configure.ac: update the version to 0.4.4.
[apply-default-acl.git] / src / libadacl.c
1 /**
2 * @file libadacl.c
3 *
4 * @brief The adacl (apply default acl) shared library.
5 *
6 */
7
8 /* Enables get_current_dir_name() in unistd.h, the O_PATH flag, and
9 * the asprintf() function.
10 */
11 #define _GNU_SOURCE
12
13 #include <dirent.h> /* readdir(), etc. */
14 #include <errno.h> /* EINVAL, ELOOP, ENOTDIR, etc. */
15 #include <fcntl.h> /* openat() */
16 #include <libgen.h> /* basename(), dirname() */
17 #include <limits.h> /* PATH_MAX */
18 #include <stdbool.h> /* the "bool" type */
19 #include <stdio.h> /* perror(), asprintf() */
20 #include <stdlib.h> /* free() */
21 #include <string.h> /* strdup() */
22 #include <sys/stat.h> /* fstat() */
23 #include <sys/xattr.h> /* fgetxattr(), fsetxattr() */
24 #include <unistd.h> /* get_current_dir_name() */
25
26 /* ACLs */
27 #include <acl/libacl.h> /* acl_get_perm, not portable */
28 #include <sys/acl.h> /* all other acl_foo functions */
29
30 /* XATTR_NAME_POSIX_ACL_ACCESS and XATTR_NAME_POSIX_ACL_DEFAULT */
31 #include <linux/xattr.h>
32
33 #include "libadacl.h"
34
35
36 /* Even though most other library functions reliably return -1 for
37 * error, it feels a little wrong to re-use the ACL_ERROR constant.
38 */
39 #define CLOSE_ERROR -1
40 #define OPEN_ERROR -1
41 #define ASPRINTF_ERROR -1
42 #define STAT_ERROR -1
43 #define XATTR_ERROR -1
44
45
46 /* Prototypes */
47 int safe_open_ex(int at_fd, char* pathname, int flags);
48 int safe_open(const char* pathname, int flags);
49 int acl_update_entry(acl_t aclp, acl_entry_t updated_entry);
50 int acl_entry_count(acl_t acl);
51 int acl_is_minimal(acl_t acl);
52 int acl_execute_masked(acl_t acl);
53 int any_can_execute(int fd, const struct stat* sp);
54 int acl_copy_xattr(int src_fd,
55 acl_type_t src_type,
56 int dst_fd,
57 acl_type_t dst_type);
58 int has_default_acl_fd(int fd);
59 int apply_default_acl_fds(int parent_fd, int fd, bool recursive);
60 int apply_default_acl(const char* path, bool recursive);
61
62
63
64 /**
65 * @brief The recursive portion of the @c safe_open function, used to
66 * open a file descriptor in a symlink-safe way when combined with
67 * the @c O_NOFOLLOW flag.
68 *
69 * @param at_fd
70 * A file descriptor relative to which @c pathname will be opened.
71 *
72 * @param pathname
73 * The path to the file/directory/whatever whose descriptor you want.
74 *
75 * @param flags
76 * File status flags to be passed to @c openat.
77 *
78 * @return a file descriptor for @c pathname if everything goes well,
79 * and @c OPEN_ERROR if not.
80 */
81 int safe_open_ex(int at_fd, char* pathname, int flags) {
82 if (pathname == NULL) {
83 errno = EINVAL;
84 perror("safe_open_ex (args)");
85 return OPEN_ERROR;
86 }
87
88 char* firstslash = strchr(pathname, '/');
89 if (firstslash == NULL) {
90 /* No more slashes, this is the base case. */
91 return openat(at_fd, pathname, flags);
92 }
93 if (firstslash[1] == '\0') {
94 /* The first slash is the last character; ensure that we open
95 a directory. */
96 firstslash[0] = '\0';
97 return openat(at_fd, pathname, flags | O_DIRECTORY);
98 }
99
100 /* The first slash exists and isn't the last character in the path,
101 so we can split the path wherever that first slash lies and
102 recurse. */
103 *firstslash = '\0';
104 int fd = openat(at_fd, pathname, flags | O_DIRECTORY | O_PATH);
105 if (fd == OPEN_ERROR) {
106 if (errno != ENOTDIR) {
107 /* Don't output anything if we ignore a symlink */
108 perror("safe_open_ex (safe_open_ex)");
109 }
110 return OPEN_ERROR;
111 }
112
113 /* The +1 is safe because there needs to be at least one character
114 after the first slash (we checked this above). */
115 int result = safe_open_ex(fd, firstslash+1, flags);
116 if (close(fd) == CLOSE_ERROR) {
117 perror("safe_open_ex (close)");
118 return OPEN_ERROR;
119 }
120 return result;
121 }
122
123
124 /**
125 * @brief A version of @c open that is completely symlink-safe when
126 * used with the @c O_NOFOLLOW flag.
127 *
128 * The @c openat function exists to ensure that you can anchor one
129 * path to a particular directory while opening it; however, if you
130 * open "b/c/d" relative to "/a", then even the @c openat function will
131 * still follow symlinks in the "b" component. This can be exploited
132 * by an attacker to make you open the wrong path.
