2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Determine if the given file descriptor might refer to an
43 * The file descriptor whose link count we want to investigate.
45 * @return true if we are certain that @c fd does not describe a hard
46 * link, and false otherwise. In case of error, false is returned,
47 * because we are not sure that @c fd is not a hard link.
49 bool is_hardlink_safe(int fd
) {
54 if (fstat(fd
, &s
) == 0) {
55 return (s
.st_nlink
== 1 || S_ISDIR(s
.st_mode
));
64 * @brief Determine whether or not the given file descriptor is for
68 * The file descriptor to test for regular-fileness.
70 * @return true if @c fd describes a regular file, and false otherwise.
72 bool is_regular_file(int fd
) {
78 if (fstat(fd
, &s
) == 0) {
79 return S_ISREG(s
.st_mode
);
89 * @brief Determine whether or not the given path is accessible.
94 * @return true if @c path is accessible to the current effective
95 * user/group, false otherwise.
97 bool path_accessible(const char* path
) {
102 /* Test for access using the effective user and group rather than
104 int flags
= AT_EACCESS
;
106 /* Don't follow symlinks when checking for a path's existence,
107 since we won't follow them to set its ACLs either. */
108 flags
|= AT_SYMLINK_NOFOLLOW
;
110 /* If the path is relative, interpret it relative to the current
111 working directory (just like the access() system call). */
112 if (faccessat(AT_FDCWD
, path
, F_OK
, flags
) == 0) {
123 * @brief Determine whether or not the given path is a directory.
128 * @return true if @c path is a directory, false otherwise.
130 bool is_path_directory(const char* path
) {
136 if (lstat(path
, &s
) == 0) {
137 return S_ISDIR(s
.st_mode
);
146 * @brief Determine whether or not the given file descriptor is for
150 * The file descriptor whose directoryness is in question.
152 * @return true if @c fd describes a directory, and false otherwise.
154 bool is_directory(int fd
) {
160 if (fstat(fd
, &s
) == 0) {
161 return S_ISDIR(s
.st_mode
);
171 * @brief Update (or create) an entry in an @b minimal ACL.
173 * This function will not work if @c aclp contains extended
174 * entries. This is fine for our purposes, since we call @c wipe_acls
175 * on each path before applying the default to it.
177 * The assumption that there are no extended entries makes things much
178 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
179 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
180 * be created anew. This means we don't have to fool around comparing
181 * named-user/group entries.
184 * A pointer to the acl_t structure whose entry we want to modify.
187 * The new entry. If @c entry contains a user/group/other entry, we
188 * update the existing one. Otherwise we create a new entry.
190 * @return If there is an unexpected library error, @c ACL_ERROR is
191 * returned. Otherwise, @c ACL_SUCCESS.
194 int acl_set_entry(acl_t
* aclp
, acl_entry_t entry
) {
197 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
198 perror("acl_set_entry (acl_get_tag_type)");
202 acl_permset_t entry_permset
;
203 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
204 perror("acl_set_entry (acl_get_permset)");
208 acl_entry_t existing_entry
;
209 /* Loop through the given ACL looking for matching entries. */
210 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
212 while (result
== ACL_SUCCESS
) {
213 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
215 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
216 perror("set_acl_tag_permset (acl_get_tag_type)");
220 if (existing_tag
== entry_tag
) {
221 if (entry_tag
== ACL_USER_OBJ
||
222 entry_tag
== ACL_GROUP_OBJ
||
223 entry_tag
== ACL_OTHER
) {
224 /* Only update for these three since all other tags will have
225 been wiped. These three are guaranteed to exist, so if we
226 match one of them, we're allowed to return ACL_SUCCESS
227 below and bypass the rest of the function. */
228 acl_permset_t existing_permset
;
229 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
230 perror("acl_set_entry (acl_get_permset)");
234 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
235 perror("acl_set_entry (acl_set_permset)");
244 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
247 /* This catches both the initial acl_get_entry and the ones at the
249 if (result
== ACL_ERROR
) {
250 perror("acl_set_entry (acl_get_entry)");
254 /* If we've made it this far, we need to add a new entry to the
256 acl_entry_t new_entry
;
258 /* The acl_create_entry() function can allocate new memory and/or
259 * change the location of the ACL structure entirely. When that
260 * happens, the value pointed to by aclp is updated, which means
261 * that a new acl_t gets "passed out" to our caller, eventually to
262 * be fed to acl_free(). In other words, we should still be freeing
263 * the right thing, even if the value pointed to by aclp changes.
