401 while (ge_result
== ACL_SUCCESS
) {
402 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
403 int tag_result
= acl_get_tag_type(entry
, &tag
);
405 if (tag_result
== ACL_ERROR
) {
406 perror("acl_execute_masked (acl_get_tag_type)");
411 if (tag
== ACL_MASK
) {
412 /* This is the mask entry, get its permissions, and see if
413 execute is specified. */
414 acl_permset_t permset
;
416 int ps_result
= acl_get_permset(entry
, &permset
);
417 if (ps_result
== ACL_ERROR
) {
418 perror("acl_execute_masked (acl_get_permset)");
423 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
424 if (gp_result
== ACL_ERROR
) {
425 perror("acl_execute_masked (acl_get_perm)");
430 if (gp_result
== ACL_FAILURE
) {
431 /* No execute bit set in the mask; execute not allowed. */
436 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
447 * @brief Determine whether @c path is executable (by anyone) or a
450 * This is used as part of the heuristic to determine whether or not
451 * we should mask the execute bit when inheriting an ACL. If @c path
452 * is a directory, the answer is a clear-cut yes. This behavior is
453 * modeled after the capital 'X' perms of setfacl.
455 * If @c path is a file, we check the @a effective permissions,
456 * contrary to what setfacl does.
462 * - @c ACL_SUCCESS - @c path is a directory, or someone has effective
464 * - @c ACL_FAILURE - @c path is a regular file and nobody can execute
466 * - @c ACL_ERROR - Unexpected library error.
468 int any_can_execute_or_dir(const char* path
) {
470 if (is_directory(path
)) {
471 /* That was easy... */
475 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
477 if (acl
== (acl_t
)NULL
) {
478 perror("any_can_execute_or_dir (acl_get_file)");
482 /* Our return value. */
483 int result
= ACL_FAILURE
;
485 if (acl_is_minimal(&acl
)) {
486 mode_t mode
= get_mode(path
);
487 if (mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
488 result
= ACL_SUCCESS
;
492 result
= ACL_FAILURE
;
498 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
500 while (ge_result
== ACL_SUCCESS
) {
501 /* The first thing we do is check to see if this is a mask
502 entry. If it is, we skip it entirely. */
503 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
504 int tag_result
= acl_get_tag_type(entry
, &tag
);
506 if (tag_result
== ACL_ERROR
) {
507 perror("any_can_execute_or_dir (acl_get_tag_type)");
512 if (tag
== ACL_MASK
) {
513 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
517 /* Ok, so it's not a mask entry. Check the execute perms. */
518 acl_permset_t permset
;
520 int ps_result
= acl_get_permset(entry
, &permset
);
521 if (ps_result
== ACL_ERROR
) {
522 perror("any_can_execute_or_dir (acl_get_permset)");
527 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
528 if (gp_result
== ACL_ERROR
) {
529 perror("any_can_execute_or_dir (acl_get_perm)");
534 if (gp_result
== ACL_SUCCESS
) {
535 /* Only return ACL_SUCCESS if this execute bit is not masked. */
536 if (acl_execute_masked(path
) != ACL_SUCCESS
) {
537 result
= ACL_SUCCESS
;
542 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
545 if (ge_result
== ACL_ERROR
) {
546 perror("any_can_execute_or_dir (acl_get_entry)");
559 * @brief Inherit the default ACL from @c parent to @c path.
561 * The @c parent parameter does not necessarily need to be the parent
562 * of @c path, although that will usually be the case. This overwrites
563 * any existing default ACL on @c path.
566 * The parent directory whose ACL we want to inherit.
569 * The target directory whose ACL we wish to overwrite (or create).
572 * - @c ACL_SUCCESS - The default ACL was inherited successfully.
573 * - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
574 * - @c ACL_ERROR - Unexpected library error.
576 int inherit_default_acl(const char* path
, const char* parent
) {
578 /* Our return value. */
579 int result
= ACL_SUCCESS
;
586 if (!is_directory(path
) || !is_directory(parent
)) {
590 acl_t parent_acl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
591 if (parent_acl
== (acl_t
)NULL
) {
592 perror("inherit_default_acl (acl_get_file)");
596 acl_t path_acl
= acl_dup(parent_acl
);
598 if (path_acl
== (acl_t
)NULL
) {
599 perror("inherit_default_acl (acl_dup)");
600 acl_free(parent_acl
);
604 int sf_result
= acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
);
605 if (sf_result
== -1) {
606 perror("inherit_default_acl (acl_set_file)");
619 * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
620 * from the given path.
623 * The path whose ACLs we want to wipe.
626 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
627 * existed in the first place.
628 * - @c ACL_ERROR - Unexpected library error.
