2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
38 * @brief Get the mode bits from the given file descriptor.
41 * The file descriptor (which may reference a directory) whose
44 * @return A mode_t (st_mode) structure containing the mode bits.
45 * See sys/stat.h for details.
47 mode_t
get_mode(int fd
) {
54 int result
= fstat(fd
, &s
);
60 /* errno will be set already by lstat() */
68 * @brief Determine if the given file descriptor might refer to an
72 * The file descriptor whose link count we want to investigate.
74 * @return true if we are certain that @c fd does not describe a hard
75 * link, and false otherwise. In case of error, false is returned,
76 * because we are not sure that @c fd is not a hard link.
78 bool is_hardlink_safe(int fd
) {
83 int result
= fstat(fd
, &s
);
85 return (s
.st_nlink
== 1 || S_ISDIR(s
.st_mode
));
94 * @brief Determine whether or not the given file descriptor is for
98 * The file descriptor to test for regular-fileness.
100 * @return true if @c fd describes a regular file, and false otherwise.
102 bool is_regular_file(int fd
) {
108 int result
= fstat(fd
, &s
);
110 return S_ISREG(s
.st_mode
);
120 * @brief Determine whether or not the given path is accessible.
125 * @return true if @c path is accessible to the current effective
126 * user/group, false otherwise.
128 bool path_accessible(const char* path
) {
133 /* Test for access using the effective user and group rather than
135 int flags
= AT_EACCESS
;
137 /* Don't follow symlinks when checking for a path's existence,
138 since we won't follow them to set its ACLs either. */
139 flags
|= AT_SYMLINK_NOFOLLOW
;
141 /* If the path is relative, interpret it relative to the current
142 working directory (just like the access() system call). */
143 int result
= faccessat(AT_FDCWD
, path
, F_OK
, flags
);
156 * @brief Determine whether or not the given path is a directory.
161 * @return true if @c path is a directory, false otherwise.
163 bool is_path_directory(const char* path
) {
169 int result
= lstat(path
, &s
);
171 return S_ISDIR(s
.st_mode
);
180 * @brief Determine whether or not the given file descriptor is for
184 * The file descriptor whose directoryness is in question.
186 * @return true if @c fd describes a directory, and false otherwise.
188 bool is_directory(int fd
) {
194 int result
= fstat(fd
, &s
);
196 return S_ISDIR(s
.st_mode
);
206 * @brief Update (or create) an entry in an @b minimal ACL.
208 * This function will not work if @c aclp contains extended
209 * entries. This is fine for our purposes, since we call @c wipe_acls
210 * on each path before applying the default to it.
212 * The assumption that there are no extended entries makes things much
213 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
214 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
215 * be created anew. This means we don't have to fool around comparing
216 * named-user/group entries.
219 * A pointer to the acl_t structure whose entry we want to modify.
222 * The new entry. If @c entry contains a user/group/other entry, we
223 * update the existing one. Otherwise we create a new entry.
225 * @return If there is an unexpected library error, @c ACL_ERROR is
226 * returned. Otherwise, @c ACL_SUCCESS.
229 int acl_set_entry(acl_t
* aclp
,
233 int gt_result
= acl_get_tag_type(entry
, &entry_tag
);
234 if (gt_result
== ACL_ERROR
) {
235 perror("acl_set_entry (acl_get_tag_type)");
239 acl_permset_t entry_permset
;
240 int ps_result
= acl_get_permset(entry
, &entry_permset
);
241 if (ps_result
== ACL_ERROR
) {
242 perror("acl_set_entry (acl_get_permset)");
246 acl_entry_t existing_entry
;
247 /* Loop through the given ACL looking for matching entries. */
248 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
250 while (result
== ACL_SUCCESS
) {
251 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
252 int tag_result
= acl_get_tag_type(existing_entry
, &existing_tag
);
254 if (tag_result
== ACL_ERROR
) {
255 perror("set_acl_tag_permset (acl_get_tag_type)");
259 if (existing_tag
== entry_tag
) {
260 if (entry_tag
== ACL_USER_OBJ
||
261 entry_tag
== ACL_GROUP_OBJ
||
262 entry_tag
== ACL_OTHER
) {
263 /* Only update for these three since all other tags will have
264 been wiped. These three are guaranteed to exist, so if we
265 match one of them, we're allowed to return ACL_SUCCESS
266 below and bypass the rest of the function. */
267 acl_permset_t existing_permset
;
268 int gep_result
= acl_get_permset(existing_entry
, &existing_permset
);
269 if (gep_result
== ACL_ERROR
) {
270 perror("acl_set_entry (acl_get_permset)");
274 int s_result
= acl_set_permset(existing_entry
, entry_permset
);
275 if (s_result
== ACL_ERROR
) {
276 perror("acl_set_entry (acl_set_permset)");
285 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
288 /* This catches both the initial acl_get_entry and the ones at the
290 if (result
== ACL_ERROR
) {
291 perror("acl_set_entry (acl_get_entry)");
295 /* If we've made it this far, we need to add a new entry to the
297 acl_entry_t new_entry
;
299 /* The acl_create_entry() function can allocate new memory and/or
300 * change the location of the ACL structure entirely. When that
301 * happens, the value pointed to by aclp is updated, which means
302 * that a new acl_t gets "passed out" to our caller, eventually to
303 * be fed to acl_free(). In other words, we should still be freeing
304 * the right thing, even if the value pointed to by aclp changes.