265 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
266 perror("acl_set_entry (acl_create_entry)");
270 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
271 perror("acl_set_entry (acl_set_tag_type)");
275 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
276 perror("acl_set_entry (acl_set_permset)");
280 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
281 /* We need to set the qualifier too. */
282 void* entry_qual
= acl_get_qualifier(entry
);
283 if (entry_qual
== (void*)NULL
) {
284 perror("acl_set_entry (acl_get_qualifier)");
288 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
289 perror("acl_set_entry (acl_set_qualifier)");
300 * @brief Determine the number of entries in the given ACL.
303 * The ACL to inspect.
305 * @return Either the non-negative number of entries in @c acl, or
306 * @c ACL_ERROR on error.
308 int acl_entry_count(acl_t acl
) {
312 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
314 while (result
== ACL_SUCCESS
) {
316 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
319 if (result
== ACL_ERROR
) {
320 perror("acl_entry_count (acl_get_entry)");
330 * @brief Determine whether or not the given ACL is minimal.
332 * An ACL is minimal if it has fewer than four entries.
335 * The ACL whose minimality is in question.
338 * - @c ACL_SUCCESS - @c acl is minimal
339 * - @c ACL_FAILURE - @c acl is not minimal
340 * - @c ACL_ERROR - Unexpected library error
342 int acl_is_minimal(acl_t acl
) {
344 int ec
= acl_entry_count(acl
);
346 if (ec
== ACL_ERROR
) {
347 perror("acl_is_minimal (acl_entry_count)");
362 * @brief Determine whether the given ACL's mask denies execute.
365 * The ACL whose mask we want to check.
368 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
369 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
370 * - @c ACL_ERROR - Unexpected library error.
372 int acl_execute_masked(acl_t acl
) {
375 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
377 while (ge_result
== ACL_SUCCESS
) {
378 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
380 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
381 perror("acl_execute_masked (acl_get_tag_type)");
385 if (tag
== ACL_MASK
) {
386 /* This is the mask entry, get its permissions, and see if
387 execute is specified. */
388 acl_permset_t permset
;
390 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
391 perror("acl_execute_masked (acl_get_permset)");
395 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
396 if (gp_result
== ACL_ERROR
) {
397 perror("acl_execute_masked (acl_get_perm)");
401 if (gp_result
== ACL_FAILURE
) {
402 /* No execute bit set in the mask; execute not allowed. */
407 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
416 * @brief Determine whether @c fd is executable (by anyone) or a
419 * This is used as part of the heuristic to determine whether or not
420 * we should mask the execute bit when inheriting an ACL. If @c fd
421 * describes a directory, the answer is a clear-cut yes. This behavior
422 * is modeled after the capital 'X' perms of setfacl.
424 * If @c fd describes a file, we check the @a effective permissions,
425 * contrary to what setfacl does.
428 * The file descriptor to check.
431 * - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective
433 * - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute
435 * - @c ACL_ERROR - Unexpected library error.