630 int wipe_acls(const char* path
) {
637 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
638 if (acl
== (acl_t
)NULL
) {
639 perror("wipe_acls (acl_get_file)");
643 /* Our return value. */
644 int result
= ACL_SUCCESS
;
647 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
649 while (ge_result
== ACL_SUCCESS
) {
650 int d_result
= acl_delete_entry(acl
, entry
);
651 if (d_result
== ACL_ERROR
) {
652 perror("wipe_acls (acl_delete_entry)");
657 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
660 /* Catches the first acl_get_entry as well as the ones at the end of
662 if (ge_result
== ACL_ERROR
) {
663 perror("wipe_acls (acl_get_entry)");
668 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
669 if (sf_result
== ACL_ERROR
) {
670 perror("wipe_acls (acl_set_file)");
683 * @brief Apply parent default ACL to a path.
685 * This overwrites any existing ACLs on @c path.
688 * The path whose ACL we would like to reset to its default.
690 * @param no_exec_mask
691 * The value (either true or false) of the --no-exec-mask flag.
694 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
695 * - @c ACL_FAILURE - The target path is not a regular file/directory,
696 * or the parent of @c path is not a directory.
697 * - @c ACL_ERROR - Unexpected library error.
699 int apply_default_acl(const char* path
, bool no_exec_mask
) {
706 /* Refuse to operate on hard links, which can be abused by an
707 * attacker to trick us into changing the ACL on a file we didn't
708 * intend to; namely the "target" of the hard link. To truly prevent
709 * that sort of mischief, we should be using file descriptors for
710 * the target and its parent directory. Then modulo a tiny race
711 * condition, we would be sure that "path" and "parent" don't change
712 * their nature between the time that we test them and when we
713 * utilize them. For contrast, the same attacker is free to replace
714 * "path" with a hard link after is_hardlink_safe() has returned
717 * Unfortunately, our API is lacking in this area. For example,
718 * acl_set_fd() is only capable of setting the ACL_TYPE_ACCESS list,
719 * and not the ACL_TYPE_DEFAULT. Apparently the only way to operate
720 * on default ACLs is through the path name, which is inherently
721 * unreliable since the acl_*_file() calls themselves might follow
722 * links (both hard and symbolic).
724 * Some improvement could still be made by using descriptors where
725 * possible -- this would shrink the exploit window -- but for now
726 * we use a naive implementation that only keeps honest men honest.
728 if (!is_hardlink_safe(path
)) {
732 if (!is_regular_file(path
) && !is_directory(path
)) {
736 /* dirname mangles its argument */
737 char path_copy
[PATH_MAX
];
738 strncpy(path_copy
, path
, PATH_MAX
-1);
739 path_copy
[PATH_MAX
-1] = 0;
741 char* parent
= dirname(path_copy
);
742 if (!is_directory(parent
)) {
743 /* Make sure dirname() did what we think it did. */
747 /* Default to not masking the exec bit; i.e. applying the default
748 ACL literally. If --no-exec-mask was not specified, then we try
749 to "guess" whether or not to mask the exec bit. */
750 bool allow_exec
= true;
753 int ace_result
= any_can_execute_or_dir(path
);
755 if (ace_result
== ACL_ERROR
) {
756 perror("apply_default_acl (any_can_execute_or_dir)");
760 allow_exec
= (bool)ace_result
;
763 acl_t defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
765 if (defacl
== (acl_t
)NULL
) {
766 perror("apply_default_acl (acl_get_file)");
770 /* Our return value. */
771 int result
= ACL_SUCCESS
;
773 int wipe_result
= wipe_acls(path
);
774 if (wipe_result
== ACL_ERROR
) {
775 perror("apply_default_acl (wipe_acls)");
780 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
781 ACL with this one. */
782 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
783 if (acl
== (acl_t
)NULL
) {
784 perror("apply_default_acl (acl_get_file)");
788 /* If it's a directory, inherit the parent's default. */
789 int inherit_result
= inherit_default_acl(path
, parent
);
790 if (inherit_result
== ACL_ERROR
) {
791 perror("apply_default_acl (inherit_acls)");
797 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
799 while (ge_result
== ACL_SUCCESS
) {
800 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
801 int tag_result
= acl_get_tag_type(entry
, &tag
);
803 if (tag_result
== ACL_ERROR
) {
804 perror("apply_default_acl (acl_get_tag_type)");
810 /* We've got an entry/tag from the default ACL. Get its permset. */
811 acl_permset_t permset
;
812 int ps_result
= acl_get_permset(entry
, &permset
);
813 if (ps_result
== ACL_ERROR
) {
814 perror("apply_default_acl (acl_get_permset)");
819 /* If this is a default mask, fix it up. */
820 if (tag
== ACL_MASK
||
821 tag
== ACL_USER_OBJ
||
822 tag
== ACL_GROUP_OBJ
||
826 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
827 minimal ACLs) or acl_other entries, so if execute should be
828 masked, we have to do it manually. */
829 int d_result
= acl_delete_perm(permset
, ACL_EXECUTE
);
830 if (d_result
== ACL_ERROR
) {
831 perror("apply_default_acl (acl_delete_perm)");
836 int sp_result
= acl_set_permset(entry
, permset
);
837 if (sp_result
== ACL_ERROR
) {
838 perror("apply_default_acl (acl_set_permset)");
845 /* Finally, add the permset to the access ACL. */
846 int set_result
= acl_set_entry(&acl
, entry
);
847 if (set_result
== ACL_ERROR
) {
848 perror("apply_default_acl (acl_set_entry)");
853 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
856 /* Catches the first acl_get_entry as well as the ones at the end of
858 if (ge_result
== ACL_ERROR
) {
859 perror("apply_default_acl (acl_get_entry)");
864 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
865 if (sf_result
== ACL_ERROR
) {
866 perror("apply_default_acl (acl_set_file)");
879 * @brief Display program usage information.
