2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Determine whether or not the given path is accessible.
44 * @return true if @c path is accessible to the current effective
45 * user/group, false otherwise.
47 bool path_accessible(const char* path
) {
52 /* Test for access using the effective user and group rather than
54 int flags
= AT_EACCESS
;
56 /* Don't follow symlinks when checking for a path's existence,
57 since we won't follow them to set its ACLs either. */
58 flags
|= AT_SYMLINK_NOFOLLOW
;
60 /* If the path is relative, interpret it relative to the current
61 working directory (just like the access() system call). */
62 if (faccessat(AT_FDCWD
, path
, F_OK
, flags
) == 0) {
73 * @brief Update (or create) an entry in an @b minimal ACL.
75 * This function will not work if @c aclp contains extended
76 * entries. This is fine for our purposes, since we call @c wipe_acls
77 * on each path before applying the default to it.
79 * The assumption that there are no extended entries makes things much
80 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
81 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
82 * be created anew. This means we don't have to fool around comparing
83 * named-user/group entries.
86 * A pointer to the acl_t structure whose entry we want to modify.
89 * The new entry. If @c entry contains a user/group/other entry, we
90 * update the existing one. Otherwise we create a new entry.
92 * @return If there is an unexpected library error, @c ACL_ERROR is
93 * returned. Otherwise, @c ACL_SUCCESS.
96 int acl_set_entry(acl_t
* aclp
, acl_entry_t entry
) {
99 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
100 perror("acl_set_entry (acl_get_tag_type)");
104 acl_permset_t entry_permset
;
105 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
106 perror("acl_set_entry (acl_get_permset)");
110 acl_entry_t existing_entry
;
111 /* Loop through the given ACL looking for matching entries. */
112 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
114 while (result
== ACL_SUCCESS
) {
115 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
117 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
118 perror("set_acl_tag_permset (acl_get_tag_type)");
122 if (existing_tag
== entry_tag
) {
123 if (entry_tag
== ACL_USER_OBJ
||
124 entry_tag
== ACL_GROUP_OBJ
||
125 entry_tag
== ACL_OTHER
) {
126 /* Only update for these three since all other tags will have
127 been wiped. These three are guaranteed to exist, so if we
128 match one of them, we're allowed to return ACL_SUCCESS
129 below and bypass the rest of the function. */
130 acl_permset_t existing_permset
;
131 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
132 perror("acl_set_entry (acl_get_permset)");
136 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
137 perror("acl_set_entry (acl_set_permset)");
146 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
149 /* This catches both the initial acl_get_entry and the ones at the
151 if (result
== ACL_ERROR
) {
152 perror("acl_set_entry (acl_get_entry)");
156 /* If we've made it this far, we need to add a new entry to the
158 acl_entry_t new_entry
;
160 /* The acl_create_entry() function can allocate new memory and/or
161 * change the location of the ACL structure entirely. When that
162 * happens, the value pointed to by aclp is updated, which means
163 * that a new acl_t gets "passed out" to our caller, eventually to
164 * be fed to acl_free(). In other words, we should still be freeing
165 * the right thing, even if the value pointed to by aclp changes.
167 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
168 perror("acl_set_entry (acl_create_entry)");
172 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
173 perror("acl_set_entry (acl_set_tag_type)");
177 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
178 perror("acl_set_entry (acl_set_permset)");
182 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
183 /* We need to set the qualifier too. */
184 void* entry_qual
= acl_get_qualifier(entry
);
185 if (entry_qual
== (void*)NULL
) {
186 perror("acl_set_entry (acl_get_qualifier)");
190 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
191 perror("acl_set_entry (acl_set_qualifier)");
202 * @brief Determine the number of entries in the given ACL.
205 * The ACL to inspect.
207 * @return Either the non-negative number of entries in @c acl, or
208 * @c ACL_ERROR on error.
210 int acl_entry_count(acl_t acl
) {
214 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
216 while (result
== ACL_SUCCESS
) {
218 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
221 if (result
== ACL_ERROR
) {
222 perror("acl_entry_count (acl_get_entry)");
232 * @brief Determine whether or not the given ACL is minimal.
234 * An ACL is minimal if it has fewer than four entries.
237 * The ACL whose minimality is in question.
240 * - @c ACL_SUCCESS - @c acl is minimal
241 * - @c ACL_FAILURE - @c acl is not minimal
242 * - @c ACL_ERROR - Unexpected library error
244 int acl_is_minimal(acl_t acl
) {
246 int ec
= acl_entry_count(acl
);
248 if (ec
== ACL_ERROR
) {
249 perror("acl_is_minimal (acl_entry_count)");
264 * @brief Determine whether the given ACL's mask denies execute.
