/**
 * @file apply-default-acl.c
 *
 * @brief The entire implementation.
 *
 */

/* On Linux, ftw.h needs this special voodoo to work. */
#define _XOPEN_SOURCE 500
#define _GNU_SOURCE

#include <errno.h>
#include <ftw.h>    /* nftw() et al. */
#include <getopt.h>
#include <libgen.h> /* dirname()     */
#include <limits.h> /* PATH_MAX      */
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>

/* ACLs */
#include <acl/libacl.h> /* acl_get_perm, not portable */
#include <sys/types.h>
#include <sys/acl.h>

/* Most of the libacl functions return 1 for success, 0 for failure,
   and -1 on error */
#define ACL_ERROR -1
#define ACL_FAILURE 0
#define ACL_SUCCESS 1



/**
 * @brief Get the mode bits from the given path.
 *
 * @param path
 *   The path (file or directory) whose mode we want.
 *
 * @return A mode_t (st_mode) structure containing the mode bits.
 *   See sys/stat.h for details.
 */
mode_t get_mode(const char* path) {
  if (path == NULL) {
    errno = ENOENT;
    return -1;
  }

  struct stat s;
  int result = stat(path, &s);

  if (result == 0) {
    return s.st_mode;
  }
  else {
    /* errno will be set already by stat() */
    return result;
  }
}



/**
 * @brief Determine whether or not the given path is a regular file.
 *
 * @param path
 *   The path to test.
 *
 * @return true if @c path is a regular file, false otherwise.
 */
bool is_regular_file(const char* path) {
  if (path == NULL) {
    return false;
  }

  struct stat s;
  int result = stat(path, &s);
  if (result == 0) {
    return S_ISREG(s.st_mode);
  }
  else {
    return false;
  }
}



/**
 * @brief Determine whether or not the given path is a directory.
 *
 * @param path
 *   The path to test.
 *
 * @return true if @c path is a directory, false otherwise.
 */
bool is_directory(const char* path) {
  if (path == NULL) {
    return false;
  }

  struct stat s;
  int result = stat(path, &s);
  if (result == 0) {
    return S_ISDIR(s.st_mode);
  }
  else {
    return false;
  }
}



/**
 * @brief Update (or create) an entry in an @b minimal ACL.
 *
 * This function will not work if @c aclp contains extended
 * entries. This is fine for our purposes, since we call @c wipe_acls
 * on each path before applying the default to it.
 *
 * The assumption that there are no extended entries makes things much
 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
 * be created anew. This means we don't have to fool around comparing
 * named-user/group entries.
 *
 * @param aclp
 *   A pointer to the acl_t structure whose entry we want to modify.
 *
 * @param entry
 *   The new entry. If @c entry contains a user/group/other entry, we
 *   update the existing one. Otherwise we create a new entry.
 *
 * @return If there is an unexpected library error, @c ACL_ERROR is
 *   returned. Otherwise, @c ACL_SUCCESS.
 *
 */
int acl_set_entry(acl_t* aclp,
		  acl_entry_t entry) {

  acl_tag_t entry_tag;
  int gt_result = acl_get_tag_type(entry, &entry_tag);
  if (gt_result == ACL_ERROR) {
    perror("acl_set_entry (acl_get_tag_type)");
    return ACL_ERROR;
  }

  acl_permset_t entry_permset;
  int ps_result = acl_get_permset(entry, &entry_permset);
  if (ps_result == ACL_ERROR) {
    perror("acl_set_entry (acl_get_permset)");
    return ACL_ERROR;
  }

  acl_entry_t existing_entry;
  /* Loop through the given ACL looking for matching entries. */
  int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);

  while (result == ACL_SUCCESS) {
    acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
    int tag_result = acl_get_tag_type(existing_entry, &existing_tag);

    if (tag_result == ACL_ERROR) {
       perror("set_acl_tag_permset (acl_get_tag_type)");
       return ACL_ERROR;
    }