133 *
134 * To avoid that problem, this function uses a recursive
135 * implementation that opens every path from the root, one level at a
136 * time. So "a" is opened relative to "/", and then "b" is opened
137 * relative to "/a", and then "c" is opened relative to "/a/b",
138 * etc. When the @c O_NOFOLLOW flag is used, this approach ensures
139 * that no symlinks in any component are followed.
140 *
141 * @param pathname
142 * The path to the file/directory/whatever whose descriptor you want.
143 *
144 * @param flags
145 * File status flags to be passed to @c openat.
146 *
147 * @return a file descriptor for @c pathname if everything goes well,
148 * and @c OPEN_ERROR if not.
149 */
150 int safe_open(const char* pathname, int flags) {
151 if (pathname == NULL) {
152 errno = EINVAL;
153 perror("safe_open (args)");
154 return OPEN_ERROR;
155 }
156
157 char* abspath = NULL;
158 int asprintf_result = 0;
159 if (strchr(pathname, '/') == pathname) {
160 /* pathname is already absolute; just copy it. */
161 asprintf_result = asprintf(&abspath, "%s", pathname);
162 }
163 else {
164 /* Concatenate the current working directory and pathname into an
165 * absolute path. We use realpath() ONLY on the cwd part, and not
166 * on the pathname part, because realpath() resolves symlinks. And
167 * the whole point of all this crap is to avoid following symlinks
168 * in the pathname.
169 *
170 * Using realpath() on the cwd lets us operate on relative paths
171 * while we're sitting in a directory that happens to have a
172 * symlink in it; for example: cd /var/run && apply-default-acl foo.
173 */
174 char* cwd = get_current_dir_name();
175 if (cwd == NULL) {
176 perror("safe_open (get_current_dir_name)");
177 return OPEN_ERROR;
178 }
179
180 char abs_cwd[PATH_MAX];
181 if (realpath(cwd, abs_cwd) == NULL) {
182 perror("safe_open (realpath)");
183 free(cwd);
184 return OPEN_ERROR;
185 }
186 asprintf_result = asprintf(&abspath, "%s/%s", abs_cwd, pathname);
187 free(cwd);
188 }
189 if (asprintf_result == ASPRINTF_ERROR) {
190 perror("safe_open (asprintf)");
191 return OPEN_ERROR;
192 }
193
194 /* Beyond here, asprintf() worked, and we need to free abspath. */
195 int result = OPEN_ERROR;
196
197 bool abspath_is_root = (strcmp(abspath, "/") == 0);
198 int rootflags = flags | O_DIRECTORY;
199 if (!abspath_is_root) {
200 /* Use O_PATH for some added safety if "/" is not our target */
201 rootflags |= O_PATH;
202 }
203 int rootfd = open("/", rootflags);
204 if (rootfd == OPEN_ERROR) {
205 perror("safe_open (open)");
206 result = OPEN_ERROR;
207 goto cleanup;
208 }
209
210 if (abspath_is_root) {
211 result = rootfd;
212 goto cleanup;
213 }
214
215 result = safe_open_ex(rootfd, abspath+1, flags);
216 if (close(rootfd) == CLOSE_ERROR) {
217 perror("safe_open (close)");
218 result = OPEN_ERROR;
219 goto cleanup;
220 }
221
222 cleanup:
223 free(abspath);
224 return result;
225 }
226
227
228
229
230 /**
231 * @brief Update an entry in an @b minimal ACL.
232 *
233 * @param aclp
234 * A pointer to the acl_t structure whose entry we want to update.
235 *
236 * @param updated_entry
237 * An updated copy of an existing entry in @c aclp.
238 *
239 * @return
240 * - @c ACL_SUCCESS - If we update an existing entry.
241 * - @c ACL_FAILURE - If we don't find an entry to update.
242 * - @c ACL_ERROR - Unexpected library error.
