src/libadacl.c

   1 /**
   2  * @file libadacl.c
   3  *
   4  * @brief The adacl (apply default acl) shared library.
   5  *
   6  */
   7
   8 /* Enables get_current_dir_name() in unistd.h and the O_PATH flag. */
   9 #define _GNU_SOURCE
  10
  11 #include <errno.h>      /* EINVAL, ELOOP, ENOTDIR, etc. */
  12 #include <fcntl.h>      /* openat() */
  13 #include <libgen.h>     /* basename(), dirname() */
  14 #include <limits.h>     /* PATH_MAX */
  15 #include <stdbool.h>    /* the "bool" type */
  16 #include <stdio.h>      /* perror(), snprintf() */
  17 #include <stdlib.h>     /* free() */
  18 #include <string.h>     /* strdup() */
  19 #include <sys/stat.h>   /* fstat() */
  20 #include <sys/xattr.h>  /* fgetxattr(), fsetxattr() */
  21 #include <unistd.h>     /* get_current_dir_name() */
  22
  23 /* ACLs */
  24 #include <acl/libacl.h> /* acl_get_perm, not portable */
  25 #include <sys/acl.h>    /* all other acl_foo functions */
  26
  27 /* XATTR_NAME_POSIX_ACL_ACCESS and XATTR_NAME_POSIX_ACL_DEFAULT */
  28 #include <linux/xattr.h>
  29
  30 #include "libadacl.h"
  31
  32
  33 /* Even though most other library functions reliably return -1 for
  34  * error, it feels a little wrong to re-use the ACL_ERROR constant.
  35  */
  36 #define CLOSE_ERROR -1
  37 #define OPEN_ERROR -1
  38 #define SNPRINTF_ERROR -1
  39 #define STAT_ERROR -1
  40 #define XATTR_ERROR -1
  41
  42
  43 /**
  44  * @brief The recursive portion of the @c safe_open function, used to
  45  *   open a file descriptor in a symlink-safe way when combined with
  46  *   the @c O_NOFOLLOW flag.
  47  *
  48  * @param at_fd
  49  *   A file descriptor relative to which @c pathname will be opened.
  50  *
  51  * @param pathname
  52  *   The path to the file/directory/whatever whose descriptor you want.
  53  *
  54  * @param flags
  55  *   File status flags to be passed to @c openat.
  56  *
  57  * @return a file descriptor for @c pathname if everything goes well,
  58  *   and @c OPEN_ERROR if not.
  59  */
  60 int safe_open_ex(int at_fd, char* pathname, int flags) {
  61   if (pathname == NULL) {
  62     errno = EINVAL;
  63     perror("safe_open_ex (args)");
  64     return OPEN_ERROR;
  65   }
  66
  67   char* firstslash = strchr(pathname, '/');
  68   if (firstslash == NULL) {
  69     /* No more slashes, this is the base case. */
  70     return openat(at_fd, pathname, flags);
  71   }
  72   if (firstslash[1] == '\0') {
  73     /* The first slash is the last character; ensure that we open
  74        a directory. */
  75     firstslash[0] = '\0';
  76     return openat(at_fd, pathname, flags | O_DIRECTORY);
  77   }
  78
  79   /* The first slash exists and isn't the last character in the path,
  80      so we can split the path wherever that first slash lies and
  81      recurse. */
  82    *firstslash = '\0';
  83    int fd = openat(at_fd, pathname, flags | O_DIRECTORY | O_PATH);
  84    if (fd == OPEN_ERROR) {
  85      if (errno != ENOTDIR) {
  86        /* Don't output anything if we ignore a symlink */
  87        perror("safe_open_ex (safe_open_ex)");
  88      }
  89      return OPEN_ERROR;
  90    }
  91
  92    /* The +1 is safe because there needs to be at least one character
  93       after the first slash (we checked this above). */
  94    int result = safe_open_ex(fd, firstslash+1, flags);
  95    if (close(fd) == CLOSE_ERROR) {
  96       perror("safe_open_ex (close)");
  97       return OPEN_ERROR;
  98     }
  99    return result;
 100 }
 101
 102
 103 /**
 104  * @brief A version of @c open that is completely symlink-safe when
 105  *   used with the @c O_NOFOLLOW flag.