    if (existing_tag == entry_tag) {
      if (entry_tag == ACL_USER_OBJ ||
	  entry_tag == ACL_GROUP_OBJ ||
	  entry_tag == ACL_OTHER) {
	/* Only update for these three since all other tags will have
	   been wiped. These three are guaranteed to exist, so if we
	   match one of them, we're allowed to return ACL_SUCCESS
	   below and bypass the rest of the function. */
	acl_permset_t existing_permset;
	int gep_result = acl_get_permset(existing_entry, &existing_permset);
	if (gep_result == ACL_ERROR) {
	  perror("acl_set_entry (acl_get_permset)");
	  return ACL_ERROR;
	}

	int s_result = acl_set_permset(existing_entry, entry_permset);
	if (s_result == ACL_ERROR) {
	  perror("acl_set_entry (acl_set_permset)");
	  return ACL_ERROR;
	}

	return ACL_SUCCESS;
      }

    }

    result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
  }

  /* This catches both the initial acl_get_entry and the ones at the
     end of the loop. */
  if (result == ACL_ERROR) {
    perror("acl_set_entry (acl_get_entry)");
    return ACL_ERROR;
  }

  /* If we've made it this far, we need to add a new entry to the
     ACL. */
  acl_entry_t new_entry;

  /* We allocate memory here that we should release! */
  int c_result = acl_create_entry(aclp, &new_entry);
  if (c_result == ACL_ERROR) {
    perror("acl_set_entry (acl_create_entry)");
    return ACL_ERROR;
  }

  int st_result = acl_set_tag_type(new_entry, entry_tag);
  if (st_result == ACL_ERROR) {
    perror("acl_set_entry (acl_set_tag_type)");
    return ACL_ERROR;
  }

  int s_result = acl_set_permset(new_entry, entry_permset);
  if (s_result == ACL_ERROR) {
    perror("acl_set_entry (acl_set_permset)");
    return ACL_ERROR;
  }

  if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
    /* We need to set the qualifier too. */
    void* entry_qual = acl_get_qualifier(entry);
    if (entry_qual == (void*)NULL) {
      perror("acl_set_entry (acl_get_qualifier)");
      return ACL_ERROR;
    }

    int sq_result = acl_set_qualifier(new_entry, entry_qual);
    if (sq_result == ACL_ERROR) {
      perror("acl_set_entry (acl_set_qualifier)");
      return ACL_ERROR;
    }
  }

  return ACL_SUCCESS;
}



/**
 * @brief Determine the number of entries in the given ACL.
 *
 * @param acl
 *   A pointer to an @c acl_t structure.
 *
 * @return Either the non-negative number of entries in @c acl, or
 *   @c ACL_ERROR on error.
 */
int acl_entry_count(acl_t* acl) {

  acl_entry_t entry;
  int entry_count = 0;
  int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry);

  while (result == ACL_SUCCESS) {
    entry_count++;
    result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry);
  }

  if (result == ACL_ERROR) {
    perror("acl_entry_count (acl_get_entry)");
    return ACL_ERROR;
  }

  return entry_count;
}



/**
 * @brief Determine whether or not the given ACL is minimal.
 *
 * An ACL is minimal if it has fewer than four entries.
 *
 * @param acl
 *   A pointer to an acl_t structure.
 *
 * @return
 *   - @c ACL_SUCCESS - @c acl is minimal
 *   - @c ACL_FAILURE - @c acl is not minimal
 *   - @c ACL_ERROR - Unexpected library error
 */
int acl_is_minimal(acl_t* acl) {

  int ec = acl_entry_count(acl);

  if (ec == ACL_ERROR) {
    perror("acl_is_minimal (acl_entry_count)");
    return ACL_ERROR;
  }

  if (ec < 4) {
    return ACL_SUCCESS;
  }
  else {
    return ACL_FAILURE;
  }
}



/**
 * @brief Determine whether the given path has an ACL whose mask
 *   denies execute.
 *
 * @param path
 *   The path to check.
 *
 * @return
 *   - @c ACL_SUCCESS - @c path has a mask which denies execute.
 *   - @c ACL_FAILURE - The ACL for @c path does not deny execute,
 *     or @c path has no extended ACL at all.
 *   - @c ACL_ERROR - Unexpected library error.
 */
int acl_execute_masked(const char* path) {

  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);

  if (acl == (acl_t)NULL) {
    perror("acl_execute_masked (acl_get_file)");
    return ACL_ERROR;
  }