267 * The ACL whose mask we want to check.
270 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
271 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
272 * - @c ACL_ERROR - Unexpected library error.
274 int acl_execute_masked(acl_t acl
) {
277 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
279 while (ge_result
== ACL_SUCCESS
) {
280 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
282 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
283 perror("acl_execute_masked (acl_get_tag_type)");
287 if (tag
== ACL_MASK
) {
288 /* This is the mask entry, get its permissions, and see if
289 execute is specified. */
290 acl_permset_t permset
;
292 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
293 perror("acl_execute_masked (acl_get_permset)");
297 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
298 if (gp_result
== ACL_ERROR
) {
299 perror("acl_execute_masked (acl_get_perm)");
303 if (gp_result
== ACL_FAILURE
) {
304 /* No execute bit set in the mask; execute not allowed. */
309 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
318 * @brief Determine whether @c fd is executable by anyone.
321 * This is used as part of the heuristic to determine whether or not
322 * we should mask the execute bit when inheriting an ACL. If @c fd
323 * describes a file, we check the @a effective permissions, contrary
324 * to what setfacl does.
327 * The file descriptor to check.
330 * A pointer to a stat structure for @c fd.
333 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
334 * - @c ACL_FAILURE - Nobody can execute @c fd.
335 * - @c ACL_ERROR - Unexpected library error.
337 int any_can_execute(int fd
, const struct stat
* sp
) {
338 acl_t acl
= acl_get_fd(fd
);
340 if (acl
== (acl_t
)NULL
) {
341 perror("any_can_execute (acl_get_file)");
345 /* Our return value. */
346 int result
= ACL_FAILURE
;
348 if (acl_is_minimal(acl
)) {
349 if (sp
->st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
350 result
= ACL_SUCCESS
;
354 result
= ACL_FAILURE
;
360 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
362 while (ge_result
== ACL_SUCCESS
) {
363 /* The first thing we do is check to see if this is a mask
364 entry. If it is, we skip it entirely. */
365 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
367 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
368 perror("any_can_execute_or (acl_get_tag_type)");
373 if (tag
== ACL_MASK
) {
374 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
378 /* Ok, so it's not a mask entry. Check the execute perms. */
379 acl_permset_t permset
;
381 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
382 perror("any_can_execute_or (acl_get_permset)");
387 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
388 if (gp_result
== ACL_ERROR
) {
389 perror("any_can_execute (acl_get_perm)");
394 if (gp_result
== ACL_SUCCESS
) {
395 /* Only return ACL_SUCCESS if this execute bit is not masked. */
396 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
397 result
= ACL_SUCCESS
;
402 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
405 if (ge_result
== ACL_ERROR
) {
406 perror("any_can_execute (acl_get_entry)");
419 * @brief Set @c acl as the default ACL on @c path.
421 * This overwrites any existing default ACL on @c path. If @c path is
422 * not a directory, we return ACL_ERROR and @c errno is set.
425 * The target directory whose ACL we wish to replace or create.
428 * The ACL to set as default on @c path.
431 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
432 * - @c ACL_ERROR - Unexpected library error.
434 int assign_default_acl(const char* path
, acl_t acl
) {
438 perror("assign_default_acl (args)");
442 /* Our return value; success unless something bad happens. */
443 int result
= ACL_SUCCESS
;
444 acl_t path_acl
= acl_dup(acl
);
446 if (path_acl
== (acl_t
)NULL
) {
447 perror("assign_default_acl (acl_dup)");
448 return ACL_ERROR
; /* Nothing to clean up in this case. */
451 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
452 perror("assign_default_acl (acl_set_file)");
463 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
464 * descriptor, leaving the UNIX permission bits.
467 * The file descriptor whose ACLs we want to wipe.
470 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
471 * existed in the first place.
472 * - @c ACL_ERROR - Unexpected library error.
474 int wipe_acls(int fd
) {
475 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
476 acl_t empty_acl
= acl_init(0);
478 if (empty_acl
== (acl_t
)NULL
) {
479 perror("wipe_acls (acl_init)");
483 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
484 perror("wipe_acls (acl_set_fd)");
496 * @brief Apply parent default ACL to a path.
498 * This overwrites any existing ACLs on @c path.
501 * The path whose ACL we would like to reset to its default.
504 * A pointer to a stat structure for @c path, or @c NULL if you don't
507 * @param no_exec_mask
508 * The value (either true or false) of the --no-exec-mask flag.