 106  *
 107  * The @c openat function exists to ensure that you can anchor one
 108  * path to a particular directory while opening it; however, if you
 109  * open "b/c/d" relative to "/a", then even the @c openat function will
 110  * still follow symlinks in the "b" component. This can be exploited
 111  * by an attacker to make you open the wrong path.
 112  *
 113  * To avoid that problem, this function uses a recursive
 114  * implementation that opens every path from the root, one level at a
 115  * time. So "a" is opened relative to "/", and then "b" is opened
 116  * relative to "/a", and then "c" is opened relative to "/a/b",
 117  * etc. When the @c O_NOFOLLOW flag is used, this approach ensures
 118  * that no symlinks in any component are followed.
 119  *
 120  * @param pathname
 121  *   The path to the file/directory/whatever whose descriptor you want.
 122  *
 123  * @param flags
 124  *   File status flags to be passed to @c openat.
 125  *
 126  * @return a file descriptor for @c pathname if everything goes well,
 127  *   and @c OPEN_ERROR if not.
 128  */
 129 int safe_open(const char* pathname, int flags) {
 130   if (pathname == NULL) {
 131     errno = EINVAL;
 132     perror("safe_open (args)");
 133     return OPEN_ERROR;
 134   }
 135
 136   char abspath[PATH_MAX];
 137   int snprintf_result = 0;
 138   if (strchr(pathname, '/') == pathname) {
 139     /* pathname is already absolute; just copy it. */
 140     snprintf_result = snprintf(abspath, PATH_MAX, "%s", pathname);
 141   }
 142   else {
 143     /* Concatenate the current working directory and pathname into an
 144      * absolute path. We use realpath() ONLY on the cwd part, and not
 145      * on the pathname part, because realpath() resolves symlinks. And
 146      * the whole point of all this crap is to avoid following symlinks
 147      * in the pathname.
 148      *
 149      * Using realpath() on the cwd lets us operate on relative paths
 150      * while we're sitting in a directory that happens to have a
 151      * symlink in it; for example: cd /var/run && apply-default-acl foo.
 152      */
 153     char* cwd = get_current_dir_name();
 154     if (cwd == NULL) {
 155       perror("safe_open (get_current_dir_name)");
 156       return OPEN_ERROR;
 157     }
 158
 159     char abs_cwd[PATH_MAX];
 160     if (realpath(cwd, abs_cwd) == NULL) {
 161       perror("safe_open (realpath)");
 162       free(cwd);
 163       return OPEN_ERROR;
 164     }
 165     snprintf_result = snprintf(abspath, PATH_MAX, "%s/%s", abs_cwd, pathname);
 166     free(cwd);
 167   }
 168   if (snprintf_result == SNPRINTF_ERROR || snprintf_result > PATH_MAX) {
 169     perror("safe_open (snprintf)");
 170     return OPEN_ERROR;
 171   }
 172
 173   int fd = 0;
 174   if (strcmp(abspath, "/") == 0) {
 175     fd = open("/", flags | O_DIRECTORY);
 176   }
 177   else {
 178     /* Use O_PATH for some added safety if "/" is not our target */
 179     fd = open("/", flags | O_DIRECTORY | O_PATH);
 180   }
 181   if (fd == OPEN_ERROR) {
 182     perror("safe_open (open)");
 183     return OPEN_ERROR;
 184   }
 185
 186   if (strcmp(abspath, "/") == 0) {
 187     return fd;
 188   }
 189
 190   int result = safe_open_ex(fd, abspath+1, flags);
 191   if (close(fd) == CLOSE_ERROR) {
 192     perror("safe_open (close)");
 193     return OPEN_ERROR;
 194   }
 195   return result;
 196 }
 197
 198
 199
 200
 201 /**
 202  * @brief Update an entry in an @b minimal ACL.
 203  *
 204  * @param aclp
 205  *   A pointer to the acl_t structure whose entry we want to update.
 206  *
 207  * @param entry
 208  *   The new entry.
 209  *
 210  * @return
 211  *   - @c ACL_SUCCESS - If we update an existing entry.
 212  *   - @c ACL_FAILURE - If we don't find an entry to update.
 213  *   - @c ACL_ERROR - Unexpected library error.