  /* Our return value. */
  int result = ACL_FAILURE;

  acl_entry_t entry;
  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);

  while (ge_result == ACL_SUCCESS) {
    acl_tag_t tag = ACL_UNDEFINED_TAG;
    int tag_result = acl_get_tag_type(entry, &tag);

    if (tag_result == ACL_ERROR) {
       perror("acl_execute_masked (acl_get_tag_type)");
       result = ACL_ERROR;
       goto cleanup;
    }

    if (tag == ACL_MASK) {
      /* This is the mask entry, get its permissions, and see if
	 execute is specified. */
      acl_permset_t permset;

      int ps_result = acl_get_permset(entry, &permset);
      if (ps_result == ACL_ERROR) {
	perror("acl_execute_masked (acl_get_permset)");
	result = ACL_ERROR;
	goto cleanup;
      }

      int gp_result = acl_get_perm(permset, ACL_EXECUTE);
      if (gp_result == ACL_ERROR) {
	perror("acl_execute_masked (acl_get_perm)");
	result = ACL_ERROR;
	goto cleanup;
      }

      if (gp_result == ACL_FAILURE) {
	/* No execute bit set in the mask; execute not allowed. */
	return ACL_SUCCESS;
      }
    }

    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
  }

 cleanup:
  acl_free(acl);
  return result;
}



/**
 * @brief Determine whether @c path is executable (by anyone) or a
 *   directory.
 *
 * This is used as part of the heuristic to determine whether or not
 * we should mask the execute bit when inheriting an ACL. If @c path
 * is a directory, the answer is a clear-cut yes. This behavior is
 * modeled after the capital 'X' perms of setfacl.
 *
 * If @c path is a file, we check the @a effective permissions,
 * contrary to what setfacl does.
 *
 * @param path
 *   The path to check.
 *
 * @return
 *   - @c ACL_SUCCESS - @c path is a directory, or someone has effective
       execute permissions.
 *   - @c ACL_FAILURE - @c path is a regular file and nobody can execute
       it.
 *   - @c ACL_ERROR - Unexpected library error.
 */
int any_can_execute_or_dir(const char* path) {

  if (is_directory(path)) {
    /* That was easy... */
    return ACL_SUCCESS;
  }

  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);

  if (acl == (acl_t)NULL) {
    perror("any_can_execute_or_dir (acl_get_file)");
    return ACL_ERROR;
  }

  /* Our return value. */
  int result = ACL_FAILURE;

  if (acl_is_minimal(&acl)) {
    mode_t mode = get_mode(path);
    if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
      result = ACL_SUCCESS;
      goto cleanup;
    }
    else {
      result = ACL_FAILURE;
      goto cleanup;
    }
  }

  acl_entry_t entry;
  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);

  while (ge_result == ACL_SUCCESS) {
    /* The first thing we do is check to see if this is a mask
       entry. If it is, we skip it entirely. */
    acl_tag_t tag = ACL_UNDEFINED_TAG;
    int tag_result = acl_get_tag_type(entry, &tag);

    if (tag_result == ACL_ERROR) {
      perror("any_can_execute_or_dir (acl_get_tag_type)");
      result = ACL_ERROR;
      goto cleanup;
    }

    if (tag == ACL_MASK) {
      ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
      continue;
    }

    /* Ok, so it's not a mask entry. Check the execute perms. */
    acl_permset_t permset;

    int ps_result = acl_get_permset(entry, &permset);
    if (ps_result == ACL_ERROR) {
      perror("any_can_execute_or_dir (acl_get_permset)");
      result = ACL_ERROR;
      goto cleanup;
    }

    int gp_result = acl_get_perm(permset, ACL_EXECUTE);
    if (gp_result == ACL_ERROR) {
      perror("any_can_execute_or_dir (acl_get_perm)");
      result = ACL_ERROR;
      goto cleanup;
    }

    if (gp_result == ACL_SUCCESS) {
      /* Only return ACL_SUCCESS if this execute bit is not masked. */
      if (acl_execute_masked(path) != ACL_SUCCESS) {
	result = ACL_SUCCESS;
	goto cleanup;
      }
    }