243 */
244 int acl_update_entry(acl_t aclp, acl_entry_t updated_entry) {
245 if (aclp == NULL || updated_entry == NULL) {
246 errno = EINVAL;
247 perror("acl_update_entry (args)");
248 return ACL_ERROR;
249 }
250
251 acl_tag_t updated_tag;
252 if (acl_get_tag_type(updated_entry, &updated_tag) == ACL_ERROR) {
253 perror("acl_update_entry (acl_get_tag_type)");
254 return ACL_ERROR;
255 }
256
257 acl_permset_t updated_permset;
258 if (acl_get_permset(updated_entry, &updated_permset) == ACL_ERROR) {
259 perror("acl_update_entry (acl_get_permset)");
260 return ACL_ERROR;
261 }
262
263 /* This can allocate memory, so from here on out we have to jump to
264 the "cleanup" label to exit. */
265 void* updated_qualifier = acl_get_qualifier(updated_entry);
266 if (updated_qualifier == NULL &&
267 (updated_tag == ACL_USER || updated_tag == ACL_GROUP)) {
268 /* acl_get_qualifier() can return NULL, but it shouldn't for
269 ACL_USER or ACL_GROUP entries. */
270 perror("acl_update_entry (acl_get_qualifier)");
271 return ACL_ERROR;
272 }
273
274 /* Our return value. Default to failure, and change to success if we
275 actually update something. */
276 int result = ACL_FAILURE;
277
278 acl_entry_t existing_entry;
279 /* Loop through the given ACL looking for matching entries. */
280 int get_entry_result = acl_get_entry(aclp, ACL_FIRST_ENTRY, &existing_entry);
281
282 while (get_entry_result == ACL_SUCCESS) {
283 acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
284
285 if (acl_get_tag_type(existing_entry, &existing_tag) == ACL_ERROR) {
286 perror("set_acl_tag_permset (acl_get_tag_type)");
287 result = ACL_ERROR;
288 goto cleanup;
289 }
290
291 if (existing_tag == updated_tag) {
292 /* Our tag types match, but if we have a named user or group
293 entry, then we need to check that the user/group (that is,
294 the qualifier) matches too. */
295 bool qualifiers_match = false;
296
297 /* There are three ways the qualifiers can match... */
298 void* existing_qualifier = acl_get_qualifier(existing_entry);
299 if (existing_qualifier == NULL) {
300 if (existing_tag == ACL_USER || existing_tag == ACL_GROUP) {
301 perror("acl_update_entry (acl_get_qualifier)");
302 result = ACL_ERROR;
303 goto cleanup;
304 }
305 else {
306 /* First, we could be dealing with an entry that isn't a
307 named user or group, in which case they "match
308 vacuously." */
309 qualifiers_match = true;
310 }
311 }
312
313 /* Second, they could have matching UIDs. We don't really need to
314 check both tags here, since we know that they're equal. However,
315 clang-tidy can't figure that out, and the redundant equality
316 check prevents it from complaining about a potential null pointer
317 dereference. */
318 if (updated_tag == ACL_USER && existing_tag == ACL_USER) {
319 qualifiers_match = ( *((uid_t*)existing_qualifier)
320 ==
321 *((uid_t*)updated_qualifier) );
322 }
323
324 /* Third, they could have matching GIDs. See above for why
325 we check the redundant condition existing_tag == ACL_GROUP. */
326 if (updated_tag == ACL_GROUP && existing_tag == ACL_GROUP) {
327 qualifiers_match = ( *((gid_t*)existing_qualifier)
328 ==
329 *((gid_t*)updated_qualifier) );
330 }
331
332 /* Be sure to free this inside the loop, where memory is allocated. */
333 acl_free(existing_qualifier);
334
335 if (qualifiers_match) {
336 /* If we update something, we're done and return ACL_SUCCESS */
337 if (acl_set_permset(existing_entry, updated_permset) == ACL_ERROR) {
338 perror("acl_update_entry (acl_set_permset)");
339 result = ACL_ERROR;
340 goto cleanup;
341 }
342
343 result = ACL_SUCCESS;
344 goto cleanup;
345 }
346 }
347
348 get_entry_result = acl_get_entry(aclp, ACL_NEXT_ENTRY, &existing_entry);
349 }
350
351 /* This catches both the initial acl_get_entry and the ones at the
352 end of the loop. */
353 if (get_entry_result == ACL_ERROR) {
354 perror("acl_update_entry (acl_get_entry)");
355 result = ACL_ERROR;
356 }
357
358 cleanup:
359 acl_free(updated_qualifier);
360 return result;
361 }
362
363
364
365 /**
366 * @brief Determine the number of entries in the given ACL.
367 *
368 * @param acl
369 * The ACL to inspect.
370 *
371 * @return Either the non-negative number of entries in @c acl, or
372 * @c ACL_ERROR on error.
373 */
374 int acl_entry_count(acl_t acl) {
375
376 acl_entry_t entry;
377 int entry_count = 0;
378 int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
379
380 while (result == ACL_SUCCESS) {
381 entry_count++;
382 result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
383 }
384
385 if (result == ACL_ERROR) {
386 perror("acl_entry_count (acl_get_entry)");
387 return ACL_ERROR;
388 }
389
390 return entry_count;
391 }
392
393
394
395 /**
396 * @brief Determine whether or not the given ACL is minimal.
397 *
398 * An ACL is minimal if it has fewer than four entries.
399 *
400 * @param acl
401 * The ACL whose minimality is in question.
402 *
403 * @return
404 * - @c ACL_SUCCESS - @c acl is minimal
405 * - @c ACL_FAILURE - @c acl is not minimal
406 * - @c ACL_ERROR - Unexpected library error
407 */
408 int acl_is_minimal(acl_t acl) {
409 if (acl == NULL) {
410 errno = EINVAL;
411 perror("acl_is_minimal (args)");
412 return ACL_ERROR;
413 }
414
415 int ec = acl_entry_count(acl);
416
417 if (ec == ACL_ERROR) {
418 perror("acl_is_minimal (acl_entry_count)");
419 return ACL_ERROR;
420 }
421
422 if (ec < 4) {
423 return ACL_SUCCESS;
424 }
425 else {
426 return ACL_FAILURE;
427 }
428 }
429
430
431
432 /**
433 * @brief Determine whether the given ACL's mask denies execute.