306 int c_result
= acl_create_entry(aclp
, &new_entry
);
307 if (c_result
== ACL_ERROR
) {
308 perror("acl_set_entry (acl_create_entry)");
312 int st_result
= acl_set_tag_type(new_entry
, entry_tag
);
313 if (st_result
== ACL_ERROR
) {
314 perror("acl_set_entry (acl_set_tag_type)");
318 int s_result
= acl_set_permset(new_entry
, entry_permset
);
319 if (s_result
== ACL_ERROR
) {
320 perror("acl_set_entry (acl_set_permset)");
324 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
325 /* We need to set the qualifier too. */
326 void* entry_qual
= acl_get_qualifier(entry
);
327 if (entry_qual
== (void*)NULL
) {
328 perror("acl_set_entry (acl_get_qualifier)");
332 int sq_result
= acl_set_qualifier(new_entry
, entry_qual
);
333 if (sq_result
== ACL_ERROR
) {
334 perror("acl_set_entry (acl_set_qualifier)");
345 * @brief Determine the number of entries in the given ACL.
348 * The ACL to inspect.
350 * @return Either the non-negative number of entries in @c acl, or
351 * @c ACL_ERROR on error.
353 int acl_entry_count(acl_t acl
) {
357 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
359 while (result
== ACL_SUCCESS
) {
361 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
364 if (result
== ACL_ERROR
) {
365 perror("acl_entry_count (acl_get_entry)");
375 * @brief Determine whether or not the given ACL is minimal.
377 * An ACL is minimal if it has fewer than four entries.
380 * The ACL whose minimality is in question.
383 * - @c ACL_SUCCESS - @c acl is minimal
384 * - @c ACL_FAILURE - @c acl is not minimal
385 * - @c ACL_ERROR - Unexpected library error
387 int acl_is_minimal(acl_t acl
) {
389 int ec
= acl_entry_count(acl
);
391 if (ec
== ACL_ERROR
) {
392 perror("acl_is_minimal (acl_entry_count)");
407 * @brief Determine whether the given ACL's mask denies execute.
410 * The ACL whose mask we want to check.
413 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
414 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
415 * - @c ACL_ERROR - Unexpected library error.
417 int acl_execute_masked(acl_t acl
) {
420 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
422 while (ge_result
== ACL_SUCCESS
) {
423 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
424 int tag_result
= acl_get_tag_type(entry
, &tag
);
426 if (tag_result
== ACL_ERROR
) {
427 perror("acl_execute_masked (acl_get_tag_type)");
431 if (tag
== ACL_MASK
) {
432 /* This is the mask entry, get its permissions, and see if
433 execute is specified. */
434 acl_permset_t permset
;
436 int ps_result
= acl_get_permset(entry
, &permset
);
437 if (ps_result
== ACL_ERROR
) {
438 perror("acl_execute_masked (acl_get_permset)");
442 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
443 if (gp_result
== ACL_ERROR
) {
444 perror("acl_execute_masked (acl_get_perm)");
448 if (gp_result
== ACL_FAILURE
) {
449 /* No execute bit set in the mask; execute not allowed. */
454 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
463 * @brief Determine whether @c fd is executable (by anyone) or a
466 * This is used as part of the heuristic to determine whether or not
467 * we should mask the execute bit when inheriting an ACL. If @c fd
468 * describes a directory, the answer is a clear-cut yes. This behavior
469 * is modeled after the capital 'X' perms of setfacl.
471 * If @c fd describes a file, we check the @a effective permissions,
472 * contrary to what setfacl does.
475 * The file descriptor to check.
478 * - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective
480 * - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute
482 * - @c ACL_ERROR - Unexpected library error.