 214  */
 215 int acl_update_entry(acl_t aclp, acl_entry_t entry) {
 216   if (aclp == NULL || entry == NULL) {
 217     errno = EINVAL;
 218     perror("acl_update_entry (args)");
 219     return ACL_ERROR;
 220   }
 221
 222   acl_tag_t entry_tag;
 223   if (acl_get_tag_type(entry, &entry_tag) == ACL_ERROR) {
 224     perror("acl_update_entry (acl_get_tag_type)");
 225     return ACL_ERROR;
 226   }
 227
 228   acl_permset_t entry_permset;
 229   if (acl_get_permset(entry, &entry_permset) == ACL_ERROR) {
 230     perror("acl_update_entry (acl_get_permset)");
 231     return ACL_ERROR;
 232   }
 233
 234   acl_entry_t existing_entry;
 235   /* Loop through the given ACL looking for matching entries. */
 236   int result = acl_get_entry(aclp, ACL_FIRST_ENTRY, &existing_entry);
 237
 238   while (result == ACL_SUCCESS) {
 239     acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
 240
 241     if (acl_get_tag_type(existing_entry, &existing_tag) == ACL_ERROR) {
 242        perror("set_acl_tag_permset (acl_get_tag_type)");
 243        return ACL_ERROR;
 244     }
 245
 246     if (existing_tag == entry_tag) {
 247       /* If we update something, we're done and return ACL_SUCCESS */
 248       if (acl_set_permset(existing_entry, entry_permset) == ACL_ERROR) {
 249         perror("acl_update_entry (acl_set_permset)");
 250         return ACL_ERROR;
 251       }
 252
 253       return ACL_SUCCESS;
 254     }
 255
 256     result = acl_get_entry(aclp, ACL_NEXT_ENTRY, &existing_entry);
 257   }
 258
 259   /* This catches both the initial acl_get_entry and the ones at the
 260      end of the loop. */
 261   if (result == ACL_ERROR) {
 262     perror("acl_update_entry (acl_get_entry)");
 263     return ACL_ERROR;
 264   }
 265
 266   return ACL_FAILURE;
 267 }
 268
 269
 270
 271 /**
 272  * @brief Determine the number of entries in the given ACL.
 273  *
 274  * @param acl
 275  *   The ACL to inspect.
 276  *
 277  * @return Either the non-negative number of entries in @c acl, or
 278  *   @c ACL_ERROR on error.
 279  */
 280 int acl_entry_count(acl_t acl) {
 281
 282   acl_entry_t entry;
 283   int entry_count = 0;
 284   int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 285
 286   while (result == ACL_SUCCESS) {
 287     entry_count++;
 288     result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 289   }
 290
 291   if (result == ACL_ERROR) {
 292     perror("acl_entry_count (acl_get_entry)");
 293     return ACL_ERROR;
 294   }
 295
 296   return entry_count;
 297 }
 298
 299
 300
 301 /**
 302  * @brief Determine whether or not the given ACL is minimal.
 303  *
 304  * An ACL is minimal if it has fewer than four entries.
 305  *
 306  * @param acl
 307  *   The ACL whose minimality is in question.
 308  *
 309  * @return
 310  *   - @c ACL_SUCCESS - @c acl is minimal
 311  *   - @c ACL_FAILURE - @c acl is not minimal
 312  *   - @c ACL_ERROR - Unexpected library error
 313  */
 314 int acl_is_minimal(acl_t acl) {
 315   if (acl == NULL) {
 316     errno = EINVAL;
 317     perror("acl_is_minimal (args)");
 318     return ACL_ERROR;
 319   }
 320
 321   int ec = acl_entry_count(acl);
 322
 323   if (ec == ACL_ERROR) {
 324     perror("acl_is_minimal (acl_entry_count)");
 325     return ACL_ERROR;
 326   }
 327
 328   if (ec < 4) {
 329     return ACL_SUCCESS;
 330   }
 331   else {
 332     return ACL_FAILURE;
 333   }
 334 }
 335
 336
 337
 338 /**
 339  * @brief Determine whether the given ACL's mask denies execute.
 340  *
 341  * @param acl
 342  *   The ACL whose mask we want to check.
 343  *
 344  * @return
 345  *   - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
 346  *   - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
 347  *   - @c ACL_ERROR - Unexpected library error.