881 * @param program_name
882 * The program name to use in the output.
885 void usage(const char* program_name
) {
886 printf("Apply any applicable default ACLs to the given files or "
888 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
891 printf(" -h, --help Print this help message\n");
892 printf(" -r, --recursive Act on any given directories recursively\n");
893 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
900 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
902 * For parameter information, see the @c nftw man page.
904 * @return If the ACL was applied to @c target successfully, we return
905 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
906 * the next file or directory. Otherwise, we return @c FTW_STOP to
910 int apply_default_acl_nftw(const char *target
,
911 const struct stat
*s
,
915 bool app_result
= apply_default_acl(target
, false);
927 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
929 * This is identical to @c apply_default_acl_nftw(), except it passes
930 * @c true to @c apply_default_acl() as its no_exec_mask argument.
933 int apply_default_acl_nftw_x(const char *target
,
934 const struct stat
*s
,
938 bool app_result
= apply_default_acl(target
, true);
950 * @brief Recursive version of @c apply_default_acl().
952 * If @c target is a directory, we use @c nftw() to call @c
953 * apply_default_acl() recursively on all of its children. Otherwise,
954 * we just delegate to @c apply_default_acl().
956 * We ignore symlinks for consistency with chmod -r.
959 * The root (path) of the recursive application.
961 * @param no_exec_mask
962 * The value (either true or false) of the --no-exec-mask flag.
965 * If @c target is not a directory, we return the result of
966 * calling @c apply_default_acl() on @c target. Otherwise, we convert
967 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
968 * then we return @c true. Otherwise, we return @c false.
970 * If there is an error, it will be reported via @c perror, but
971 * we still return @c false.
973 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
975 if (!is_directory(target
)) {
976 return apply_default_acl(target
, no_exec_mask
);
979 int max_levels
= 256;
980 int flags
= FTW_PHYS
; /* Don't follow links. */
982 /* There are two separate functions that could be passed to
983 nftw(). One passes no_exec_mask = true to apply_default_acl(),
984 and the other passes no_exec_mask = false. Since the function we
985 pass to nftw() cannot have parameters, we have to create separate
986 options and make the decision here. */
987 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
988 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
990 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
992 if (nftw_result
== 0) {
997 /* nftw will return -1 on error, or if the supplied function
998 * (apply_default_acl_nftw) returns a non-zero result, nftw will
1001 if (nftw_result
== -1) {
1002 perror("apply_default_acl_recursive (nftw)");
1011 * @brief Call apply_default_acl (possibly recursively) on each
1012 * command-line argument.
1014 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
1015 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
1018 int main(int argc
, char* argv
[]) {
1022 return EXIT_FAILURE
;
1025 bool recursive
= false;
1026 bool no_exec_mask
= false;
1028 struct option long_options
[] = {
1029 /* These options set a flag. */
1030 {"help", no_argument
, NULL
, 'h'},
1031 {"recursive", no_argument
, NULL
, 'r'},
1032 {"no-exec-mask", no_argument
, NULL
, 'x'},
1038 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
1042 return EXIT_SUCCESS
;
1047 no_exec_mask
= true;
1051 return EXIT_FAILURE
;
1055 int result
= EXIT_SUCCESS
;
1058 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
1059 const char* target
= argv
[arg_index
];
1060 bool reapp_result
= false;
1062 /* Make sure we can access the given path before we go out of our
1063 * way to please it. Doing this check outside of
1064 * apply_default_acl() lets us spit out a better error message for
1067 if (!path_accessible(target
)) {
1068 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
1069 result
= EXIT_FAILURE
;
1074 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
1077 /* It's either a normal file, or we're not operating recursively. */
1078 reapp_result
= apply_default_acl(target
, no_exec_mask
);
1081 if (!reapp_result
) {
1082 result
= EXIT_FAILURE
;