2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* dirname() */
17 #include <limits.h> /* PATH_MAX */
26 #include <acl/libacl.h> /* acl_get_perm, not portable */
27 #include <sys/types.h>
30 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Get the mode bits from the given path.
42 * The path (file or directory) whose mode we want.
44 * @return A mode_t (st_mode) structure containing the mode bits.
45 * See sys/stat.h for details.
47 mode_t
get_mode(const char* path
) {
54 int result
= stat(path
, &s
);
60 /* errno will be set already by stat() */
68 * @brief Determine whether or not the given path is a regular file.
73 * @return true if @c path is a regular file, false otherwise.
75 bool is_regular_file(const char* path
) {
81 int result
= stat(path
, &s
);
83 return S_ISREG(s
.st_mode
);
93 * @brief Determine whether or not the given path is accessible.
98 * @return true if @c path is accessible to the current effective
99 * user/group, false otherwise.
101 bool path_accessible(const char* path
) {
106 /* Test for access using the effective user and group rather than
108 int flags
= AT_EACCESS
;
110 /* Don't follow symlinks when checking for a path's existence,
111 since we won't follow them to set its ACLs either. */
112 flags
|= AT_SYMLINK_NOFOLLOW
;
114 /* If the path is relative, interpret it relative to the current
115 working directory (just like the access() system call). */
116 int result
= faccessat(AT_FDCWD
, path
, F_OK
, flags
);
129 * @brief Determine whether or not the given path is a directory.
134 * @return true if @c path is a directory, false otherwise.
136 bool is_directory(const char* path
) {
142 int result
= stat(path
, &s
);
144 return S_ISDIR(s
.st_mode
);
154 * @brief Update (or create) an entry in an @b minimal ACL.
156 * This function will not work if @c aclp contains extended
157 * entries. This is fine for our purposes, since we call @c wipe_acls
158 * on each path before applying the default to it.
160 * The assumption that there are no extended entries makes things much
161 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
162 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
163 * be created anew. This means we don't have to fool around comparing
164 * named-user/group entries.
167 * A pointer to the acl_t structure whose entry we want to modify.
170 * The new entry. If @c entry contains a user/group/other entry, we
171 * update the existing one. Otherwise we create a new entry.
173 * @return If there is an unexpected library error, @c ACL_ERROR is
174 * returned. Otherwise, @c ACL_SUCCESS.
177 int acl_set_entry(acl_t
* aclp
,
181 int gt_result
= acl_get_tag_type(entry
, &entry_tag
);
182 if (gt_result
== ACL_ERROR
) {
183 perror("acl_set_entry (acl_get_tag_type)");
187 acl_permset_t entry_permset
;
188 int ps_result
= acl_get_permset(entry
, &entry_permset
);
189 if (ps_result
== ACL_ERROR
) {
190 perror("acl_set_entry (acl_get_permset)");
194 acl_entry_t existing_entry
;
195 /* Loop through the given ACL looking for matching entries. */
196 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
198 while (result
== ACL_SUCCESS
) {
199 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
200 int tag_result
= acl_get_tag_type(existing_entry
, &existing_tag
);
202 if (tag_result
== ACL_ERROR
) {
203 perror("set_acl_tag_permset (acl_get_tag_type)");
207 if (existing_tag
== entry_tag
) {
208 if (entry_tag
== ACL_USER_OBJ
||
209 entry_tag
== ACL_GROUP_OBJ
||
210 entry_tag
== ACL_OTHER
) {
211 /* Only update for these three since all other tags will have
212 been wiped. These three are guaranteed to exist, so if we
213 match one of them, we're allowed to return ACL_SUCCESS
214 below and bypass the rest of the function. */
215 acl_permset_t existing_permset
;
216 int gep_result
= acl_get_permset(existing_entry
, &existing_permset
);
217 if (gep_result
== ACL_ERROR
) {
218 perror("acl_set_entry (acl_get_permset)");
222 int s_result
= acl_set_permset(existing_entry