434 *
435 * @param acl
436 * The ACL whose mask we want to check.
437 *
438 * @return
439 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
440 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
441 * - @c ACL_ERROR - Unexpected library error.
442 */
443 int acl_execute_masked(acl_t acl) {
444 if (acl == NULL) {
445 errno = EINVAL;
446 perror("acl_execute_masked (args)");
447 return ACL_ERROR;
448 }
449
450 acl_entry_t entry;
451 int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
452
453 while (ge_result == ACL_SUCCESS) {
454 acl_tag_t tag = ACL_UNDEFINED_TAG;
455
456 if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
457 perror("acl_execute_masked (acl_get_tag_type)");
458 return ACL_ERROR;
459 }
460
461 if (tag == ACL_MASK) {
462 /* This is the mask entry, get its permissions, and see if
463 execute is specified. */
464 acl_permset_t permset;
465
466 if (acl_get_permset(entry, &permset) == ACL_ERROR) {
467 perror("acl_execute_masked (acl_get_permset)");
468 return ACL_ERROR;
469 }
470
471 int gp_result = acl_get_perm(permset, ACL_EXECUTE);
472 if (gp_result == ACL_ERROR) {
473 perror("acl_execute_masked (acl_get_perm)");
474 return ACL_ERROR;
475 }
476
477 if (gp_result == ACL_FAILURE) {
478 /* No execute bit set in the mask; execute not allowed. */
479 return ACL_SUCCESS;
480 }
481 }
482
483 ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
484 }
485
486 return ACL_FAILURE;
487 }
488
489
490
491 /**
492 * @brief Determine whether @c fd is executable by anyone.
493 *
494 *
495 * This is used as part of the heuristic to determine whether or not
496 * we should mask the execute bit when inheriting an ACL. If @c fd
497 * describes a file, we check the @a effective permissions, contrary
498 * to what setfacl does.
499 *
500 * @param fd
501 * The file descriptor to check.
502 *
503 * @param sp
504 * A pointer to a stat structure for @c fd.
505 *
506 * @return
507 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
508 * - @c ACL_FAILURE - Nobody can execute @c fd.
509 * - @c ACL_ERROR - Unexpected library error.
510 */
511 int any_can_execute(int fd, const struct stat* sp) {
512 if (sp == NULL) {
513 errno = EINVAL;
514 perror("any_can_execute (args)");
515 return ACL_ERROR;
516 }
517
518 acl_t acl = acl_get_fd(fd);
519
520 if (acl == (acl_t)NULL) {
521 perror("any_can_execute (acl_get_fd)");
522 return ACL_ERROR;
523 }
524
525 /* Our return value. */
526 int result = ACL_FAILURE;
527
528 if (acl_is_minimal(acl)) {
529 if (sp->st_mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
530 result = ACL_SUCCESS;
531 goto cleanup;
532 }
533 else {
534 result = ACL_FAILURE;
535 goto cleanup;
536 }
537 }
538
539 acl_entry_t entry;
540 int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
541
542 while (ge_result == ACL_SUCCESS) {
543 /* The first thing we do is check to see if this is a mask
544 entry. If it is, we skip it entirely. */
545 acl_tag_t tag = ACL_UNDEFINED_TAG;
546
547 if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
548 perror("any_can_execute_or (acl_get_tag_type)");
549 result = ACL_ERROR;
550 goto cleanup;
551 }
552
553 if (tag == ACL_MASK) {
554 ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
555 continue;
556 }
557
558 /* Ok, so it's not a mask entry. Check the execute perms. */
559 acl_permset_t permset;
560
561 if (acl_get_permset(entry, &permset) == ACL_ERROR) {
562 perror("any_can_execute_or (acl_get_permset)");
563 result = ACL_ERROR;
564 goto cleanup;
565 }
566
567 int gp_result = acl_get_perm(permset, ACL_EXECUTE);
568 if (gp_result == ACL_ERROR) {
569 perror("any_can_execute (acl_get_perm)");
570 result = ACL_ERROR;
571 goto cleanup;
572 }
573
574 if (gp_result == ACL_SUCCESS) {
575 /* Only return ACL_SUCCESS if this execute bit is not masked. */
576 if (acl_execute_masked(acl) != ACL_SUCCESS) {
577 result = ACL_SUCCESS;
578 goto cleanup;
579 }
580 }
581
582 ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
583 }
584
585 if (ge_result == ACL_ERROR) {
586 perror("any_can_execute (acl_get_entry)");
587 result = ACL_ERROR;
588 goto cleanup;
589 }
590
591 cleanup:
592 acl_free(acl);
593 return result;
594 }
595
596
597
598 /**
599 * @brief Copy ACLs between file descriptors as xattrs, verbatim.
600 *
601 * There is a small deficiency in libacl, namely that there is no way
602 * to get or set default ACLs through file descriptors. The @c
603 * acl_get_file and @c acl_set_file functions can do it, but they use
604 * paths, and are vulnerable to symlink attacks.