437 int any_can_execute_or_dir(int fd
) {
439 if (is_directory(fd
)) {
440 /* That was easy... */
444 acl_t acl
= acl_get_fd(fd
);
446 if (acl
== (acl_t
)NULL
) {
447 perror("any_can_execute_or_dir (acl_get_file)");
451 /* Our return value. */
452 int result
= ACL_FAILURE
;
454 if (acl_is_minimal(acl
)) {
456 if (fstat(fd
, &s
) == -1) {
457 perror("any_can_execute_or_dir (fstat)");
461 if (s
.st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
462 result
= ACL_SUCCESS
;
466 result
= ACL_FAILURE
;
472 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
474 while (ge_result
== ACL_SUCCESS
) {
475 /* The first thing we do is check to see if this is a mask
476 entry. If it is, we skip it entirely. */
477 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
479 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
480 perror("any_can_execute_or_dir (acl_get_tag_type)");
485 if (tag
== ACL_MASK
) {
486 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
490 /* Ok, so it's not a mask entry. Check the execute perms. */
491 acl_permset_t permset
;
493 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
494 perror("any_can_execute_or_dir (acl_get_permset)");
499 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
500 if (gp_result
== ACL_ERROR
) {
501 perror("any_can_execute_or_dir (acl_get_perm)");
506 if (gp_result
== ACL_SUCCESS
) {
507 /* Only return ACL_SUCCESS if this execute bit is not masked. */
508 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
509 result
= ACL_SUCCESS
;
514 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
517 if (ge_result
== ACL_ERROR
) {
518 perror("any_can_execute_or_dir (acl_get_entry)");
531 * @brief Set @c acl as the default ACL on @c path if it's a directory.
533 * This overwrites any existing default ACL on @c path. If no default
534 * ACL exists, then one is created. If @c path is not a directory, we
535 * return ACL_FAILURE but no error is raised.
538 * The target directory whose ACL we wish to replace or create.
541 * The ACL to set as default on @c path.
544 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
545 * - @c ACL_FAILURE - If @c path is not a directory.
546 * - @c ACL_ERROR - Unexpected library error.
548 int assign_default_acl(const char* path
, acl_t acl
) {
555 if (!is_path_directory(path
)) {
559 /* Our return value; success unless something bad happens. */
560 int result
= ACL_SUCCESS
;
561 acl_t path_acl
= acl_dup(acl
);
563 if (path_acl
== (acl_t
)NULL
) {
564 perror("assign_default_acl (acl_dup)");
565 return ACL_ERROR
; /* Nothing to clean up in this case. */
568 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
569 perror("assign_default_acl (acl_set_file)");
580 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
581 * descriptor, leaving the UNIX permission bits.
584 * The file descriptor whose ACLs we want to wipe.
587 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
588 * existed in the first place.
589 * - @c ACL_ERROR - Unexpected library error.
591 int wipe_acls(int fd
) {
592 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
593 acl_t empty_acl
= acl_init(0);
595 if (empty_acl
== (acl_t
)NULL
) {
596 perror("wipe_acls (acl_init)");
600 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
601 perror("wipe_acls (acl_set_fd)");
613 * @brief Apply parent default ACL to a path.
615 * This overwrites any existing ACLs on @c path.
618 * The path whose ACL we would like to reset to its default.
620 * @param no_exec_mask
621 * The value (either true or false) of the --no-exec-mask flag.
624 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
625 * - @c ACL_FAILURE - The target path is not a regular file/directory,
626 * or the parent of @c path is not a directory.
627 * - @c ACL_ERROR - Unexpected library error.
629 int apply_default_acl(const char* path
, bool no_exec_mask
) {
633 perror("apply_default_acl (args)");
637 /* Define these next three variables here because we may have to
638 * jump to the cleanup routine which expects them to exist.
641 /* Our return value. */
642 int result
= ACL_SUCCESS
;
644 /* The default ACL on path's parent directory */
645 acl_t defacl
= (acl_t
)NULL
;
647 /* The file descriptor corresponding to "path" */
650 /* Split "path" into base/dirname parts to be used with openat().
