4 * @brief The adacl (apply default acl) shared library.
8 /* Enables get_current_dir_name() in unistd.h and the O_PATH flag. */
11 #include <errno.h> /* EINVAL, ELOOP, ENOTDIR, etc. */
12 #include <fcntl.h> /* openat() */
13 #include <libgen.h> /* basename(), dirname() */
14 #include <limits.h> /* PATH_MAX */
15 #include <stdbool.h> /* the "bool" type */
16 #include <stdio.h> /* perror(), snprintf() */
17 #include <stdlib.h> /* free() */
18 #include <string.h> /* strdup() */
19 #include <sys/stat.h> /* fstat() */
20 #include <unistd.h> /* get_current_dir_name() */
23 #include <acl/libacl.h> /* acl_get_perm, not portable */
24 #include <sys/acl.h> /* all other acl_foo functions */
29 /* Even though most other library functions reliably return -1 for
30 * error, it feels a little wrong to re-use the ACL_ERROR constant.
32 #define CLOSE_ERROR -1
34 #define SNPRINTF_ERROR -1
39 * @brief The recursive portion of the @c safe_open function, used to
40 * open a file descriptor in a symlink-safe way when combined with
41 * the @c O_NOFOLLOW flag.
44 * A file descriptor relative to which @c pathname will be opened.
47 * The path to the file/directory/whatever whose descriptor you want.
50 * File status flags to be passed to @c openat.
52 * @return a file descriptor for @c pathname if everything goes well,
53 * and @c OPEN_ERROR if not.
55 int safe_open_ex(int at_fd
, char* pathname
, int flags
) {
56 if (pathname
== NULL
) {
58 perror("safe_open_ex (args)");
62 char* firstslash
= strchr(pathname
, '/');
63 if (firstslash
== NULL
) {
64 /* No more slashes, this is the base case. */
65 return openat(at_fd
, pathname
, flags
);
67 else if (firstslash
[1] == '\0') {
68 /* The first slash is the last character; ensure that we open
71 return openat(at_fd
, pathname
, flags
| O_DIRECTORY
);
74 /* The first slash exists and isn't the last character in the path,
75 so we can split the path wherever that first slash lies and
78 int fd
= openat(at_fd
, pathname
, flags
| O_DIRECTORY
| O_PATH
);
79 if (fd
== OPEN_ERROR
) {
80 if (errno
!= ENOTDIR
) {
81 /* Don't output anything if we ignore a symlink */
82 perror("safe_open_ex (safe_open_ex)");
87 /* The +1 is safe because there needs to be at least one character
88 after the first slash (we checked this above). */
89 int result
= safe_open_ex(fd
, firstslash
+1, flags
);
90 if (close(fd
) == CLOSE_ERROR
) {
91 perror("safe_open_ex (close)");
99 * @brief A version of @c open that is completely symlink-safe when
100 * used with the @c O_NOFOLLOW flag.
102 * The @c openat function exists to ensure that you can anchor one
103 * path to a particular directory while opening it; however, if you
104 * open "b/c/d" relative to "/a", then even the @c openat function will
105 * still follow symlinks in the "b" component. This can be exploited
106 * by an attacker to make you open the wrong path.
108 * To avoid that problem, this function uses a recursive
109 * implementation that opens every path from the root, one level at a
110 * time. So "a" is opened relative to "/", and then "b" is opened
111 * relative to "/a", and then "c" is opened relative to "/a/b",
112 * etc. When the @c O_NOFOLLOW flag is used, this approach ensures
113 * that no symlinks in any component are followed.
116 * The path to the file/directory/whatever whose descriptor you want.
119 * File status flags to be passed to @c openat.
121 * @return a file descriptor for @c pathname if everything goes well,
122 * and @c OPEN_ERROR if not.
124 int safe_open(const char* pathname
, int flags
) {
125 if (pathname
== NULL
|| strlen(pathname
) == 0 || pathname
[0] == '\0') {
127 perror("safe_open (args)");
131 char abspath
[PATH_MAX
];
132 int snprintf_result
= 0;
133 if (strchr(pathname
, '/') == pathname
) {
134 /* pathname is already absolute; just copy it. */
135 snprintf_result
= snprintf(abspath
, PATH_MAX
, "%s", pathname
);
138 /* Concatenate the current working directory and pathname into an
139 * absolute path. We use realpath() ONLY on the cwd part, and not
140 * on the pathname part, because realpath() resolves symlinks. And
141 * the whole point of all this crap is to avoid following symlinks
144 * Using realpath() on the cwd lets us operate on relative paths
145 * while we're sitting in a directory that happens to have a
146 * symlink in it; for example: cd /var/run && apply-default-acl foo.