605 *
606 * Fortunately, when inheriting an ACL, we don't really need to look
607 * at what it contains. That means that we can copy the on-disk xattrs
608 * from the source directory to the destination file/directory without
609 * passing through libacl, and this can be done with file descriptors
610 * through @c fgetxattr and @c fsetxattr. That's what this function
611 * does.
612 *
613 * @param src_fd
614 * The file descriptor from which the ACL will be copied.
615 *
616 * @param src_type
617 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
618 * to copy from @c src_fd.
619 *
620 * @param dst_fd
621 * The file descriptor whose ACL will be overwritten with the one
622 * from @c src_fd.
623 *
624 * @param dst_type
625 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
626 * to replace on @c dst_fd.
627 *
628 * @return
629 * - @c ACL_SUCCESS - The ACL was copied successfully.
630 * - @c ACL_FAILURE - There was no ACL on @c src_fd.
631 * - @c ACL_ERROR - Unexpected library error.
632 */
633 int acl_copy_xattr(int src_fd,
634 acl_type_t src_type,
635 int dst_fd,
636 acl_type_t dst_type) {
637
638 const char* src_name;
639 if (src_type == ACL_TYPE_ACCESS) {
640 src_name = XATTR_NAME_POSIX_ACL_ACCESS;
641 }
642 else if (src_type == ACL_TYPE_DEFAULT) {
643 src_name = XATTR_NAME_POSIX_ACL_DEFAULT;
644 }
645 else {
646 errno = EINVAL;
647 perror("acl_copy_xattr (src type)");
648 return ACL_ERROR;
649 }
650
651 const char* dst_name;
652 if (dst_type == ACL_TYPE_ACCESS) {
653 dst_name = XATTR_NAME_POSIX_ACL_ACCESS;
654 }
655 else if (dst_type == ACL_TYPE_DEFAULT) {
656 dst_name = XATTR_NAME_POSIX_ACL_DEFAULT;
657 }
658 else {
659 errno = EINVAL;
660 perror("acl_copy_xattr (dst type)");
661 return ACL_ERROR;
662 }
663
664 ssize_t src_size_guess = fgetxattr(src_fd, src_name, NULL, 0);
665 if (src_size_guess == XATTR_ERROR) {
666 if (errno == ENODATA) {
667 /* A missing ACL isn't really an error. ENOATTR and ENODATA are
668 synonyms, but using ENODATA here lets us avoid another
669 "include" directive. */
670 return ACL_FAILURE;
671 }
672 perror("acl_copy_xattr (fgetxattr size guess)");
673 return ACL_ERROR;
674 }
675 char* src_acl_p = alloca(src_size_guess);
676 /* The actual size may be smaller than our guess? I don't know. The
677 return value from fgetxattr() will either be nonnegative, or
678 XATTR_ERROR (which we've already ruled out), so it's safe to cast
679 it to an unsigned size_t here to avoid a compiler warning. */
680 ssize_t src_size = fgetxattr(src_fd,
681 src_name,
682 src_acl_p,
683 (size_t)src_size_guess);
684 if (src_size == XATTR_ERROR) {
685 if (errno == ENODATA) {
686 /* A missing ACL isn't an error. */
687 return ACL_FAILURE;
688 }
689 perror("acl_copy_xattr (fgetxattr)");
690 return ACL_ERROR;
691 }
692
693 /* See above: src_size must be nonnegative at this point,so we cast
694 it to size_t to avoid a compiler warning. */
695 if (fsetxattr(dst_fd,
696 dst_name,
697 src_acl_p,
698 (size_t)src_size,
699 0)
700 == XATTR_ERROR) {
701 perror("acl_copy_xattr (fsetxattr)");
702 return ACL_ERROR;
703 }
704
705 return ACL_SUCCESS;
706 }
707
708
709 /**
710 * @brief Determine if a file descriptor has a default ACL.
711 *
712 * @param fd
713 * The file descriptor whose default ACL is in question.
714 *
715 * @return
716 * - @c ACL_SUCCESS - If @c fd has a default ACL.
717 * - @c ACL_FAILURE - If @c fd does not have a default ACL.
718 * - @c ACL_ERROR - Unexpected library error.
719 */
720 int has_default_acl_fd(int fd) {
721 if (fgetxattr(fd, XATTR_NAME_POSIX_ACL_DEFAULT, NULL, 0) == XATTR_ERROR) {
722 if (errno == ENODATA) {
723 return ACL_FAILURE;
724 }
725 perror("has_default_acl_fd (fgetxattr)");
726 return ACL_ERROR;
727 }
728
729 return ACL_SUCCESS;
730 }
731
732
733
734 /**
735 * @brief The recursive portion of @c apply_default_acl.
736 *
737 * The @c apply_default_acl function takes a path, but then opens file
738 * descriptors for the path and its parent. Afterwards, everything is
739 * done using file descriptors, including the recursive application on
740 * the path's children. This function encapsulates the portion of @c
741 * apply_default_acl that uses only file descriptors; for the
742 * recursion, this function ultimately calls itself.
743 *
744 * This overwrites any existing ACLs on @c fd and, if @c recursive is
745 * @c true, its children. When @c recursive is @c true, the "worst"
746 * result encountered is returned as the overall result.