511 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
512 * - @c ACL_FAILURE - The target path is not a regular file/directory,
513 * or the parent of @c path is not a directory.
514 * - @c ACL_ERROR - Unexpected library error.
516 int apply_default_acl(const char* path
,
517 const struct stat
* sp
,
522 perror("apply_default_acl (args)");
526 /* Define these next three variables here because we may have to
527 * jump to the cleanup routine which expects them to exist.
530 /* Our return value. */
531 int result
= ACL_SUCCESS
;
533 /* The default ACL on path's parent directory */
534 acl_t defacl
= (acl_t
)NULL
;
536 /* The file descriptor corresponding to "path" */
539 /* Split "path" into base/dirname parts to be used with openat().
540 * We duplicate the strings involved because dirname/basename mangle
543 char* path_copy
= strdup(path
);
544 if (path_copy
== NULL
) {
545 perror("apply_default_acl (strdup)");
548 char* parent
= dirname(path_copy
);
550 fd
= open(path
, O_NOFOLLOW
);
552 if (errno
== ELOOP
) {
553 result
= ACL_FAILURE
; /* hit a symlink */
557 perror("apply_default_acl (open fd)");
564 /* Refuse to operate on hard links, which can be abused by an
565 * attacker to trick us into changing the ACL on a file we didn't
566 * intend to; namely the "target" of the hard link. There is TOCTOU
567 * race condition here, but the window is as small as possible
568 * between when we open the file descriptor (look above) and when we
571 * Note: we only need to call fstat ourselves if we weren't passed a
572 * valid pointer to a stat structure (nftw does that).
576 if (fstat(fd
, &s
) == -1) {
577 perror("apply_default_acl (fstat)");
584 if (!S_ISDIR(sp
->st_mode
)) {
585 /* If it's not a directory, make sure it's a regular,
586 non-hard-linked file. */
587 if (!S_ISREG(sp
->st_mode
) || sp
->st_nlink
!= 1) {
588 result
= ACL_FAILURE
;
594 /* Default to not masking the exec bit; i.e. applying the default
595 ACL literally. If --no-exec-mask was not specified, then we try
596 to "guess" whether or not to mask the exec bit. This behavior
597 is modeled after the capital 'X' perms of setfacl. */
598 bool allow_exec
= true;
601 /* Never mask the execute bit on directories. */
602 int ace_result
= any_can_execute(fd
,sp
) || S_ISDIR(sp
->st_mode
);
604 if (ace_result
== ACL_ERROR
) {
605 perror("apply_default_acl (any_can_execute)");
610 allow_exec
= (bool)ace_result
;
613 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
615 if (defacl
== (acl_t
)NULL
) {
616 perror("apply_default_acl (acl_get_file)");
621 if (wipe_acls(fd
) == ACL_ERROR
) {
622 perror("apply_default_acl (wipe_acls)");
627 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
628 ACL with this one. */
629 acl_t acl
= acl_get_fd(fd
);
630 if (acl
== (acl_t
)NULL
) {
631 perror("apply_default_acl (acl_get_fd)");
636 /* If it's a directory, inherit the parent's default. We sure hope
637 * that "path" still points to the same thing that "fd" and this
638 * "sp" describe. If not, we may wind up trying to set a default ACL
639 * on a file, and this will throw an error. I guess that's what we
642 if (S_ISDIR(sp
->st_mode
) && assign_default_acl(path
, defacl
) == ACL_ERROR
) {
643 perror("apply_default_acl (assign_default_acl)");
649 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
651 while (ge_result
== ACL_SUCCESS
) {
652 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
654 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
655 perror("apply_default_acl (acl_get_tag_type)");
661 /* We've got an entry/tag from the default ACL. Get its permset. */
662 acl_permset_t permset
;
663 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
664 perror("apply_default_acl (acl_get_permset)");
669 /* If this is a default mask, fix it up. */
670 if (tag
== ACL_MASK
||
671 tag
== ACL_USER_OBJ
||
672 tag
== ACL_GROUP_OBJ
||
676 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
677 minimal ACLs) or acl_other entries, so if execute should be
678 masked, we have to do it manually. */
679 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
680 perror("apply_default_acl (acl_delete_perm)");
685 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
686 perror("apply_default_acl (acl_set_permset)");
693 /* Finally, add the permset to the access ACL. It's actually
694 * important that we pass in the address of "acl" here, and not
695 * "acl" itself. Why? The call to acl_create_entry() within
696 * acl_set_entry() can allocate new memory for the entry.
