2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
39 * @brief Determine whether or not the given path is accessible.
44 * @return true if @c path is accessible to the current effective
45 * user/group, false otherwise.
47 bool path_accessible(const char* path
) {
52 /* Test for access using the effective user and group rather than
54 int flags
= AT_EACCESS
;
56 /* Don't follow symlinks when checking for a path's existence,
57 since we won't follow them to set its ACLs either. */
58 flags
|= AT_SYMLINK_NOFOLLOW
;
60 /* If the path is relative, interpret it relative to the current
61 working directory (just like the access() system call). */
62 if (faccessat(AT_FDCWD
, path
, F_OK
, flags
) == 0) {
73 * @brief Determine whether or not the given path is a directory.
78 * @return true if @c path is a directory, false otherwise.
80 bool is_path_directory(const char* path
) {
86 if (lstat(path
, &s
) == 0) {
87 return S_ISDIR(s
.st_mode
);
96 * @brief Determine whether or not the given file descriptor is for
100 * The file descriptor whose directoryness is in question.
102 * @return true if @c fd describes a directory, and false otherwise.
104 bool is_directory(int fd
) {
110 if (fstat(fd
, &s
) == 0) {
111 return S_ISDIR(s
.st_mode
);
121 * @brief Update (or create) an entry in an @b minimal ACL.
123 * This function will not work if @c aclp contains extended
124 * entries. This is fine for our purposes, since we call @c wipe_acls
125 * on each path before applying the default to it.
127 * The assumption that there are no extended entries makes things much
128 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
129 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
130 * be created anew. This means we don't have to fool around comparing
131 * named-user/group entries.
134 * A pointer to the acl_t structure whose entry we want to modify.
137 * The new entry. If @c entry contains a user/group/other entry, we
138 * update the existing one. Otherwise we create a new entry.
140 * @return If there is an unexpected library error, @c ACL_ERROR is
141 * returned. Otherwise, @c ACL_SUCCESS.
144 int acl_set_entry(acl_t
* aclp
, acl_entry_t entry
) {
147 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
148 perror("acl_set_entry (acl_get_tag_type)");
152 acl_permset_t entry_permset
;
153 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
154 perror("acl_set_entry (acl_get_permset)");
158 acl_entry_t existing_entry
;
159 /* Loop through the given ACL looking for matching entries. */
160 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
162 while (result
== ACL_SUCCESS
) {
163 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
165 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
166 perror("set_acl_tag_permset (acl_get_tag_type)");
170 if (existing_tag
== entry_tag
) {
171 if (entry_tag
== ACL_USER_OBJ
||
172 entry_tag
== ACL_GROUP_OBJ
||
173 entry_tag
== ACL_OTHER
) {
174 /* Only update for these three since all other tags will have
175 been wiped. These three are guaranteed to exist, so if we
176 match one of them, we're allowed to return ACL_SUCCESS
177 below and bypass the rest of the function. */
178 acl_permset_t existing_permset
;
179 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
180 perror("acl_set_entry (acl_get_permset)");
184 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
185 perror("acl_set_entry (acl_set_permset)");
194 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
197 /* This catches both the initial acl_get_entry and the ones at the
199 if (result
== ACL_ERROR
) {
200 perror("acl_set_entry (acl_get_entry)");
204 /* If we've made it this far, we need to add a new entry to the
206 acl_entry_t new_entry
;
208 /* The acl_create_entry() function can allocate new memory and/or
209 * change the location of the ACL structure entirely. When that
210 * happens, the value pointed to by aclp is updated, which means
211 * that a new acl_t gets "passed out" to our caller, eventually to
212 * be fed to acl_free(). In other words, we should still be freeing
213 * the right thing, even if the value pointed to by aclp changes.
215 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
216 perror("acl_set_entry (acl_create_entry)");
220 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
221 perror("acl_set_entry (acl_set_tag_type)");
225 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
226 perror("acl_set_entry (acl_set_permset)");
230 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
231 /* We need to set the qualifier too. */
232 void* entry_qual
= acl_get_qualifier(entry
);
233 if (entry_qual
== (void*)NULL
) {
234 perror("acl_set_entry (acl_get_qualifier)");
238 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
239 perror("acl_set_entry (acl_set_qualifier)");
250 * @brief Determine the number of entries in the given ACL.
253 * The ACL to inspect.
255 * @return Either the non-negative number of entries in @c acl, or
256 * @c ACL_ERROR on error.
258 int acl_entry_count(acl_t acl
) {
262 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
264 while (result
== ACL_SUCCESS
) {
266 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
269 if (result
== ACL_ERROR
) {
270 perror("acl_entry_count (acl_get_entry)");
280 * @brief Determine whether or not the given ACL is minimal.