    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
  }

  if (ge_result == ACL_ERROR) {
    perror("any_can_execute_or_dir (acl_get_entry)");
    result = ACL_ERROR;
    goto cleanup;
  }

 cleanup:
  acl_free(acl);
  return result;
}



/**
 * @brief Inherit the default ACL from @c parent to @c path.
 *
 * The @c parent parameter does not necessarily need to be the parent
 * of @c path, although that will usually be the case. This overwrites
 * any existing default ACL on @c path.
 *
 * @param parent
 *   The parent directory whose ACL we want to inherit.
 *
 * @param path
 *   The target directory whose ACL we wish to overwrite (or create).
 *
 * @return
 *   - @c ACL_SUCCESS - The default ACL was inherited successfully.
 *   - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
 *   - @c ACL_ERROR - Unexpected library error.
 */
int inherit_default_acl(const char* path, const char* parent) {

  /* Our return value. */
  int result = ACL_SUCCESS;

  if (path == NULL) {
    errno = ENOENT;
    return ACL_ERROR;
  }

  if (!is_directory(path) || !is_directory(parent)) {
    return ACL_FAILURE;
  }

  acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT);
  if (parent_acl == (acl_t)NULL) {
    perror("inherit_default_acl (acl_get_file)");
    return ACL_ERROR;
  }

  acl_t path_acl = acl_dup(parent_acl);

  if (path_acl == (acl_t)NULL) {
    perror("inherit_default_acl (acl_dup)");
    acl_free(parent_acl);
    return ACL_ERROR;
  }

  int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
  if (sf_result == -1) {
    perror("inherit_default_acl (acl_set_file)");
    result = ACL_ERROR;
    goto cleanup;
  }

 cleanup:
  acl_free(path_acl);
  return result;
}



/**
 * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
 *   from the given path.
 *
 * @param path
 *   The path whose ACLs we want to wipe.
 *
 * @return
 *   - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
 *     existed in the first place.
 *   - @c ACL_ERROR - Unexpected library error.
 */
int wipe_acls(const char* path) {

  if (path == NULL) {
    errno = ENOENT;
    return ACL_ERROR;
  }

  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
  if (acl == (acl_t)NULL) {
    perror("wipe_acls (acl_get_file)");
    return ACL_ERROR;
  }

  /* Our return value. */
  int result = ACL_SUCCESS;

  acl_entry_t entry;
  int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);

  while (ge_result == ACL_SUCCESS) {
    int d_result = acl_delete_entry(acl, entry);
    if (d_result == ACL_ERROR) {
      perror("wipe_acls (acl_delete_entry)");
      result = ACL_ERROR;
      goto cleanup;
    }

    ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
  }

  /* Catches the first acl_get_entry as well as the ones at the end of
     the loop. */
  if (ge_result == ACL_ERROR) {
    perror("wipe_acls (acl_get_entry)");
    result = ACL_ERROR;
    goto cleanup;
  }

  int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
  if (sf_result == ACL_ERROR) {
    perror("wipe_acls (acl_set_file)");
    result = ACL_ERROR;
    goto cleanup;
  }

 cleanup:
  acl_free(acl);
  return result;
}



/**
 * @brief Apply parent default ACL to a path.
 *
 * This overwrites any existing ACLs on @c path.
 *
 * @param path
 *   The path whose ACL we would like to reset to its default.
 *
 * @param no_exec_mask
 *   The value (either true or false) of the --no-exec-mask flag.
 *
 * @return
 *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 *   - @c ACL_FAILURE - The target path is not a regular file/directory,
 *     or the parent of @c path is not a directory.
 *   - @c ACL_ERROR - Unexpected library error.
 */
int apply_default_acl(const char* path, bool no_exec_mask) {

  if (path == NULL) {
    errno = ENOENT;
    return ACL_ERROR;
  }

  if (!is_regular_file(path) && !is_directory(path)) {
    return ACL_FAILURE;
  }

  /* dirname mangles its argument */
  char path_copy[PATH_MAX];
  strncpy(path_copy, path, PATH_MAX-1);
  path_copy[PATH_MAX-1] = 0;

  char* parent = dirname(path_copy);
  if (!is_directory(parent)) {
    /* Make sure dirname() did what we think it did. */
    return ACL_FAILURE;
  }