697 * Sometimes that can be done in-place, in which case everything
698 * is cool and the new memory gets released when we call
701 * But occasionally, the whole ACL structure will have to be moved
702 * in order to allocate the extra space. When that happens,
703 * acl_create_entry() modifies the pointer it was passed (in this
704 * case, &acl) to point to the new location. We want to call
705 * acl_free() on the new location, and since acl_free() gets
706 * called right here, we need acl_create_entry() to update the
707 * value of "acl". To do that, it needs the address of "acl".
709 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
710 perror("apply_default_acl (acl_set_entry)");
715 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
718 /* Catches the first acl_get_entry as well as the ones at the end of
720 if (ge_result
== ACL_ERROR
) {
721 perror("apply_default_acl (acl_get_entry)");
726 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
727 perror("apply_default_acl (acl_set_fd)");
734 if (defacl
!= (acl_t
)NULL
) {
737 if (fd
>= 0 && close(fd
) == -1) {
738 perror("apply_default_acl (close)");
747 * @brief Display program usage information.
749 * @param program_name
750 * The program name to use in the output.
753 void usage(const char* program_name
) {
754 printf("Apply any applicable default ACLs to the given files or "
756 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
759 printf(" -h, --help Print this help message\n");
760 printf(" -r, --recursive Act on any given directories recursively\n");
761 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
768 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
770 * For parameter information, see the @c nftw man page.
772 * @return If the ACL was applied to @c target successfully, we return
773 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
774 * the next file or directory. Otherwise, we return @c FTW_STOP to
778 int apply_default_acl_nftw(const char *target
,
779 const struct stat
*sp
,
783 if (apply_default_acl(target
, sp
, false)) {
794 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
796 * This is identical to @c apply_default_acl_nftw(), except it passes
797 * @c true to @c apply_default_acl() as its no_exec_mask argument.
800 int apply_default_acl_nftw_x(const char *target
,
801 const struct stat
*sp
,
805 if (apply_default_acl(target
, sp
, true)) {
816 * @brief Recursive version of @c apply_default_acl().
818 * If @c target is a directory, we use @c nftw() to call @c
819 * apply_default_acl() recursively on all of its children. Otherwise,
820 * we just delegate to @c apply_default_acl().
822 * We ignore symlinks for consistency with chmod -r.
825 * The root (path) of the recursive application.
827 * @param no_exec_mask
828 * The value (either true or false) of the --no-exec-mask flag.
831 * If @c target is not a directory, we return the result of
832 * calling @c apply_default_acl() on @c target. Otherwise, we convert
833 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
834 * then we return @c true. Otherwise, we return @c false.
836 * If there is an error, it will be reported via @c perror, but
837 * we still return @c false.
839 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
840 int max_levels
= 256;
841 int flags
= FTW_PHYS
; /* Don't follow links. */
843 /* There are two separate functions that could be passed to
844 nftw(). One passes no_exec_mask = true to apply_default_acl(),
845 and the other passes no_exec_mask = false. Since the function we
846 pass to nftw() cannot have parameters, we have to create separate
847 options and make the decision here. */
848 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
849 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
851 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
853 if (nftw_result
== 0) {
858 /* nftw will return -1 on error, or if the supplied function
859 * (apply_default_acl_nftw) returns a non-zero result, nftw will
862 if (nftw_result
== -1) {
863 perror("apply_default_acl_recursive (nftw)");
872 * @brief Call apply_default_acl (possibly recursively) on each
873 * command-line argument.
875 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
876 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
879 int main(int argc
, char* argv
[]) {
886 bool recursive
= false;
887 bool no_exec_mask
= false;
889 struct option long_options
[] = {
890 /* These options set a flag. */
891 {"help", no_argument
, NULL
, 'h'},
892 {"recursive", no_argument
, NULL
, 'r'},
893 {"no-exec-mask", no_argument
, NULL
, 'x'},
899 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
916 int result
= EXIT_SUCCESS
;
919 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
920 const char* target
= argv
[arg_index
];
921 bool reapp_result
= false;
923 /* Make sure we can access the given path before we go out of our
924 * way to please it. Doing this check outside of
925 * apply_default_acl() lets us spit out a better error message for
928 if (!path_accessible(target
)) {
929 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
930 result
= EXIT_FAILURE
;
935 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
938 /* It's either a normal file, or we're not operating recursively. */
939 reapp_result
= apply_default_acl(target
, NULL
, no_exec_mask
);
943 result
= EXIT_FAILURE
;