484 int any_can_execute_or_dir(int fd
) {
486 if (is_directory(fd
)) {
487 /* That was easy... */
491 acl_t acl
= acl_get_fd(fd
);
493 if (acl
== (acl_t
)NULL
) {
494 perror("any_can_execute_or_dir (acl_get_file)");
498 /* Our return value. */
499 int result
= ACL_FAILURE
;
501 if (acl_is_minimal(acl
)) {
502 mode_t mode
= get_mode(fd
);
503 if (mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
504 result
= ACL_SUCCESS
;
508 result
= ACL_FAILURE
;
514 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
516 while (ge_result
== ACL_SUCCESS
) {
517 /* The first thing we do is check to see if this is a mask
518 entry. If it is, we skip it entirely. */
519 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
520 int tag_result
= acl_get_tag_type(entry
, &tag
);
522 if (tag_result
== ACL_ERROR
) {
523 perror("any_can_execute_or_dir (acl_get_tag_type)");
528 if (tag
== ACL_MASK
) {
529 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
533 /* Ok, so it's not a mask entry. Check the execute perms. */
534 acl_permset_t permset
;
536 int ps_result
= acl_get_permset(entry
, &permset
);
537 if (ps_result
== ACL_ERROR
) {
538 perror("any_can_execute_or_dir (acl_get_permset)");
543 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
544 if (gp_result
== ACL_ERROR
) {
545 perror("any_can_execute_or_dir (acl_get_perm)");
550 if (gp_result
== ACL_SUCCESS
) {
551 /* Only return ACL_SUCCESS if this execute bit is not masked. */
552 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
553 result
= ACL_SUCCESS
;
558 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
561 if (ge_result
== ACL_ERROR
) {
562 perror("any_can_execute_or_dir (acl_get_entry)");
575 * @brief Set @c acl as the default ACL on @c path if it's a directory.
577 * This overwrites any existing default ACL on @c path. If no default
578 * ACL exists, then one is created. If @c path is not a directory, we
579 * return ACL_FAILURE but no error is raised.
582 * The target directory whose ACL we wish to replace or create.
585 * The ACL to set as default on @c path.
588 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
589 * - @c ACL_FAILURE - If @c path is not a directory.
590 * - @c ACL_ERROR - Unexpected library error.
592 int assign_default_acl(const char* path
, acl_t acl
) {
599 if (!is_path_directory(path
)) {
603 /* Our return value; success unless something bad happens. */
604 int result
= ACL_SUCCESS
;
605 acl_t path_acl
= acl_dup(acl
);
607 if (path_acl
== (acl_t
)NULL
) {
608 perror("assign_default_acl (acl_dup)");
609 return ACL_ERROR
; /* Nothing to clean up in this case. */
612 int sf_result
= acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
);
613 if (sf_result
== ACL_ERROR
) {
614 perror("assign_default_acl (acl_set_file)");
625 * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
626 * from the given file descriptor.
629 * The file descriptor whose ACLs we want to wipe.
632 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
633 * existed in the first place.
634 * - @c ACL_ERROR - Unexpected library error.
636 int wipe_acls(int fd
) {
643 acl_t acl
= acl_get_fd(fd
);
644 if (acl
== (acl_t
)NULL
) {
645 perror("wipe_acls (acl_get_fd)");
649 /* Our return value. */
650 int result
= ACL_SUCCESS
;
653 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
655 while (ge_result
== ACL_SUCCESS
) {
656 int d_result
= acl_delete_entry(acl
, entry
);
657 if (d_result
== ACL_ERROR
) {
658 perror("wipe_acls (acl_delete_entry)");
663 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
666 /* Catches the first acl_get_entry as well as the ones at the end of
668 if (ge_result
== ACL_ERROR
) {
669 perror("wipe_acls (acl_get_entry)");
674 int sf_result
= acl_set_fd(fd
, acl
);
675 if (sf_result
== ACL_ERROR
) {
676 perror("wipe_acls (acl_set_fd)");
689 * @brief Apply parent default ACL to a path.
691 * This overwrites any existing ACLs on @c path.
694 * The path whose ACL we would like to reset to its default.
696 * @param no_exec_mask
697 * The value (either true or false) of the --no-exec-mask flag.
700 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
701 * - @c ACL_FAILURE - The target path is not a regular file/directory,
702 * or the parent of @c path is not a directory.
703 * - @c ACL_ERROR - Unexpected library error.
705 int apply_default_acl(const char* path
, bool no_exec_mask
) {
712 /* Define these next three variables here because we may have to
713 * jump to the cleanup routine which expects them to exist.