  /* Default to not masking the exec bit; i.e. applying the default
     ACL literally. If --no-exec-mask was not specified, then we try
     to "guess" whether or not to mask the exec bit. */
  bool allow_exec = true;

  if (!no_exec_mask) {
    int ace_result = any_can_execute_or_dir(path);

    if (ace_result == ACL_ERROR) {
      perror("apply_default_acl (any_can_execute_or_dir)");
      return ACL_ERROR;
    }

    allow_exec = (bool)ace_result;
  }

  acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);

  if (defacl == (acl_t)NULL) {
    perror("apply_default_acl (acl_get_file)");
    return ACL_ERROR;
  }

  /* Our return value. */
  int result = ACL_SUCCESS;

  int wipe_result = wipe_acls(path);
  if (wipe_result == ACL_ERROR) {
    perror("apply_default_acl (wipe_acls)");
    result = ACL_ERROR;
    goto cleanup;
  }

  /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
     ACL with this one. */
  acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
  if (acl == (acl_t)NULL) {
    perror("apply_default_acl (acl_get_file)");
    return ACL_ERROR;
  }

  /* If it's a directory, inherit the parent's default. */
  int inherit_result = inherit_default_acl(path, parent);
  if (inherit_result == ACL_ERROR) {
    perror("apply_default_acl (inherit_acls)");
    result = ACL_ERROR;
    goto cleanup;
  }

  acl_entry_t entry;
  int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);

  while (ge_result == ACL_SUCCESS) {
    acl_tag_t tag = ACL_UNDEFINED_TAG;
    int tag_result = acl_get_tag_type(entry, &tag);

    if (tag_result == ACL_ERROR) {
       perror("apply_default_acl (acl_get_tag_type)");
       result = ACL_ERROR;
       goto cleanup;
    }


    /* We've got an entry/tag from the default ACL. Get its permset. */
    acl_permset_t permset;
    int ps_result = acl_get_permset(entry, &permset);
    if (ps_result == ACL_ERROR) {
      perror("apply_default_acl (acl_get_permset)");
      result = ACL_ERROR;
      goto cleanup;
    }

    /* If this is a default mask, fix it up. */
    if (tag == ACL_MASK ||
	tag == ACL_USER_OBJ ||
	tag == ACL_GROUP_OBJ ||
	tag == ACL_OTHER) {

      if (!allow_exec) {
	/* The mask doesn't affect acl_user_obj, acl_group_obj (in
	   minimal ACLs) or acl_other entries, so if execute should be
	   masked, we have to do it manually. */
	int d_result = acl_delete_perm(permset, ACL_EXECUTE);
	if (d_result == ACL_ERROR) {
	  perror("apply_default_acl (acl_delete_perm)");
	  result = ACL_ERROR;
	  goto cleanup;
	}

	int sp_result = acl_set_permset(entry, permset);
	if (sp_result == ACL_ERROR) {
	  perror("apply_default_acl (acl_set_permset)");
	  result = ACL_ERROR;
	  goto cleanup;
	}
      }
    }

    /* Finally, add the permset to the access ACL. */
    int set_result = acl_set_entry(&acl, entry);
    if (set_result == ACL_ERROR) {
      perror("apply_default_acl (acl_set_entry)");
      result = ACL_ERROR;
      goto cleanup;
    }

    ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
  }

  /* Catches the first acl_get_entry as well as the ones at the end of
     the loop. */
  if (ge_result == ACL_ERROR) {
    perror("apply_default_acl (acl_get_entry)");
    result = ACL_ERROR;
    goto cleanup;
  }

  int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
  if (sf_result == ACL_ERROR) {
    perror("apply_default_acl (acl_set_file)");
    result = ACL_ERROR;
    goto cleanup;
  }

 cleanup:
  acl_free(defacl);
  return result;
}



/**
 * @brief Display program usage information.
 *
 * @param program_name
 *   The program name to use in the output.
 *
 */
void usage(char* program_name) {
  printf("Apply any applicable default ACLs to the given files or "
	 "directories.\n\n");
  printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
	 program_name);
  printf("Flags:\n");
  printf(" -h, --help         Print this help message\n");
  printf(" -r, --recursive    Act on any given directories recursively\n");
  printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");

  return;
}


/**
 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 *
 * For parameter information, see the @c nftw man page.
 *
 * @return If the ACL was applied to @c target successfully, we return
 *   @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
 *   the next file or directory. Otherwise, we return @c FTW_STOP to
 *   signal failure.
 *
 */
int apply_default_acl_nftw(const char *target,
			   const struct stat *s,
			   int info,
			   struct FTW *ftw) {

  bool app_result = apply_default_acl(target, false);
  if (app_result) {
    return FTW_CONTINUE;
  }
  else {
    return FTW_STOP;
  }
}