747 *
748 * @param parent_fd
749 * A file descriptor for the parent directory of @c fd.
750 *
751 * @param fd
752 * The file descriptor that should inherit its parent's default ACL.
753 *
754 * @param recursive
755 * Should we recurse into subdirectories?
756 *
757 * @return
758 * - @c ACL_SUCCESS - The parent default ACLs were inherited successfully.
759 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
760 * - @c ACL_ERROR - Unexpected library error.
761 */
762 int apply_default_acl_fds(int parent_fd, int fd, bool recursive) {
763 int result = ACL_SUCCESS;
764
765 /* The new ACL for this path */
766 acl_t new_acl = (acl_t)NULL;
767
768 /* A copy of new_acl, to be made before we begin mangling new_acl in
769 order to mask the execute bit. */
770 acl_t new_acl_unmasked = (acl_t)NULL;
771
772 /* Refuse to operate on hard links, which can be abused by an
773 * attacker to trick us into changing the ACL on a file we didn't
774 * intend to; namely the "target" of the hard link. There is TOCTOU
775 * race condition here, but the window is as small as possible
776 * between when we open the file descriptor (look above) and when we
777 * fstat it.
778 */
779 struct stat s;
780 if (fstat(fd, &s) == STAT_ERROR) {
781 perror("apply_default_acl_fds (fstat)");
782 /* We can't recurse without the stat struct for fd */
783 goto cleanup;
784 }
785
786
787 /* Check to make sure the parent descriptor actually has a default
788 ACL. If it doesn't, then we can "succeed" immediately, saving a
789 little work, particularly in any_can_execute(). Note that we
790 can't skip the fstat() above, because we need it in case we
791 recurse. */
792 if (has_default_acl_fd(parent_fd) == ACL_FAILURE) {
793 result = ACL_SUCCESS;
794 /* Just because this target can't inherit anything doesn't mean
795 that one of it's children can't. For example, if there's a
796 default on "c" in "a/b/c/d", then we don't want to skip all
797 children of "a"! */
798 goto recurse;
799 }
800
801
802 if (!S_ISDIR(s.st_mode)) {
803 /* If it's not a directory, make sure it's a regular,
804 non-hard-linked file. */
805 if (!S_ISREG(s.st_mode) || s.st_nlink != 1) {
806 result = ACL_FAILURE;
807 goto cleanup; /* It's not a directory, so we can skip the recursion. */
808 }
809 }
810
811
812 /* Next We try to guess whether or not to strip the execute bits.
813 * This behavior is modeled after the capital 'X' perms of setfacl.
814 */
815 int ace_result = any_can_execute(fd, &s);
816
817 if (ace_result == ACL_ERROR) {
818 perror("apply_default_acl_fds (any_can_execute)");
819 result = ACL_ERROR;
820 goto cleanup;
821 }
822
823 /* Never mask the execute bit on directories. */
824 bool allow_exec = (bool)ace_result || S_ISDIR(s.st_mode);
825
826
827 /* If it's a directory, inherit the parent's default. */
828 if (S_ISDIR(s.st_mode)) {
829 if (acl_copy_xattr(parent_fd,
830 ACL_TYPE_DEFAULT,
831 fd,
832 ACL_TYPE_DEFAULT) == ACL_ERROR) {
833 perror("apply_default_acl_fds (acl_copy_xattr default)");
834 result = ACL_ERROR;
835 goto cleanup;
836 }
837 }
838
839 /* If it's anything, _apply_ the parent's default. */
840 if (acl_copy_xattr(parent_fd,
841 ACL_TYPE_DEFAULT,
842 fd,
843 ACL_TYPE_ACCESS) == ACL_ERROR) {
844 perror("apply_default_acl_fds (acl_copy_xattr access)");
845 result = ACL_ERROR;
846 goto cleanup;
847 }
848
849 /* There's a good reason why we saved the ACL above, even though
850 * we're about to read it back into memory and mess with it on the
851 * next line. The acl_copy_xattr() function is already a hack to let
852 * us copy default ACLs without resorting to path names; we simply
853 * have no way to read the parent's default ACL into memory using
854 * parent_fd. We can, however, copy the parent's ACL to a file (with
855 * acl_copy_xattr), and then read the ACL from a file using
856 * "fd". It's quite the circus, but it works and should be safe from
857 * sym/hardlink attacks.