 348  */
 349 int acl_execute_masked(acl_t acl) {
 350   if (acl == NULL) {
 351     errno = EINVAL;
 352     perror("acl_execute_masked (args)");
 353     return ACL_ERROR;
 354   }
 355
 356   acl_entry_t entry;
 357   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 358
 359   while (ge_result == ACL_SUCCESS) {
 360     acl_tag_t tag = ACL_UNDEFINED_TAG;
 361
 362     if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
 363        perror("acl_execute_masked (acl_get_tag_type)");
 364        return ACL_ERROR;
 365     }
 366
 367     if (tag == ACL_MASK) {
 368       /* This is the mask entry, get its permissions, and see if
 369          execute is specified. */
 370       acl_permset_t permset;
 371
 372       if (acl_get_permset(entry, &permset) == ACL_ERROR) {
 373         perror("acl_execute_masked (acl_get_permset)");
 374         return ACL_ERROR;
 375       }
 376
 377       int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 378       if (gp_result == ACL_ERROR) {
 379         perror("acl_execute_masked (acl_get_perm)");
 380         return ACL_ERROR;
 381       }
 382
 383       if (gp_result == ACL_FAILURE) {
 384         /* No execute bit set in the mask; execute not allowed. */
 385         return ACL_SUCCESS;
 386       }
 387     }
 388
 389     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 390   }
 391
 392   return ACL_FAILURE;
 393 }
 394
 395
 396
 397 /**
 398  * @brief Determine whether @c fd is executable by anyone.
 399  *
 400  *
 401  * This is used as part of the heuristic to determine whether or not
 402  * we should mask the execute bit when inheriting an ACL. If @c fd
 403  * describes a file, we check the @a effective permissions, contrary
 404  * to what setfacl does.
 405  *
 406  * @param fd
 407  *   The file descriptor to check.
 408  *
 409  * @param sp
 410  *   A pointer to a stat structure for @c fd.
 411  *
 412  * @return
 413  *   - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
 414  *   - @c ACL_FAILURE - Nobody can execute @c fd.
 415  *   - @c ACL_ERROR - Unexpected library error.
 416  */
 417 int any_can_execute(int fd, const struct stat* sp) {
 418   if (sp == NULL) {
 419     errno = EINVAL;
 420     perror("any_can_execute (args)");
 421     return ACL_ERROR;
 422   }
 423
 424   acl_t acl = acl_get_fd(fd);
 425
 426   if (acl == (acl_t)NULL) {
 427     perror("any_can_execute (acl_get_fd)");
 428     return ACL_ERROR;
 429   }
 430
 431   /* Our return value. */
 432   int result = ACL_FAILURE;
 433
 434   if (acl_is_minimal(acl)) {
 435     if (sp->st_mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
 436       result = ACL_SUCCESS;
 437       goto cleanup;
 438     }
 439     else {
 440       result = ACL_FAILURE;
 441       goto cleanup;
 442     }
 443   }
 444
 445   acl_entry_t entry;
 446   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 447
 448   while (ge_result == ACL_SUCCESS) {
 449     /* The first thing we do is check to see if this is a mask
 450        entry. If it is, we skip it entirely. */
 451     acl_tag_t tag = ACL_UNDEFINED_TAG;
 452
 453     if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
 454       perror("any_can_execute_or (acl_get_tag_type)");
 455       result = ACL_ERROR;
 456       goto cleanup;
 457     }
 458
 459     if (tag == ACL_MASK) {
 460       ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 461       continue;
 462     }
 463
 464     /* Ok, so it's not a mask entry. Check the execute perms. */
 465     acl_permset_t permset;
 466
 467     if (acl_get_permset(entry, &permset) == ACL_ERROR) {
 468       perror("any_can_execute_or (acl_get_permset)");
 469       result = ACL_ERROR;
 470       goto cleanup;
 471     }
 472
 473     int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 474     if (gp_result == ACL_ERROR) {
 475       perror("any_can_execute (acl_get_perm)");
 476       result = ACL_ERROR;
 477       goto cleanup;
 478     }
 479
 480     if (gp_result == ACL_SUCCESS) {
 481       /* Only return ACL_SUCCESS if this execute bit is not masked. */
 482       if (acl_execute_masked(acl) != ACL_SUCCESS) {
 483         result = ACL_SUCCESS;
 484         goto cleanup;
 485       }
 486     }
 487
 488     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 489   }
 490
 491   if (ge_result == ACL_ERROR) {
 492     perror("any_can_execute (acl_get_entry)");
 493     result = ACL_ERROR;
 494     goto cleanup;
 495   }
 496
 497  cleanup:
 498   acl_free(acl);
 499   return result;
 500 }
 501
 502
 503
 504 /**
 505  * @brief Copy ACLs between file descriptors as xattrs, verbatim.