282 * An ACL is minimal if it has fewer than four entries.
285 * The ACL whose minimality is in question.
288 * - @c ACL_SUCCESS - @c acl is minimal
289 * - @c ACL_FAILURE - @c acl is not minimal
290 * - @c ACL_ERROR - Unexpected library error
292 int acl_is_minimal(acl_t acl
) {
294 int ec
= acl_entry_count(acl
);
296 if (ec
== ACL_ERROR
) {
297 perror("acl_is_minimal (acl_entry_count)");
312 * @brief Determine whether the given ACL's mask denies execute.
315 * The ACL whose mask we want to check.
318 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
319 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
320 * - @c ACL_ERROR - Unexpected library error.
322 int acl_execute_masked(acl_t acl
) {
325 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
327 while (ge_result
== ACL_SUCCESS
) {
328 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
330 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
331 perror("acl_execute_masked (acl_get_tag_type)");
335 if (tag
== ACL_MASK
) {
336 /* This is the mask entry, get its permissions, and see if
337 execute is specified. */
338 acl_permset_t permset
;
340 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
341 perror("acl_execute_masked (acl_get_permset)");
345 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
346 if (gp_result
== ACL_ERROR
) {
347 perror("acl_execute_masked (acl_get_perm)");
351 if (gp_result
== ACL_FAILURE
) {
352 /* No execute bit set in the mask; execute not allowed. */
357 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
366 * @brief Determine whether @c fd is executable (by anyone) or a
369 * This is used as part of the heuristic to determine whether or not
370 * we should mask the execute bit when inheriting an ACL. If @c fd
371 * describes a directory, the answer is a clear-cut yes. This behavior
372 * is modeled after the capital 'X' perms of setfacl.
374 * If @c fd describes a file, we check the @a effective permissions,
375 * contrary to what setfacl does.
378 * The file descriptor to check.
381 * - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective
383 * - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute
385 * - @c ACL_ERROR - Unexpected library error.
387 int any_can_execute_or_dir(int fd
) {
389 if (is_directory(fd
)) {
390 /* That was easy... */
394 acl_t acl
= acl_get_fd(fd
);
396 if (acl
== (acl_t
)NULL
) {
397 perror("any_can_execute_or_dir (acl_get_file)");
401 /* Our return value. */
402 int result
= ACL_FAILURE
;
404 if (acl_is_minimal(acl
)) {
406 if (fstat(fd
, &s
) == -1) {
407 perror("any_can_execute_or_dir (fstat)");
411 if (s
.st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
412 result
= ACL_SUCCESS
;
416 result
= ACL_FAILURE
;
422 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
424 while (ge_result
== ACL_SUCCESS
) {
425 /* The first thing we do is check to see if this is a mask
426 entry. If it is, we skip it entirely. */
427 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
429 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
430 perror("any_can_execute_or_dir (acl_get_tag_type)");
435 if (tag
== ACL_MASK
) {
436 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
440 /* Ok, so it's not a mask entry. Check the execute perms. */
441 acl_permset_t permset
;
443 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
444 perror("any_can_execute_or_dir (acl_get_permset)");
449 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
450 if (gp_result
== ACL_ERROR
) {
451 perror("any_can_execute_or_dir (acl_get_perm)");
456 if (gp_result
== ACL_SUCCESS
) {
457 /* Only return ACL_SUCCESS if this execute bit is not masked. */
458 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
459 result
= ACL_SUCCESS
;
464 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
467 if (ge_result
== ACL_ERROR
) {
468 perror("any_can_execute_or_dir (acl_get_entry)");
481 * @brief Set @c acl as the default ACL on @c path if it's a directory.
483 * This overwrites any existing default ACL on @c path. If no default
484 * ACL exists, then one is created. If @c path is not a directory, we
485 * return ACL_FAILURE but no error is raised.
488 * The target directory whose ACL we wish to replace or create.
491 * The ACL to set as default on @c path.
494 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
495 * - @c ACL_FAILURE - If @c path is not a directory.
496 * - @c ACL_ERROR - Unexpected library error.
498 int assign_default_acl(const char* path
, acl_t acl
) {
505 if (!is_path_directory(path
)) {
509 /* Our return value; success unless something bad happens. */
510 int result
= ACL_SUCCESS
;
511 acl_t path_acl
= acl_dup(acl
);
513 if (path_acl
== (acl_t
)NULL
) {
514 perror("assign_default_acl (acl_dup)");
515 return ACL_ERROR
; /* Nothing to clean up in this case. */
518 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
519 perror("assign_default_acl (acl_set_file)");
530 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
531 * descriptor, leaving the UNIX permission bits.