716 /* Our return value. */
717 int result
= ACL_SUCCESS
;
719 /* The default ACL on path's parent directory */
720 acl_t defacl
= (acl_t
)NULL
;
722 /* The file descriptor corresponding to "path" */
725 /* Split "path" into base/dirname parts to be used with openat().
726 * We duplicate the strings involved because dirname/basename mangle
729 char* path_copy
= strdup(path
);
730 if (path_copy
== NULL
) {
731 perror("apply_default_acl (strdup)");
734 char* parent
= dirname(path_copy
);
736 fd
= open(path
, O_NOFOLLOW
);
738 if (errno
== ELOOP
) {
739 result
= ACL_FAILURE
; /* hit a symlink */
743 perror("apply_default_acl (open fd)");
750 /* Refuse to operate on hard links, which can be abused by an
751 * attacker to trick us into changing the ACL on a file we didn't
752 * intend to; namely the "target" of the hard link. There is TOCTOU
753 * race condition here, but the window is as small as possible
754 * between when we open the file descriptor (look above) and when we
757 if (!is_hardlink_safe(fd
)) {
758 result
= ACL_FAILURE
;
762 if (!is_regular_file(fd
) && !is_directory(fd
)) {
763 result
= ACL_FAILURE
;
767 /* Default to not masking the exec bit; i.e. applying the default
768 ACL literally. If --no-exec-mask was not specified, then we try
769 to "guess" whether or not to mask the exec bit. */
770 bool allow_exec
= true;
773 int ace_result
= any_can_execute_or_dir(fd
);
775 if (ace_result
== ACL_ERROR
) {
776 perror("apply_default_acl (any_can_execute_or_dir)");
781 allow_exec
= (bool)ace_result
;
784 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
786 if (defacl
== (acl_t
)NULL
) {
787 perror("apply_default_acl (acl_get_file)");
792 int wipe_result
= wipe_acls(fd
);
793 if (wipe_result
== ACL_ERROR
) {
794 perror("apply_default_acl (wipe_acls)");
799 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
800 ACL with this one. */
801 acl_t acl
= acl_get_fd(fd
);
802 if (acl
== (acl_t
)NULL
) {
803 perror("apply_default_acl (acl_get_fd)");
808 /* If it's a directory, inherit the parent's default. */
809 int inherit_result
= assign_default_acl(path
, defacl
);
810 if (inherit_result
== ACL_ERROR
) {
811 perror("apply_default_acl (assign_default_acl)");
817 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
819 while (ge_result
== ACL_SUCCESS
) {
820 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
821 int tag_result
= acl_get_tag_type(entry
, &tag
);
823 if (tag_result
== ACL_ERROR
) {
824 perror("apply_default_acl (acl_get_tag_type)");
830 /* We've got an entry/tag from the default ACL. Get its permset. */
831 acl_permset_t permset
;
832 int ps_result
= acl_get_permset(entry
, &permset
);
833 if (ps_result
== ACL_ERROR
) {
834 perror("apply_default_acl (acl_get_permset)");
839 /* If this is a default mask, fix it up. */
840 if (tag
== ACL_MASK
||
841 tag
== ACL_USER_OBJ
||
842 tag
== ACL_GROUP_OBJ
||
846 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
847 minimal ACLs) or acl_other entries, so if execute should be
848 masked, we have to do it manually. */
849 int d_result
= acl_delete_perm(permset
, ACL_EXECUTE
);
850 if (d_result
== ACL_ERROR
) {
851 perror("apply_default_acl (acl_delete_perm)");
856 int sp_result
= acl_set_permset(entry
, permset
);
857 if (sp_result
== ACL_ERROR
) {
858 perror("apply_default_acl (acl_set_permset)");
865 /* Finally, add the permset to the access ACL. It's actually
866 * important that we pass in the address of "acl" here, and not
867 * "acl" itself. Why? The call to acl_create_entry() within
868 * acl_set_entry() can allocate new memory for the entry.
869 * Sometimes that can be done in-place, in which case everything
870 * is cool and the new memory gets released when we call
873 * But occasionally, the whole ACL structure will have to be moved
874 * in order to allocate the extra space. When that happens,
875 * acl_create_entry() modifies the pointer it was passed (in this
876 * case, &acl) to point to the new location. We want to call
877 * acl_free() on the new location, and since acl_free() gets
878 * called right here, we need acl_create_entry() to update the
879 * value of "acl". To do that, it needs the address of "acl".