858 */
859
860 /* Now we potentially need to mask the execute permissions in the
861 ACL on fd; or maybe not. */
862 if (allow_exec) {
863 /* Skip the mask code for this target, but don't skip its children! */
864 goto recurse;
865 }
866
867 /* OK, we need to mask some execute permissions. First obtain the
868 current ACL... */
869 new_acl = acl_get_fd(fd);
870 if (new_acl == (acl_t)NULL) {
871 perror("apply_default_acl_fds (acl_get_fd)");
872 result = ACL_ERROR;
873 goto cleanup;
874 }
875
876 /* ...and now make a copy of it, because otherwise when we loop
877 below, some shit gets stuck (modifying the structure while
878 looping over it no worky). */
879 new_acl_unmasked = acl_dup(new_acl);
880 if (new_acl_unmasked == (acl_t)NULL) {
881 perror("apply_default_acl_fds (acl_dup)");
882 result = ACL_ERROR;
883 goto cleanup;
884 }
885
886 acl_entry_t entry;
887 int ge_result = acl_get_entry(new_acl_unmasked, ACL_FIRST_ENTRY, &entry);
888
889 while (ge_result == ACL_SUCCESS) {
890 acl_tag_t tag = ACL_UNDEFINED_TAG;
891
892 if (acl_get_tag_type(entry, &tag) == ACL_ERROR) {
893 perror("apply_default_acl_fds (acl_get_tag_type)");
894 result = ACL_ERROR;
895 goto cleanup;
896 }
897
898
899 /* We've got an entry/tag from the default ACL. Get its permset. */
900 acl_permset_t permset;
901 if (acl_get_permset(entry, &permset) == ACL_ERROR) {
902 perror("apply_default_acl_fds (acl_get_permset)");
903 result = ACL_ERROR;
904 goto cleanup;
905 }
906
907 /* To mimic what the kernel does, I think we could drop
908 ACL_GROUP_OBJ from the list below? */
909 if (tag == ACL_MASK ||
910 tag == ACL_USER_OBJ ||
911 tag == ACL_GROUP_OBJ ||
912 tag == ACL_OTHER) {
913
914 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
915 minimal ACLs) or acl_other entries, so if execute should be
916 masked, we have to do it manually. */
917 if (acl_delete_perm(permset, ACL_EXECUTE) == ACL_ERROR) {
918 perror("apply_default_acl_fds (acl_delete_perm)");
919 result = ACL_ERROR;
920 goto cleanup;
921 }
922
923 if (acl_set_permset(entry, permset) == ACL_ERROR) {
924 perror("apply_default_acl_fds (acl_set_permset)");
925 result = ACL_ERROR;
926 goto cleanup;
927 }
928 }
929
930 if (acl_update_entry(new_acl, entry) == ACL_ERROR) {
931 perror("apply_default_acl_fds (acl_update_entry)");
932 result = ACL_ERROR;
933 goto cleanup;
934 }
935
936 ge_result = acl_get_entry(new_acl_unmasked, ACL_NEXT_ENTRY, &entry);
937 }
938
939 /* Catches the first acl_get_entry as well as the ones at the end of
940 the loop. */
941 if (ge_result == ACL_ERROR) {
942 perror("apply_default_acl_fds (acl_get_entry)");
943 result = ACL_ERROR;
944 goto cleanup;
945 }
946
947 if (acl_set_fd(fd, new_acl) == ACL_ERROR) {
948 perror("apply_default_acl_fds (acl_set_fd)");
949 result = ACL_ERROR;
950 goto cleanup;
951 }
952
953 recurse:
954 if (recursive && S_ISDIR(s.st_mode)) {
955 /* Recurse into subdirectories. Don't call closedir() on d! It
956 closes the open file descriptor as well, and subsequent calls
957 to close() then throw errors. */
958 DIR* d = fdopendir(fd);
959 if (d == NULL) {
960 perror("apply_default_acl_fds (fdopendir)");
961 result = ACL_ERROR;
962 goto cleanup;
963 }
964
965 struct dirent* de;
966 int new_fd = 0;
967 while ((de = readdir(d)) != NULL) {
968 if (de->d_type != DT_DIR && de->d_type != DT_REG) {
969 /* Hit a symlink or whatever. */
970 result = ACL_FAILURE;
971 continue;
972 }
973 if (strcmp(de->d_name, ".") == 0) { continue; }
974 if (strcmp(de->d_name, "..") == 0) { continue; }
975
976 /* Be careful not to "return" out of this loop and leave the
977 new_fd open! */
978 new_fd = openat(fd, de->d_name, O_NOFOLLOW);
979 if (new_fd == OPEN_ERROR) {
980 if (errno == ELOOP || errno == ENOTDIR) {
981 /* We hit a symlink, either in the last path component (ELOOP)
982 or higher up (ENOTDIR). */
983 if (result == ACL_SUCCESS) {
984 /* Don't overwrite an error result with success/failure. */
985 result = ACL_FAILURE;
986 }
987 continue;
988 }
989 else {
990 perror("apply_default_acl_fds (openat)");
991 result = ACL_ERROR;
992 continue;
993 }
994 }
995 switch (apply_default_acl_fds(fd, new_fd, recursive)) {
996 /* Don't overwrite an error result with success/failure. */
997 case ACL_FAILURE:
998 if (result == ACL_SUCCESS) {
999 result = ACL_FAILURE;
1000 }
1001 break;
1002 case ACL_ERROR:
1003 result = ACL_ERROR;
1004 default:
1005 if (close(new_fd) == CLOSE_ERROR) {
1006 perror("apply_default_acl_fds (close)");
1007 result = ACL_ERROR;
1008 }
1009 }
1010 }
1011 }
1012
1013 cleanup:
1014 acl_free(new_acl);
1015 acl_free(new_acl_unmasked);
1016 return result;
1017 }
1018
1019
1020 /**
1021 * @brief Apply parent default ACL to a path and optionally its children.