 506  *
 507  * There is a small deficiency in libacl, namely that there is no way
 508  * to get or set default ACLs through file descriptors. The @c
 509  * acl_get_file and @c acl_set_file functions can do it, but they use
 510  * paths, and are vulnerable to symlink attacks.
 511  *
 512  * Fortunately, when inheriting an ACL, we don't really need to look
 513  * at what it contains. That means that we can copy the on-disk xattrs
 514  * from the source directory to the destination file/directory without
 515  * passing through libacl, and this can be done with file descriptors
 516  * through @c fgetxattr and @c fsetxattr. That's what this function
 517  * does.
 518  *
 519  * @param src_fd
 520  *   The file descriptor from which the ACL will be copied.
 521  *
 522  * @param src_type
 523  *   The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
 524  *   to copy from @c src_fd.
 525  *
 526  * @param dst_fd
 527  *   The file descriptor whose ACL will be overwritten with the one
 528  *   from @c src_fd.
 529  *
 530  * @param dst_type
 531  *   The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
 532  *   to replace on @c dst_fd.
 533  *
 534  * @return
 535  *   - @c ACL_SUCCESS - The ACL was copied successfully.
 536  *   - @c ACL_FAILURE - There was no ACL on @c src_fd.
 537  *   - @c ACL_ERROR - Unexpected library error.
 538  */
 539 int acl_copy_xattr(int src_fd,
 540                    acl_type_t src_type,
 541                    int dst_fd,
 542                    acl_type_t dst_type) {
 543
 544   const char* src_name;
 545   if (src_type == ACL_TYPE_ACCESS) {
 546     src_name = XATTR_NAME_POSIX_ACL_ACCESS;
 547   }
 548   else if (src_type == ACL_TYPE_DEFAULT) {
 549     src_name = XATTR_NAME_POSIX_ACL_DEFAULT;
 550   }
 551   else {
 552     errno = EINVAL;
 553     perror("acl_copy_xattr (src type)");
 554     return ACL_ERROR;
 555   }
 556
 557   const char* dst_name;
 558   if (dst_type == ACL_TYPE_ACCESS) {
 559     dst_name = XATTR_NAME_POSIX_ACL_ACCESS;
 560   }
 561   else if (dst_type == ACL_TYPE_DEFAULT) {
 562     dst_name = XATTR_NAME_POSIX_ACL_DEFAULT;
 563   }
 564   else {
 565     errno = EINVAL;
 566     perror("acl_copy_xattr (dst type)");
 567     return ACL_ERROR;
 568   }
 569
 570   ssize_t src_size_guess = fgetxattr(src_fd, src_name, NULL, 0);
 571   if (src_size_guess == XATTR_ERROR) {
 572     if (errno == ENODATA) {
 573       /* A missing ACL isn't really an error. ENOATTR and ENODATA are
 574          synonyms, but using ENODATA here lets us avoid another
 575          "include" directive. */
 576       return ACL_FAILURE;
 577     }
 578     perror("acl_copy_xattr (fgetxattr size guess)");
 579     return ACL_ERROR;
 580   }
 581   char* src_acl_p = alloca(src_size_guess);
 582   /* The actual size may be smaller than our guess? I don't know. */
 583   ssize_t src_size = fgetxattr(src_fd, src_name, src_acl_p, src_size_guess);
 584   if (src_size == XATTR_ERROR) {
 585     if (errno == ENODATA) {
 586       /* A missing ACL isn't an error. */
 587       return ACL_FAILURE;
 588     }
 589     perror("acl_copy_xattr (fgetxattr)");
 590     return ACL_ERROR;
 591   }
 592
 593   if (fsetxattr(dst_fd, dst_name, src_acl_p, src_size, 0) == XATTR_ERROR) {
 594     perror("acl_copy_xattr (fsetxattr)");
 595     return ACL_ERROR;
 596   }
 597
 598   return ACL_SUCCESS;
 599 }
 600
 601
 602 /**
 603  * @brief Determine if a file descriptor has a default ACL.
 604  *
 605  * @param fd
 606  *   The file descriptor whose default ACL is in question.