, entry_permset
);
223 if (s_result
== ACL_ERROR
) {
224 perror("acl_set_entry (acl_set_permset)");
233 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
236 /* This catches both the initial acl_get_entry and the ones at the
238 if (result
== ACL_ERROR
) {
239 perror("acl_set_entry (acl_get_entry)");
243 /* If we've made it this far, we need to add a new entry to the
245 acl_entry_t new_entry
;
247 /* We allocate memory here that we should release! */
248 int c_result
= acl_create_entry(aclp
, &new_entry
);
249 if (c_result
== ACL_ERROR
) {
250 perror("acl_set_entry (acl_create_entry)");
254 int st_result
= acl_set_tag_type(new_entry
, entry_tag
);
255 if (st_result
== ACL_ERROR
) {
256 perror("acl_set_entry (acl_set_tag_type)");
260 int s_result
= acl_set_permset(new_entry
, entry_permset
);
261 if (s_result
== ACL_ERROR
) {
262 perror("acl_set_entry (acl_set_permset)");
266 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
267 /* We need to set the qualifier too. */
268 void* entry_qual
= acl_get_qualifier(entry
);
269 if (entry_qual
== (void*)NULL
) {
270 perror("acl_set_entry (acl_get_qualifier)");
274 int sq_result
= acl_set_qualifier(new_entry
, entry_qual
);
275 if (sq_result
== ACL_ERROR
) {
276 perror("acl_set_entry (acl_set_qualifier)");
287 * @brief Determine the number of entries in the given ACL.
290 * A pointer to an @c acl_t structure.
292 * @return Either the non-negative number of entries in @c acl, or
293 * @c ACL_ERROR on error.
295 int acl_entry_count(acl_t
* acl
) {
299 int result
= acl_get_entry(*acl
, ACL_FIRST_ENTRY
, &entry
);
301 while (result
== ACL_SUCCESS
) {
303 result
= acl_get_entry(*acl
, ACL_NEXT_ENTRY
, &entry
);
306 if (result
== ACL_ERROR
) {
307 perror("acl_entry_count (acl_get_entry)");
317 * @brief Determine whether or not the given ACL is minimal.
319 * An ACL is minimal if it has fewer than four entries.
322 * A pointer to an acl_t structure.
325 * - @c ACL_SUCCESS - @c acl is minimal
326 * - @c ACL_FAILURE - @c acl is not minimal
327 * - @c ACL_ERROR - Unexpected library error
329 int acl_is_minimal(acl_t
* acl
) {
331 int ec
= acl_entry_count(acl
);
333 if (ec
== ACL_ERROR
) {
334 perror("acl_is_minimal (acl_entry_count)");
349 * @brief Determine whether the given path has an ACL whose mask
356 * - @c ACL_SUCCESS - @c path has a mask which denies execute.
357 * - @c ACL_FAILURE - The ACL for @c path does not deny execute,
358 * or @c path has no extended ACL at all.
359 * - @c ACL_ERROR - Unexpected library error.
361 int acl_execute_masked(const char* path
) {
363 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
365 if (acl
== (acl_t
)NULL
) {
366 perror("acl_execute_masked (acl_get_file)");
370 /* Our return value. */
371 int result
= ACL_FAILURE
;
374 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
376 while (ge_result
== ACL_SUCCESS
) {
377 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
378 int tag_result
= acl_get_tag_type(entry
, &tag
);
380 if (tag_result
== ACL_ERROR
) {
381 perror("acl_execute_masked (acl_get_tag_type)");
386 if (tag
== ACL_MASK
) {
387 /* This is the mask entry, get its permissions, and see if
388 execute is specified. */
389 acl_permset_t permset
;
391 int ps_result
= acl_get_permset(entry
, &permset
);
392 if (ps_result
== ACL_ERROR
) {
393 perror("acl_execute_masked (acl_get_permset)");
398 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
399 if (gp_result
== ACL_ERROR
) {
400 perror("acl_execute_masked (acl_get_perm)");
405 if (gp_result
== ACL_FAILURE
) {
406 /* No execute bit set in the mask; execute not allowed. */
411 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
422 * @brief Determine whether @c path is executable (by anyone) or a
425 * This is used as part of the heuristic to determine whether or not
426 * we should mask the execute bit when inheriting an ACL. If @c path
427 * is a directory, the answer is a clear-cut yes. This behavior is
428 * modeled after the capital 'X' perms of setfacl.