1022 *
1023 * This overwrites any existing ACLs on the target, and, if @c
1024 * recursive is @c true, its children. When @c recursive is @c true,
1025 * the "worst" result encountered is returned as the overall result.
1026 *
1027 * @param path
1028 * The path whose ACL we would like to reset to its default.
1029 *
1030 * @param recursive
1031 * Should we recurse into subdirectories?
1032 *
1033 * @return
1034 * - @c ACL_SUCCESS - The parent default ACLs were inherited successfully.
1035 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
1036 * - @c ACL_ERROR - Unexpected library error.
1037 */
1038 int apply_default_acl(const char* path, bool recursive) {
1039
1040 if (path == NULL) {
1041 errno = EINVAL;
1042 perror("apply_default_acl (args)");
1043 return ACL_ERROR;
1044 }
1045
1046 /* Define these next three variables here because we may have to
1047 * jump to the cleanup routine which expects them to exist.
1048 */
1049
1050 /* Our return value. */
1051 int result = ACL_SUCCESS;
1052
1053 /* The file descriptor corresponding to "path" */
1054 int fd = 0;
1055
1056 /* The file descriptor for the directory containing "path" */
1057 int parent_fd = 0;
1058
1059 /* dirname() and basename() mangle their arguments, so we need
1060 to make copies of "path" before using them. */
1061 char* dirname_path_copy = NULL;
1062 char* basename_path_copy = NULL;
1063
1064 /* Get the parent directory of "path" with dirname(), which happens
1065 * to murder its argument and necessitates a path_copy. */
1066 dirname_path_copy = strdup(path);
1067 if (dirname_path_copy == NULL) {
1068 perror("apply_default_acl (strdup)");
1069 return ACL_ERROR;
1070 }
1071 char* parent = dirname(dirname_path_copy);
1072
1073 basename_path_copy = strdup(path);
1074 if (basename_path_copy == NULL) {
1075 perror("apply_default_acl (strdup)");
1076 result = ACL_ERROR;
1077 goto cleanup;
1078 }
1079 char* child = basename(basename_path_copy);
1080
1081 /* Just kidding, if the path is "." or "..", then dirname will do
1082 * the wrong thing and give us "." as its parent, too. So, we handle
1083 * those as special cases. We use "child" instead of "path" here to
1084 * catch things like "./" and "../"
1085 */
1086 bool path_is_dots = strcmp(child, ".") == 0 || strcmp(child, "..") == 0;
1087 char dots_parent[6] = "../";
1088 if (path_is_dots) {
1089 /* We know that "child" contains no more than two characters here, and
1090 using strncat to enforce that belief keeps clang-tidy happy. */
1091 parent = strncat(dots_parent, child, 2);
1092 }
1093
1094 parent_fd = safe_open(parent, O_DIRECTORY | O_NOFOLLOW);
1095
1096 if (parent_fd == OPEN_ERROR) {
1097 if (errno == ELOOP || errno == ENOTDIR) {
1098 /* We hit a symlink, either in the last path component (ELOOP)
1099 or higher up (ENOTDIR). */
1100 result = ACL_FAILURE;
1101 goto cleanup;
1102 }
1103 else {
1104 perror("apply_default_acl (open parent fd)");
1105 result = ACL_ERROR;
1106 goto cleanup;
1107 }
1108 }
1109
1110 /* We already obtained the parent fd safely, so if we use the
1111 * basename of path here instead of the full thing, then we can get
1112 * away with using openat() and spare ourselves the slowness of
1113 * another safe_open().
1114 *
1115 * Note that if the basename is "." or "..", then we don't want to
1116 * open it relative to the parent_fd, so we need another special
1117 * case for those paths here.
1118 */
1119 if (path_is_dots) {
1120 fd = open(child, O_NOFOLLOW);
1121 }
1122 else {
1123 fd = openat(parent_fd, child, O_NOFOLLOW);
1124 }
1125 if (fd == OPEN_ERROR) {
1126 if (errno == ELOOP || errno == ENOTDIR) {
1127 /* We hit a symlink, either in the last path component (ELOOP)
1128 or higher up (ENOTDIR). */
1129 result = ACL_FAILURE;
1130 goto cleanup;
1131 }
1132 else {
1133 perror("apply_default_acl (open fd)");
1134 result = ACL_ERROR;
1135 goto cleanup;
1136 }
1137 }
1138
1139 result = apply_default_acl_fds(parent_fd, fd, recursive);
1140
1141 cleanup:
1142 free(dirname_path_copy);
1143 free(basename_path_copy);
1144
1145 if (parent_fd > 0 && close(parent_fd) == CLOSE_ERROR) {
1146 perror("apply_default_acl (close parent_fd)");
1147 result = ACL_ERROR;
1148 }
1149 if (fd > 0 && close(fd) == CLOSE_ERROR) {
1150 perror("apply_default_acl (close fd)");
1151 result = ACL_ERROR;
1152 }
1153 return result;
1154 }