534 * The file descriptor whose ACLs we want to wipe.
537 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
538 * existed in the first place.
539 * - @c ACL_ERROR - Unexpected library error.
541 int wipe_acls(int fd
) {
542 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
543 acl_t empty_acl
= acl_init(0);
545 if (empty_acl
== (acl_t
)NULL
) {
546 perror("wipe_acls (acl_init)");
550 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
551 perror("wipe_acls (acl_set_fd)");
563 * @brief Apply parent default ACL to a path.
565 * This overwrites any existing ACLs on @c path.
568 * The path whose ACL we would like to reset to its default.
570 * @param no_exec_mask
571 * The value (either true or false) of the --no-exec-mask flag.
574 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
575 * - @c ACL_FAILURE - The target path is not a regular file/directory,
576 * or the parent of @c path is not a directory.
577 * - @c ACL_ERROR - Unexpected library error.
579 int apply_default_acl(const char* path
, bool no_exec_mask
) {
583 perror("apply_default_acl (args)");
587 /* Define these next three variables here because we may have to
588 * jump to the cleanup routine which expects them to exist.
591 /* Our return value. */
592 int result
= ACL_SUCCESS
;
594 /* The default ACL on path's parent directory */
595 acl_t defacl
= (acl_t
)NULL
;
597 /* The file descriptor corresponding to "path" */
600 /* Split "path" into base/dirname parts to be used with openat().
601 * We duplicate the strings involved because dirname/basename mangle
604 char* path_copy
= strdup(path
);
605 if (path_copy
== NULL
) {
606 perror("apply_default_acl (strdup)");
609 char* parent
= dirname(path_copy
);
611 fd
= open(path
, O_NOFOLLOW
);
613 if (errno
== ELOOP
) {
614 result
= ACL_FAILURE
; /* hit a symlink */
618 perror("apply_default_acl (open fd)");
625 /* Refuse to operate on hard links, which can be abused by an
626 * attacker to trick us into changing the ACL on a file we didn't
627 * intend to; namely the "target" of the hard link. There is TOCTOU
628 * race condition here, but the window is as small as possible
629 * between when we open the file descriptor (look above) and when we
633 if (fstat(fd
, &s
) == -1) {
634 perror("apply_default_acl (fstat)");
637 if (!S_ISDIR(s
.st_mode
)) {
638 /* If it's not a directory, make sure it's a regular,
639 non-hard-linked file. */
640 if (!S_ISREG(s
.st_mode
) || s
.st_nlink
!= 1) {
641 result
= ACL_FAILURE
;
647 /* Default to not masking the exec bit; i.e. applying the default
648 ACL literally. If --no-exec-mask was not specified, then we try
649 to "guess" whether or not to mask the exec bit. */
650 bool allow_exec
= true;
653 int ace_result
= any_can_execute_or_dir(fd
);
655 if (ace_result
== ACL_ERROR
) {
656 perror("apply_default_acl (any_can_execute_or_dir)");
661 allow_exec
= (bool)ace_result
;
664 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
666 if (defacl
== (acl_t
)NULL
) {
667 perror("apply_default_acl (acl_get_file)");
672 if (wipe_acls(fd
) == ACL_ERROR
) {
673 perror("apply_default_acl (wipe_acls)");
678 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
679 ACL with this one. */
680 acl_t acl
= acl_get_fd(fd
);
681 if (acl
== (acl_t
)NULL
) {
682 perror("apply_default_acl (acl_get_fd)");
687 /* If it's a directory, inherit the parent's default. */
688 if (assign_default_acl(path
, defacl
) == ACL_ERROR
) {
689 perror("apply_default_acl (assign_default_acl)");
695 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
697 while (ge_result
== ACL_SUCCESS
) {
698 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
700 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
701 perror("apply_default_acl (acl_get_tag_type)");
707 /* We've got an entry/tag from the default ACL. Get its permset. */
708 acl_permset_t permset
;
709 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
710 perror("apply_default_acl (acl_get_permset)");
715 /* If this is a default mask, fix it up. */
716 if (tag
== ACL_MASK
||
717 tag
== ACL_USER_OBJ
||
718 tag
== ACL_GROUP_OBJ
||
722 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
723 minimal ACLs) or acl_other entries, so if execute should be
724 masked, we have to do it manually. */
725 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
726 perror("apply_default_acl (acl_delete_perm)");
731 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
732 perror("apply_default_acl (acl_set_permset)");
739 /* Finally, add the permset to the access ACL. It's actually
740 * important that we pass in the address of "acl" here, and not
741 * "acl" itself. Why? The call to acl_create_entry() within
742 * acl_set_entry() can allocate new memory for the entry.