430 * If @c path is a file, we check the @a effective permissions,
431 * contrary to what setfacl does.
437 * - @c ACL_SUCCESS - @c path is a directory, or someone has effective
439 * - @c ACL_FAILURE - @c path is a regular file and nobody can execute
441 * - @c ACL_ERROR - Unexpected library error.
443 int any_can_execute_or_dir(const char* path
) {
445 if (is_directory(path
)) {
446 /* That was easy... */
450 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
452 if (acl
== (acl_t
)NULL
) {
453 perror("any_can_execute_or_dir (acl_get_file)");
457 /* Our return value. */
458 int result
= ACL_FAILURE
;
460 if (acl_is_minimal(&acl
)) {
461 mode_t mode
= get_mode(path
);
462 if (mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
463 result
= ACL_SUCCESS
;
467 result
= ACL_FAILURE
;
473 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
475 while (ge_result
== ACL_SUCCESS
) {
476 /* The first thing we do is check to see if this is a mask
477 entry. If it is, we skip it entirely. */
478 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
479 int tag_result
= acl_get_tag_type(entry
, &tag
);
481 if (tag_result
== ACL_ERROR
) {
482 perror("any_can_execute_or_dir (acl_get_tag_type)");
487 if (tag
== ACL_MASK
) {
488 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
492 /* Ok, so it's not a mask entry. Check the execute perms. */
493 acl_permset_t permset
;
495 int ps_result
= acl_get_permset(entry
, &permset
);
496 if (ps_result
== ACL_ERROR
) {
497 perror("any_can_execute_or_dir (acl_get_permset)");
502 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
503 if (gp_result
== ACL_ERROR
) {
504 perror("any_can_execute_or_dir (acl_get_perm)");
509 if (gp_result
== ACL_SUCCESS
) {
510 /* Only return ACL_SUCCESS if this execute bit is not masked. */
511 if (acl_execute_masked(path
) != ACL_SUCCESS
) {
512 result
= ACL_SUCCESS
;
517 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
520 if (ge_result
== ACL_ERROR
) {
521 perror("any_can_execute_or_dir (acl_get_entry)");
534 * @brief Inherit the default ACL from @c parent to @c path.
536 * The @c parent parameter does not necessarily need to be the parent
537 * of @c path, although that will usually be the case. This overwrites
538 * any existing default ACL on @c path.
541 * The parent directory whose ACL we want to inherit.
544 * The target directory whose ACL we wish to overwrite (or create).
547 * - @c ACL_SUCCESS - The default ACL was inherited successfully.
548 * - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
549 * - @c ACL_ERROR - Unexpected library error.
551 int inherit_default_acl(const char* path
, const char* parent
) {
553 /* Our return value. */
554 int result
= ACL_SUCCESS
;
561 if (!is_directory(path
) || !is_directory(parent
)) {
565 acl_t parent_acl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
566 if (parent_acl
== (acl_t
)NULL
) {
567 perror("inherit_default_acl (acl_get_file)");
571 acl_t path_acl
= acl_dup(parent_acl
);
573 if (path_acl
== (acl_t
)NULL
) {
574 perror("inherit_default_acl (acl_dup)");
575 acl_free(parent_acl
);
579 int sf_result
= acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
);
580 if (sf_result
== -1) {
581 perror("inherit_default_acl (acl_set_file)");
594 * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
595 * from the given path.
598 * The path whose ACLs we want to wipe.
601 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
602 * existed in the first place.
603 * - @c ACL_ERROR - Unexpected library error.
605 int wipe_acls(const char* path
) {
612 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
613 if (acl
== (acl_t
)NULL
) {
614 perror("wipe_acls (acl_get_file)");
618 /* Our return value. */
619 int result
= ACL_SUCCESS
;
622 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
624 while (ge_result
== ACL_SUCCESS
) {
625 int d_result
= acl_delete_entry(acl
, entry
);
626 if (d_result
== ACL_ERROR
) {
627 perror("wipe_acls (acl_delete_entry)");
632 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
635 /* Catches the first acl_get_entry as well as the ones at the end of
637 if (ge_result
== ACL_ERROR
) {
638 perror("wipe_acls (acl_get_entry)");
643 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
644 if (sf_result
== ACL_ERROR
) {
645 perror("wipe_acls (acl_set_file)");
658 * @brief Apply parent default ACL to a path.