 607  *
 608  * @return
 609  *   - @c ACL_SUCCESS - If @c fd has a default ACL.
 610  *   - @c ACL_FAILURE - If @c fd does not have a default ACL.
 611  *   - @c ACL_ERROR - Unexpected library error.
 612  */
 613 int has_default_acl_fd(int fd) {
 614   if (fgetxattr(fd, XATTR_NAME_POSIX_ACL_DEFAULT, NULL, 0) == XATTR_ERROR) {
 615     if (errno == ENODATA) {
 616       return ACL_FAILURE;
 617     }
 618     perror("has_default_acl_fd (fgetxattr)");
 619     return ACL_ERROR;
 620   }
 621
 622   return ACL_SUCCESS;
 623 }
 624
 625
 626 /**
 627  * @brief Apply parent default ACL to a path.
 628  *
 629  * This overwrites any existing ACLs on @c path.
 630  *
 631  * @param path
 632  *   The path whose ACL we would like to reset to its default.
 633  *
 634  * @param sp
 635  *   A pointer to a stat structure for @c path, or @c NULL if you don't
 636  *   have one handy.
 637  *
 638  * @param no_exec_mask
 639  *   The value (either true or false) of the --no-exec-mask flag.
 640  *
 641  * @return
 642  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 643  *   - @c ACL_FAILURE - If symlinks or hard links are encountered.
 644  *   - @c ACL_ERROR - Unexpected library error.
 645  */
 646 int apply_default_acl_ex(const char* path,
 647                          const struct stat* sp,
 648                          bool no_exec_mask) {
 649
 650   if (path == NULL) {
 651     errno = EINVAL;
 652     perror("apply_default_acl_ex (args)");
 653     return ACL_ERROR;
 654   }
 655
 656   /* Define these next three variables here because we may have to
 657    * jump to the cleanup routine which expects them to exist.
 658    */
 659
 660   /* Our return value. */
 661   int result = ACL_SUCCESS;
 662
 663   /* The new ACL for this path */
 664   acl_t new_acl = (acl_t)NULL;
 665
 666   /* A copy of new_acl, to be made before we begin mangling new_acl in
 667      order to mask the execute bit. */
 668   acl_t new_acl_unmasked = (acl_t)NULL;
 669
 670   /* The file descriptor corresponding to "path" */
 671   int fd = 0;
 672
 673   /* The file descriptor for the directory containing "path" */
 674   int parent_fd = 0;
 675
 676   /* Get the parent directory of "path" with dirname(), which happens
 677    * to murder its argument and necessitates a path_copy. */
 678   char* path_copy = strdup(path);
 679   if (path_copy == NULL) {
 680     perror("apply_default_acl_ex (strdup)");
 681     return ACL_ERROR;
 682   }
 683   char* parent = dirname(path_copy);
 684   parent_fd = safe_open(parent, O_DIRECTORY | O_NOFOLLOW);
 685   if (parent_fd == OPEN_ERROR) {
 686     if (errno == ELOOP || errno == ENOTDIR) {
 687       /* We hit a symlink, either in the last path component (ELOOP)
 688          or higher up (ENOTDIR). */
 689       result = ACL_FAILURE;
 690       goto cleanup;
 691     }
 692     else {
 693       perror("apply_default_acl_ex (open parent fd)");
 694       result = ACL_ERROR;
 695       goto cleanup;
 696     }
 697   }
 698
 699   /* Check to make sure the parent descriptor actually has a default
 700      ACL. If it doesn't, then we can "succeed" immediately. */
 701   if (has_default_acl_fd(parent_fd) == ACL_FAILURE) {
 702     result = ACL_SUCCESS;
 703     goto cleanup;
 704   }
 705
 706   fd = safe_open(path, O_NOFOLLOW);
 707   if (fd == OPEN_ERROR) {
 708     if (errno == ELOOP || errno == ENOTDIR) {
 709       /* We hit a symlink, either in the last path component (ELOOP)
 710          or higher up (ENOTDIR). */
 711       result = ACL_FAILURE;
 712       goto cleanup;
 713     }
 714     else {
 715       perror("apply_default_acl_ex (open fd)");
 716       result = ACL_ERROR;
 717       goto cleanup;
 718     }
 719   }
 720
 721   /* Refuse to operate on hard links, which can be abused by an
 722    * attacker to trick us into changing the ACL on a file we didn't
 723    * intend to; namely the "target" of the hard link. There is TOCTOU
 724    * race condition here, but the window is as small as possible
 725    * between when we open the file descriptor (look above) and when we
 726    * fstat it.