743 * Sometimes that can be done in-place, in which case everything
744 * is cool and the new memory gets released when we call
747 * But occasionally, the whole ACL structure will have to be moved
748 * in order to allocate the extra space. When that happens,
749 * acl_create_entry() modifies the pointer it was passed (in this
750 * case, &acl) to point to the new location. We want to call
751 * acl_free() on the new location, and since acl_free() gets
752 * called right here, we need acl_create_entry() to update the
753 * value of "acl". To do that, it needs the address of "acl".
755 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
756 perror("apply_default_acl (acl_set_entry)");
761 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
764 /* Catches the first acl_get_entry as well as the ones at the end of
766 if (ge_result
== ACL_ERROR
) {
767 perror("apply_default_acl (acl_get_entry)");
772 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
773 perror("apply_default_acl (acl_set_fd)");
780 if (defacl
!= (acl_t
)NULL
) {
783 if (fd
>= 0 && close(fd
) == -1) {
784 perror("apply_default_acl (close)");
793 * @brief Display program usage information.
795 * @param program_name
796 * The program name to use in the output.
799 void usage(const char* program_name
) {
800 printf("Apply any applicable default ACLs to the given files or "
802 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
805 printf(" -h, --help Print this help message\n");
806 printf(" -r, --recursive Act on any given directories recursively\n");
807 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
814 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
816 * For parameter information, see the @c nftw man page.
818 * @return If the ACL was applied to @c target successfully, we return
819 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
820 * the next file or directory. Otherwise, we return @c FTW_STOP to
824 int apply_default_acl_nftw(const char *target
,
825 const struct stat
*s
,
829 if (apply_default_acl(target
, false)) {
840 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
842 * This is identical to @c apply_default_acl_nftw(), except it passes
843 * @c true to @c apply_default_acl() as its no_exec_mask argument.
846 int apply_default_acl_nftw_x(const char *target
,
847 const struct stat
*s
,
851 if (apply_default_acl(target
, true)) {
862 * @brief Recursive version of @c apply_default_acl().
864 * If @c target is a directory, we use @c nftw() to call @c
865 * apply_default_acl() recursively on all of its children. Otherwise,
866 * we just delegate to @c apply_default_acl().
868 * We ignore symlinks for consistency with chmod -r.
871 * The root (path) of the recursive application.
873 * @param no_exec_mask
874 * The value (either true or false) of the --no-exec-mask flag.
877 * If @c target is not a directory, we return the result of
878 * calling @c apply_default_acl() on @c target. Otherwise, we convert
879 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
880 * then we return @c true. Otherwise, we return @c false.
882 * If there is an error, it will be reported via @c perror, but
883 * we still return @c false.
885 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
887 if (!is_path_directory(target
)) {
888 return apply_default_acl(target
, no_exec_mask
);
891 int max_levels
= 256;
892 int flags
= FTW_PHYS
; /* Don't follow links. */
894 /* There are two separate functions that could be passed to
895 nftw(). One passes no_exec_mask = true to apply_default_acl(),
896 and the other passes no_exec_mask = false. Since the function we
897 pass to nftw() cannot have parameters, we have to create separate
898 options and make the decision here. */
899 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
900 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
902 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
904 if (nftw_result
== 0) {
909 /* nftw will return -1 on error, or if the supplied function
910 * (apply_default_acl_nftw) returns a non-zero result, nftw will
913 if (nftw_result
== -1) {
914 perror("apply_default_acl_recursive (nftw)");
923 * @brief Call apply_default_acl (possibly recursively) on each
924 * command-line argument.
926 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
927 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
930 int main(int argc
, char* argv
[]) {
937 bool recursive
= false;
938 bool no_exec_mask
= false;
940 struct option long_options
[] = {
941 /* These options set a flag. */
942 {"help", no_argument
, NULL
, 'h'},
943 {"recursive", no_argument
, NULL
, 'r'},
944 {"no-exec-mask", no_argument
, NULL
, 'x'},
950 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
967 int result
= EXIT_SUCCESS
;
970 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
971 const char* target
= argv
[arg_index
];
972 bool reapp_result
= false;
974 /* Make sure we can access the given path before we go out of our
975 * way to please it. Doing this check outside of
976 * apply_default_acl() lets us spit out a better error message for
979 if (!path_accessible(target
)) {
980 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
981 result
= EXIT_FAILURE
;
986 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
989 /* It's either a normal file, or we're not operating recursively. */
990 reapp_result
= apply_default_acl(target
, no_exec_mask
);
994 result
= EXIT_FAILURE
;