651 * We duplicate the strings involved because dirname/basename mangle
654 char* path_copy
= strdup(path
);
655 if (path_copy
== NULL
) {
656 perror("apply_default_acl (strdup)");
659 char* parent
= dirname(path_copy
);
661 fd
= open(path
, O_NOFOLLOW
);
663 if (errno
== ELOOP
) {
664 result
= ACL_FAILURE
; /* hit a symlink */
668 perror("apply_default_acl (open fd)");
675 /* Refuse to operate on hard links, which can be abused by an
676 * attacker to trick us into changing the ACL on a file we didn't
677 * intend to; namely the "target" of the hard link. There is TOCTOU
678 * race condition here, but the window is as small as possible
679 * between when we open the file descriptor (look above) and when we
682 if (!is_hardlink_safe(fd
)) {
683 result
= ACL_FAILURE
;
687 if (!is_regular_file(fd
) && !is_directory(fd
)) {
688 result
= ACL_FAILURE
;
692 /* Default to not masking the exec bit; i.e. applying the default
693 ACL literally. If --no-exec-mask was not specified, then we try
694 to "guess" whether or not to mask the exec bit. */
695 bool allow_exec
= true;
698 int ace_result
= any_can_execute_or_dir(fd
);
700 if (ace_result
== ACL_ERROR
) {
701 perror("apply_default_acl (any_can_execute_or_dir)");
706 allow_exec
= (bool)ace_result
;
709 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
711 if (defacl
== (acl_t
)NULL
) {
712 perror("apply_default_acl (acl_get_file)");
717 if (wipe_acls(fd
) == ACL_ERROR
) {
718 perror("apply_default_acl (wipe_acls)");
723 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
724 ACL with this one. */
725 acl_t acl
= acl_get_fd(fd
);
726 if (acl
== (acl_t
)NULL
) {
727 perror("apply_default_acl (acl_get_fd)");
732 /* If it's a directory, inherit the parent's default. */
733 if (assign_default_acl(path
, defacl
) == ACL_ERROR
) {
734 perror("apply_default_acl (assign_default_acl)");
740 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
742 while (ge_result
== ACL_SUCCESS
) {
743 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
745 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
746 perror("apply_default_acl (acl_get_tag_type)");
752 /* We've got an entry/tag from the default ACL. Get its permset. */
753 acl_permset_t permset
;
754 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
755 perror("apply_default_acl (acl_get_permset)");
760 /* If this is a default mask, fix it up. */
761 if (tag
== ACL_MASK
||
762 tag
== ACL_USER_OBJ
||
763 tag
== ACL_GROUP_OBJ
||
767 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
768 minimal ACLs) or acl_other entries, so if execute should be
769 masked, we have to do it manually. */
770 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
771 perror("apply_default_acl (acl_delete_perm)");
776 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
777 perror("apply_default_acl (acl_set_permset)");
784 /* Finally, add the permset to the access ACL. It's actually
785 * important that we pass in the address of "acl" here, and not
786 * "acl" itself. Why? The call to acl_create_entry() within
787 * acl_set_entry() can allocate new memory for the entry.
788 * Sometimes that can be done in-place, in which case everything
789 * is cool and the new memory gets released when we call
792 * But occasionally, the whole ACL structure will have to be moved
793 * in order to allocate the extra space. When that happens,
794 * acl_create_entry() modifies the pointer it was passed (in this
795 * case, &acl) to point to the new location. We want to call
796 * acl_free() on the new location, and since acl_free() gets
797 * called right here, we need acl_create_entry() to update the
798 * value of "acl". To do that, it needs the address of "acl".
800 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
801 perror("apply_default_acl (acl_set_entry)");
806 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
809 /* Catches the first acl_get_entry as well as the ones at the end of
811 if (ge_result
== ACL_ERROR
) {
812 perror("apply_default_acl (acl_get_entry)");
817 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
818 perror("apply_default_acl (acl_set_fd)");
825 if (defacl
!= (acl_t
)NULL
) {
828 if (fd
>= 0 && close(fd
) == -1) {
829 perror("apply_default_acl (close)");
838 * @brief Display program usage information.