881 int set_result
= acl_set_entry(&acl
, entry
);
882 if (set_result
== ACL_ERROR
) {
883 perror("apply_default_acl (acl_set_entry)");
888 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
891 /* Catches the first acl_get_entry as well as the ones at the end of
893 if (ge_result
== ACL_ERROR
) {
894 perror("apply_default_acl (acl_get_entry)");
899 int sf_result
= acl_set_fd(fd
, acl
);
900 if (sf_result
== ACL_ERROR
) {
901 perror("apply_default_acl (acl_set_fd)");
908 if (defacl
!= (acl_t
)NULL
) {
911 if (fd
>= 0 && close(fd
) == -1) {
912 perror("apply_default_acl (close)");
921 * @brief Display program usage information.
923 * @param program_name
924 * The program name to use in the output.
927 void usage(const char* program_name
) {
928 printf("Apply any applicable default ACLs to the given files or "
930 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
933 printf(" -h, --help Print this help message\n");
934 printf(" -r, --recursive Act on any given directories recursively\n");
935 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
942 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
944 * For parameter information, see the @c nftw man page.
946 * @return If the ACL was applied to @c target successfully, we return
947 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
948 * the next file or directory. Otherwise, we return @c FTW_STOP to
952 int apply_default_acl_nftw(const char *target
,
953 const struct stat
*s
,
957 bool app_result
= apply_default_acl(target
, false);
969 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
971 * This is identical to @c apply_default_acl_nftw(), except it passes
972 * @c true to @c apply_default_acl() as its no_exec_mask argument.
975 int apply_default_acl_nftw_x(const char *target
,
976 const struct stat
*s
,
980 bool app_result
= apply_default_acl(target
, true);
992 * @brief Recursive version of @c apply_default_acl().
994 * If @c target is a directory, we use @c nftw() to call @c
995 * apply_default_acl() recursively on all of its children. Otherwise,
996 * we just delegate to @c apply_default_acl().
998 * We ignore symlinks for consistency with chmod -r.
1001 * The root (path) of the recursive application.
1003 * @param no_exec_mask
1004 * The value (either true or false) of the --no-exec-mask flag.
1007 * If @c target is not a directory, we return the result of
1008 * calling @c apply_default_acl() on @c target. Otherwise, we convert
1009 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
1010 * then we return @c true. Otherwise, we return @c false.
1012 * If there is an error, it will be reported via @c perror, but
1013 * we still return @c false.
1015 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
1017 if (!is_path_directory(target
)) {
1018 return apply_default_acl(target
, no_exec_mask
);
1021 int max_levels
= 256;
1022 int flags
= FTW_PHYS
; /* Don't follow links. */
1024 /* There are two separate functions that could be passed to
1025 nftw(). One passes no_exec_mask = true to apply_default_acl(),
1026 and the other passes no_exec_mask = false. Since the function we
1027 pass to nftw() cannot have parameters, we have to create separate
1028 options and make the decision here. */
1029 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
1030 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
1032 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
1034 if (nftw_result
== 0) {
1039 /* nftw will return -1 on error, or if the supplied function
1040 * (apply_default_acl_nftw) returns a non-zero result, nftw will
1043 if (nftw_result
== -1) {
1044 perror("apply_default_acl_recursive (nftw)");
1053 * @brief Call apply_default_acl (possibly recursively) on each
1054 * command-line argument.
1056 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
1057 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
1060 int main(int argc
, char* argv
[]) {
1064 return EXIT_FAILURE
;
1067 bool recursive
= false;
1068 bool no_exec_mask
= false;
1070 struct option long_options
[] = {
1071 /* These options set a flag. */
1072 {"help", no_argument
, NULL
, 'h'},
1073 {"recursive", no_argument
, NULL
, 'r'},
1074 {"no-exec-mask", no_argument
, NULL
, 'x'},
1080 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
1084 return EXIT_SUCCESS
;
1089 no_exec_mask
= true;
1093 return EXIT_FAILURE
;
1097 int result
= EXIT_SUCCESS
;
1100 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
1101 const char* target
= argv
[arg_index
];
1102 bool reapp_result
= false;
1104 /* Make sure we can access the given path before we go out of our
1105 * way to please it. Doing this check outside of
1106 * apply_default_acl() lets us spit out a better error message for
1109 if (!path_accessible(target
)) {
1110 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
1111 result
= EXIT_FAILURE
;
1116 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
1119 /* It's either a normal file, or we're not operating recursively. */
1120 reapp_result
= apply_default_acl(target
, no_exec_mask
);
1123 if (!reapp_result
) {
1124 result
= EXIT_FAILURE
;