 727    *
 728    * Note: we only need to call fstat ourselves if we weren't passed a
 729    * valid pointer to a stat structure (nftw does that).
 730   */
 731   if (sp == NULL) {
 732     struct stat s;
 733     if (fstat(fd, &s) == STAT_ERROR) {
 734       perror("apply_default_acl_ex (fstat)");
 735       goto cleanup;
 736     }
 737
 738     sp = &s;
 739   }
 740
 741   if (!S_ISDIR(sp->st_mode)) {
 742     /* If it's not a directory, make sure it's a regular,
 743        non-hard-linked file. */
 744     if (!S_ISREG(sp->st_mode) || sp->st_nlink != 1) {
 745       result = ACL_FAILURE;
 746       goto cleanup;
 747     }
 748   }
 749
 750
 751   /* Default to not masking the exec bit; i.e. applying the default
 752      ACL literally. If --no-exec-mask was not specified, then we try
 753      to "guess" whether or not to mask the exec bit. This behavior
 754      is modeled after the capital 'X' perms of setfacl. */
 755   bool allow_exec = true;
 756
 757   if (!no_exec_mask) {
 758     /* Never mask the execute bit on directories. */
 759     int ace_result = any_can_execute(fd,sp) || S_ISDIR(sp->st_mode);
 760
 761     if (ace_result == ACL_ERROR) {
 762       perror("apply_default_acl_ex (any_can_execute)");
 763       result = ACL_ERROR;
 764       goto cleanup;
 765     }
 766
 767     allow_exec = (bool)ace_result;
 768   }
 769
 770   /* If it's a directory, inherit the parent's default.  */
 771   if (S_ISDIR(sp->st_mode)) {
 772     if (acl_copy_xattr(parent_fd,
 773                        ACL_TYPE_DEFAULT,
 774                        fd,
 775                        ACL_TYPE_DEFAULT) == ACL_ERROR) {
 776       perror("apply_default_acl_ex (acl_copy_xattr default)");
 777       result = ACL_ERROR;
 778       goto cleanup;
 779     }
 780   }
 781
 782   /* If it's anything, _apply_ the parent's default. */
 783   if (acl_copy_xattr(parent_fd,
 784                      ACL_TYPE_DEFAULT,
 785                      fd,
 786                      ACL_TYPE_ACCESS) == ACL_ERROR) {
 787     perror("apply_default_acl_ex (acl_copy_xattr access)");
 788     result = ACL_ERROR;
 789     goto cleanup;
 790   }
 791
 792   /* There's a good reason why we saved the ACL above, even though
 793    * we're about tto read it back into memory and mess with it on the
 794    * next line. The acl_copy_xattr() function is already a hack to let
 795    * us copy default ACLs without resorting to path names; we simply
 796    * have no way to read the parent's default ACL into memory using
 797    * parent_fd. We can, however, copy the parent's ACL to a file (with
 798    * acl_copy_xattr), and then read the ACL from a file using
 799    * "fd". It's quite the circus, but it works and should be safe from
 800    * sym/hardlink attacks.