660 * This overwrites any existing ACLs on @c path.
663 * The path whose ACL we would like to reset to its default.
665 * @param no_exec_mask
666 * The value (either true or false) of the --no-exec-mask flag.
669 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
670 * - @c ACL_FAILURE - The target path is not a regular file/directory,
671 * or the parent of @c path is not a directory.
672 * - @c ACL_ERROR - Unexpected library error.
674 int apply_default_acl(const char* path
, bool no_exec_mask
) {
681 if (!is_regular_file(path
) && !is_directory(path
)) {
685 /* dirname mangles its argument */
686 char path_copy
[PATH_MAX
];
687 strncpy(path_copy
, path
, PATH_MAX
-1);
688 path_copy
[PATH_MAX
-1] = 0;
690 char* parent
= dirname(path_copy
);
691 if (!is_directory(parent
)) {
692 /* Make sure dirname() did what we think it did. */
696 /* Default to not masking the exec bit; i.e. applying the default
697 ACL literally. If --no-exec-mask was not specified, then we try
698 to "guess" whether or not to mask the exec bit. */
699 bool allow_exec
= true;
702 int ace_result
= any_can_execute_or_dir(path
);
704 if (ace_result
== ACL_ERROR
) {
705 perror("apply_default_acl (any_can_execute_or_dir)");
709 allow_exec
= (bool)ace_result
;
712 acl_t defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
714 if (defacl
== (acl_t
)NULL
) {
715 perror("apply_default_acl (acl_get_file)");
719 /* Our return value. */
720 int result
= ACL_SUCCESS
;
722 int wipe_result
= wipe_acls(path
);
723 if (wipe_result
== ACL_ERROR
) {
724 perror("apply_default_acl (wipe_acls)");
729 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
730 ACL with this one. */
731 acl_t acl
= acl_get_file(path
, ACL_TYPE_ACCESS
);
732 if (acl
== (acl_t
)NULL
) {
733 perror("apply_default_acl (acl_get_file)");
737 /* If it's a directory, inherit the parent's default. */
738 int inherit_result
= inherit_default_acl(path
, parent
);
739 if (inherit_result
== ACL_ERROR
) {
740 perror("apply_default_acl (inherit_acls)");
746 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
748 while (ge_result
== ACL_SUCCESS
) {
749 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
750 int tag_result
= acl_get_tag_type(entry
, &tag
);
752 if (tag_result
== ACL_ERROR
) {
753 perror("apply_default_acl (acl_get_tag_type)");
759 /* We've got an entry/tag from the default ACL. Get its permset. */
760 acl_permset_t permset
;
761 int ps_result
= acl_get_permset(entry
, &permset
);
762 if (ps_result
== ACL_ERROR
) {
763 perror("apply_default_acl (acl_get_permset)");
768 /* If this is a default mask, fix it up. */
769 if (tag
== ACL_MASK
||
770 tag
== ACL_USER_OBJ
||
771 tag
== ACL_GROUP_OBJ
||
775 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
776 minimal ACLs) or acl_other entries, so if execute should be
777 masked, we have to do it manually. */
778 int d_result
= acl_delete_perm(permset
, ACL_EXECUTE
);
779 if (d_result
== ACL_ERROR
) {
780 perror("apply_default_acl (acl_delete_perm)");
785 int sp_result
= acl_set_permset(entry
, permset
);
786 if (sp_result
== ACL_ERROR
) {
787 perror("apply_default_acl (acl_set_permset)");
794 /* Finally, add the permset to the access ACL. */
795 int set_result
= acl_set_entry(&acl
, entry
);
796 if (set_result
== ACL_ERROR
) {
797 perror("apply_default_acl (acl_set_entry)");
802 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
805 /* Catches the first acl_get_entry as well as the ones at the end of
807 if (ge_result
== ACL_ERROR
) {
808 perror("apply_default_acl (acl_get_entry)");
813 int sf_result
= acl_set_file(path
, ACL_TYPE_ACCESS
, acl
);
814 if (sf_result
== ACL_ERROR
) {
815 perror("apply_default_acl (acl_set_file)");
828 * @brief Display program usage information.