/**
 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 *
 * This is identical to @c apply_default_acl_nftw(), except it passes
 * @c true to @c apply_default_acl() as its no_exec_mask argument.
 *
 */
int apply_default_acl_nftw_x(const char *target,
			     const struct stat *s,
			     int info,
			     struct FTW *ftw) {

  bool app_result = apply_default_acl(target, true);
  if (app_result) {
    return FTW_CONTINUE;
  }
  else {
    return FTW_STOP;
  }
}



/**
 * @brief Recursive version of @c apply_default_acl().
 *
 * If @c target is a directory, we use @c nftw() to call @c
 * apply_default_acl() recursively on all of its children. Otherwise,
 * we just delegate to @c apply_default_acl().
 *
 * We ignore symlinks for consistency with chmod -r.
 *
 * @param target
 *   The root (path) of the recursive application.
 *
 * @param no_exec_mask
 *   The value (either true or false) of the --no-exec-mask flag.
 *
 * @return
 *   If @c target is not a directory, we return the result of
 *   calling @c apply_default_acl() on @c target. Otherwise, we convert
 *   the return value of @c nftw(). If @c nftw() succeeds (returns 0),
 *   then we return @c true. Otherwise, we return @c false.
 *   \n\n
 *   If there is an error, it will be reported via @c perror, but
 *   we still return @c false.
 */
bool apply_default_acl_recursive(const char *target, bool no_exec_mask) {

  if (!is_directory(target)) {
    return apply_default_acl(target, no_exec_mask);
  }

  int max_levels = 256;
  int flags = FTW_PHYS; /* Don't follow links. */

  /* There are two separate functions that could be passed to
     nftw(). One passes no_exec_mask = true to apply_default_acl(),
     and the other passes no_exec_mask = false. Since the function we
     pass to nftw() cannot have parameters, we have to create separate
     options and make the decision here. */
  int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL;
  fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw;

  int nftw_result = nftw(target, fn, max_levels, flags);

  if (nftw_result == 0) {
    /* Success */
    return true;
  }

  /* nftw will return -1 on error, or if the supplied function
   * (apply_default_acl_nftw) returns a non-zero result, nftw will
   * return that.
   */
  if (nftw_result == -1) {
    perror("apply_default_acl_recursive (nftw)");
  }

  return false;
}



/**
 * @brief Call apply_default_acl (possibly recursively) on each
 * command-line argument.
 *
 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
 *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
 *   @c EXIT_FAILURE.
 */
int main(int argc, char* argv[]) {

  if (argc < 2) {
    usage(argv[0]);
    return EXIT_FAILURE;
  }

  bool recursive = false;
  bool no_exec_mask = false;

  struct option long_options[] = {
    /* These options set a flag. */
    {"help",      no_argument, NULL, 'h'},
    {"recursive", no_argument, NULL, 'r'},
    {"no-exec-mask", no_argument, NULL, 'x'},
    {NULL,        0,           NULL, 0}
  };

  int opt = 0;

  while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
    switch (opt) {
    case 'h':
      usage(argv[0]);
      return EXIT_SUCCESS;
    case 'r':
      recursive = true;
      break;
    case 'x':
      no_exec_mask = true;
      break;
    default:
      usage(argv[0]);
      return EXIT_FAILURE;
    }
  }

  int result = EXIT_SUCCESS;

  int arg_index = 1;
  for (arg_index = optind; arg_index < argc; arg_index++) {
    const char* target = argv[arg_index];
    bool reapp_result = false;

    if (recursive) {
      reapp_result = apply_default_acl_recursive(target, no_exec_mask);
    }
    else {
      /* It's either normal file, or we're not operating recursively. */
      reapp_result = apply_default_acl(target, no_exec_mask);
    }

    if (!reapp_result) {
      result = EXIT_FAILURE;
    }
  }

  return result;
}