840 * @param program_name
841 * The program name to use in the output.
844 void usage(const char* program_name
) {
845 printf("Apply any applicable default ACLs to the given files or "
847 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
850 printf(" -h, --help Print this help message\n");
851 printf(" -r, --recursive Act on any given directories recursively\n");
852 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
859 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
861 * For parameter information, see the @c nftw man page.
863 * @return If the ACL was applied to @c target successfully, we return
864 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
865 * the next file or directory. Otherwise, we return @c FTW_STOP to
869 int apply_default_acl_nftw(const char *target
,
870 const struct stat
*s
,
874 if (apply_default_acl(target
, false)) {
885 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
887 * This is identical to @c apply_default_acl_nftw(), except it passes
888 * @c true to @c apply_default_acl() as its no_exec_mask argument.
891 int apply_default_acl_nftw_x(const char *target
,
892 const struct stat
*s
,
896 if (apply_default_acl(target
, true)) {
907 * @brief Recursive version of @c apply_default_acl().
909 * If @c target is a directory, we use @c nftw() to call @c
910 * apply_default_acl() recursively on all of its children. Otherwise,
911 * we just delegate to @c apply_default_acl().
913 * We ignore symlinks for consistency with chmod -r.
916 * The root (path) of the recursive application.
918 * @param no_exec_mask
919 * The value (either true or false) of the --no-exec-mask flag.
922 * If @c target is not a directory, we return the result of
923 * calling @c apply_default_acl() on @c target. Otherwise, we convert
924 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
925 * then we return @c true. Otherwise, we return @c false.
927 * If there is an error, it will be reported via @c perror, but
928 * we still return @c false.
930 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
932 if (!is_path_directory(target
)) {
933 return apply_default_acl(target
, no_exec_mask
);
936 int max_levels
= 256;
937 int flags
= FTW_PHYS
; /* Don't follow links. */
939 /* There are two separate functions that could be passed to
940 nftw(). One passes no_exec_mask = true to apply_default_acl(),
941 and the other passes no_exec_mask = false. Since the function we
942 pass to nftw() cannot have parameters, we have to create separate
943 options and make the decision here. */
944 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
945 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
947 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
949 if (nftw_result
== 0) {
954 /* nftw will return -1 on error, or if the supplied function
955 * (apply_default_acl_nftw) returns a non-zero result, nftw will
958 if (nftw_result
== -1) {
959 perror("apply_default_acl_recursive (nftw)");
968 * @brief Call apply_default_acl (possibly recursively) on each
969 * command-line argument.
971 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
972 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
975 int main(int argc
, char* argv
[]) {
982 bool recursive
= false;
983 bool no_exec_mask
= false;
985 struct option long_options
[] = {
986 /* These options set a flag. */
987 {"help", no_argument
, NULL
, 'h'},
988 {"recursive", no_argument
, NULL
, 'r'},
989 {"no-exec-mask", no_argument
, NULL
, 'x'},
995 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
1004 no_exec_mask
= true;
1008 return EXIT_FAILURE
;
1012 int result
= EXIT_SUCCESS
;
1015 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
1016 const char* target
= argv
[arg_index
];
1017 bool reapp_result
= false;
1019 /* Make sure we can access the given path before we go out of our
1020 * way to please it. Doing this check outside of
1021 * apply_default_acl() lets us spit out a better error message for
1024 if (!path_accessible(target
)) {
1025 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
1026 result
= EXIT_FAILURE
;
1031 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
1034 /* It's either a normal file, or we're not operating recursively. */
1035 reapp_result
= apply_default_acl(target
, no_exec_mask
);
1038 if (!reapp_result
) {
1039 result
= EXIT_FAILURE
;