830 * @param program_name
831 * The program name to use in the output.
834 void usage(const char* program_name
) {
835 printf("Apply any applicable default ACLs to the given files or "
837 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
840 printf(" -h, --help Print this help message\n");
841 printf(" -r, --recursive Act on any given directories recursively\n");
842 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
849 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
851 * For parameter information, see the @c nftw man page.
853 * @return If the ACL was applied to @c target successfully, we return
854 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
855 * the next file or directory. Otherwise, we return @c FTW_STOP to
859 int apply_default_acl_nftw(const char *target
,
860 const struct stat
*s
,
864 bool app_result
= apply_default_acl(target
, false);
876 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
878 * This is identical to @c apply_default_acl_nftw(), except it passes
879 * @c true to @c apply_default_acl() as its no_exec_mask argument.
882 int apply_default_acl_nftw_x(const char *target
,
883 const struct stat
*s
,
887 bool app_result
= apply_default_acl(target
, true);
899 * @brief Recursive version of @c apply_default_acl().
901 * If @c target is a directory, we use @c nftw() to call @c
902 * apply_default_acl() recursively on all of its children. Otherwise,
903 * we just delegate to @c apply_default_acl().
905 * We ignore symlinks for consistency with chmod -r.
908 * The root (path) of the recursive application.
910 * @param no_exec_mask
911 * The value (either true or false) of the --no-exec-mask flag.
914 * If @c target is not a directory, we return the result of
915 * calling @c apply_default_acl() on @c target. Otherwise, we convert
916 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
917 * then we return @c true. Otherwise, we return @c false.
919 * If there is an error, it will be reported via @c perror, but
920 * we still return @c false.
922 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
924 if (!is_directory(target
)) {
925 return apply_default_acl(target
, no_exec_mask
);
928 int max_levels
= 256;
929 int flags
= FTW_PHYS
; /* Don't follow links. */
931 /* There are two separate functions that could be passed to
932 nftw(). One passes no_exec_mask = true to apply_default_acl(),
933 and the other passes no_exec_mask = false. Since the function we
934 pass to nftw() cannot have parameters, we have to create separate
935 options and make the decision here. */
936 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
937 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
939 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
941 if (nftw_result
== 0) {
946 /* nftw will return -1 on error, or if the supplied function
947 * (apply_default_acl_nftw) returns a non-zero result, nftw will
950 if (nftw_result
== -1) {
951 perror("apply_default_acl_recursive (nftw)");
960 * @brief Call apply_default_acl (possibly recursively) on each
961 * command-line argument.
963 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
964 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
967 int main(int argc
, char* argv
[]) {
974 bool recursive
= false;
975 bool no_exec_mask
= false;
977 struct option long_options
[] = {
978 /* These options set a flag. */
979 {"help", no_argument
, NULL
, 'h'},
980 {"recursive", no_argument
, NULL
, 'r'},
981 {"no-exec-mask", no_argument
, NULL
, 'x'},
987 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
1000 return EXIT_FAILURE
;
1004 int result
= EXIT_SUCCESS
;
1007 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
1008 const char* target
= argv
[arg_index
];
1009 bool reapp_result
= false;
1011 /* Make sure we can access the given path before we go out of our
1012 * way to please it. Doing this check outside of
1013 * apply_default_acl() lets us spit out a better error message for
1016 if (!path_accessible(target
)) {
1017 fprintf(stderr
, "%s: %s: no such file or directory\n", argv
[0], target
);
1018 result
= EXIT_FAILURE
;
1023 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
1026 /* It's either a normal file, or we're not operating recursively. */
1027 reapp_result
= apply_default_acl(target
, no_exec_mask
);
1030 if (!reapp_result
) {
1031 result
= EXIT_FAILURE
;