 801   */
 802
 803   /* Now we potentially need to mask the execute permissions in the
 804      ACL on fd; or maybe now. */
 805   if (allow_exec) {
 806     goto cleanup;
 807   }
 808
 809   /* OK, we need to mask some execute permissions. First obtain the
 810      current ACL... */
 811   new_acl = acl_get_fd(fd);
 812   if (new_acl == (acl_t)NULL) {
 813     perror("apply_default_acl_ex (acl_get_fd)");
 814     result = ACL_ERROR;
 815     goto cleanup;
 816   }
 817
 818   /* ...and now make a copy of it, because otherwise when we loop
 819      below, some shit gets stuck (modifying the structure while
 820      looping over it no worky). */
 821   new_acl_unmasked = acl_dup(new_acl);
 822   if (new_acl_unmasked == (acl_t)NULL) {
 823     perror("apply_default_acl_ex (acl_dup)");
 824     result = ACL_ERROR;
 825     goto cleanup;
 826   }
 827
 828   acl_entry_t entry;
 829   int ge_result = acl_get_entry(new_acl_unmasked, ACL_FIRST_ENTRY, &entry);
 830
 831   while (ge_result == ACL_SUCCESS) {
 832     acl_tag_t tag = ACL_UNDEFINED_TAG;
 833
 834     if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
 835        perror("apply_default_acl_ex (acl_get_tag_type)");
 836        result = ACL_ERROR;
 837        goto cleanup;
 838     }
 839
 840
 841     /* We've got an entry/tag from the default ACL. Get its permset. */
 842     acl_permset_t permset;
 843     if (acl_get_permset(entry, &permset) == ACL_ERROR) {
 844       perror("apply_default_acl_ex (acl_get_permset)");
 845       result = ACL_ERROR;
 846       goto cleanup;
 847     }
 848
 849     if (tag == ACL_MASK ||
 850         tag == ACL_USER_OBJ ||
 851         tag == ACL_GROUP_OBJ ||
 852         tag == ACL_OTHER) {
 853
 854       /* The mask doesn't affect acl_user_obj, acl_group_obj (in
 855          minimal ACLs) or acl_other entries, so if execute should be
 856          masked, we have to do it manually. */
 857       if (acl_delete_perm(permset, ACL_EXECUTE) == ACL_ERROR) {
 858         perror("apply_default_acl_ex (acl_delete_perm)");
 859         result = ACL_ERROR;
 860         goto cleanup;
 861       }
 862
 863       if (acl_set_permset(entry, permset) == ACL_ERROR) {
 864         perror("apply_default_acl_ex (acl_set_permset)");
 865         result = ACL_ERROR;
 866         goto cleanup;
 867       }
 868     }
 869
 870     if (acl_update_entry(new_acl, entry) == ACL_ERROR) {
 871       perror("apply_default_acl_ex (acl_update_entry)");
 872       result = ACL_ERROR;
 873       goto cleanup;
 874     }
 875
 876     ge_result = acl_get_entry(new_acl_unmasked, ACL_NEXT_ENTRY, &entry);
 877   }
 878
 879   /* Catches the first acl_get_entry as well as the ones at the end of
 880      the loop. */
 881   if (ge_result == ACL_ERROR) {
 882     perror("apply_default_acl_ex (acl_get_entry)");
 883     result = ACL_ERROR;
 884     goto cleanup;
 885   }
 886
 887   if (acl_set_fd(fd, new_acl) == ACL_ERROR) {
 888     perror("apply_default_acl_ex (acl_set_fd)");
 889     result = ACL_ERROR;
 890     goto cleanup;
 891   }
 892
 893  cleanup:
 894   free(path_copy);
 895   if (new_acl != (acl_t)NULL) {
 896     acl_free(new_acl);
 897   }
 898   if (new_acl_unmasked != (acl_t)NULL) {
 899     acl_free(new_acl_unmasked);
 900   }
 901   if (fd > 0 && close(fd) == CLOSE_ERROR) {
 902     perror("apply_default_acl_ex (close fd)");
 903     result = ACL_ERROR;
 904   }
 905   if (parent_fd > 0 && close(parent_fd) == CLOSE_ERROR) {
 906     perror("apply_default_acl_ex (close parent_fd)");
 907     result = ACL_ERROR;
 908   }
 909   return result;
 910 }
 911
 912
 913
 914 /**
 915  * @brief The friendly interface to @c apply_default_acl_ex.
 916  *
 917  * The @c apply_default_acl_ex function holds the real implementation
 918  * of this function, but it takes a weird second argument that most
 919  * people won't care about (a stat structure). But, we use that
 920  * argument for the recursive mode of the CLI, so it's there.
 921  *
 922  * If you don't have a stat structure for your @c path, use this instead.
 923  *
 924  * @param path
 925  *   The path whose ACL we would like to reset to its default.
 926  *
 927  * @param no_exec_mask
 928  *   The value (either true or false) of the --no-exec-mask flag.
 929  *
 930  * @return
 931  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 932  *   - @c ACL_FAILURE - If symlinks or hard links are encountered.
 933  *     or the parent of @c path is not a directory.
 934  *   - @c ACL_ERROR - Unexpected library error.
 935  */
 936 int apply_default_acl(const char* path, bool no_exec_mask) {
 937   return apply_default_acl_ex(path, NULL, no_exec_mask);
 938 }