148 char* cwd
= get_current_dir_name();
150 perror("safe_open (get_current_dir_name)");
154 char abs_cwd
[PATH_MAX
];
155 if (realpath(cwd
, abs_cwd
) == NULL
) {
156 perror("safe_open (realpath)");
160 snprintf_result
= snprintf(abspath
, PATH_MAX
, "%s/%s", abs_cwd
, pathname
);
163 if (snprintf_result
== SNPRINTF_ERROR
|| snprintf_result
> PATH_MAX
) {
164 perror("safe_open (snprintf)");
169 if (strcmp(abspath
, "/") == 0) {
170 fd
= open("/", flags
| O_DIRECTORY
);
173 /* Use O_PATH for some added safety if "/" is not our target */
174 fd
= open("/", flags
| O_DIRECTORY
| O_PATH
);
176 if (fd
== OPEN_ERROR
) {
177 perror("safe_open (open)");
181 if (strcmp(abspath
, "/") == 0) {
185 int result
= safe_open_ex(fd
, abspath
+1, flags
);
186 if (close(fd
) == CLOSE_ERROR
) {
187 perror("safe_open (close)");
197 * @brief Update (or create) an entry in an @b minimal ACL.
199 * This function will not work if @c aclp contains extended
200 * entries. This is fine for our purposes, since we call @c wipe_acls
201 * on each path before applying the default to it.
203 * The assumption that there are no extended entries makes things much
204 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
205 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
206 * be created anew. This means we don't have to fool around comparing
207 * named-user/group entries.
210 * A pointer to the acl_t structure whose entry we want to modify.
213 * The new entry. If @c entry contains a user/group/other entry, we
214 * update the existing one. Otherwise we create a new entry.
216 * @return If there is an unexpected library error, @c ACL_ERROR is
217 * returned. Otherwise, @c ACL_SUCCESS.
220 int acl_set_entry(acl_t
* aclp
, acl_entry_t entry
) {
221 if (aclp
== NULL
|| entry
== NULL
) {
223 perror("acl_set_entry (args)");
228 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
229 perror("acl_set_entry (acl_get_tag_type)");
233 acl_permset_t entry_permset
;
234 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
235 perror("acl_set_entry (acl_get_permset)");
239 acl_entry_t existing_entry
;
240 /* Loop through the given ACL looking for matching entries. */
241 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
243 while (result
== ACL_SUCCESS
) {
244 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
246 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
247 perror("set_acl_tag_permset (acl_get_tag_type)");
251 if (existing_tag
== entry_tag
) {
252 if (entry_tag
== ACL_USER_OBJ
||
253 entry_tag
== ACL_GROUP_OBJ
||
254 entry_tag
== ACL_OTHER
) {
255 /* Only update for these three since all other tags will have
256 been wiped. These three are guaranteed to exist, so if we
257 match one of them, we're allowed to return ACL_SUCCESS
258 below and bypass the rest of the function. */
259 acl_permset_t existing_permset
;
260 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
261 perror("acl_set_entry (acl_get_permset)");
265 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
266 perror("acl_set_entry (acl_set_permset)");
275 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
278 /* This catches both the initial acl_get_entry and the ones at the
280 if (result
== ACL_ERROR
) {
281 perror("acl_set_entry (acl_get_entry)");
285 /* If we've made it this far, we need to add a new entry to the
287 acl_entry_t new_entry
;
289 /* The acl_create_entry() function can allocate new memory and/or
290 * change the location of the ACL structure entirely. When that
291 * happens, the value pointed to by aclp is updated, which means
292 * that a new acl_t gets "passed out" to our caller, eventually to
293 * be fed to acl_free(). In other words, we should still be freeing
294 * the right thing, even if the value pointed to by aclp changes.
296 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
297 perror("acl_set_entry (acl_create_entry)");
301 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
302 perror("acl_set_entry (acl_set_tag_type)");
306 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
307 perror("acl_set_entry (acl_set_permset)");
311 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
312 /* We need to set the qualifier too. */
313 void* entry_qual
= acl_get_qualifier(entry
);
314 if (entry_qual
== (void*)NULL
) {
315 perror("acl_set_entry (acl_get_qualifier)");
319 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
320 perror("acl_set_entry (acl_set_qualifier)");
331 * @brief Determine the number of entries in the given ACL.
334 * The ACL to inspect.
336 * @return Either the non-negative number of entries in @c acl, or
337 * @c ACL_ERROR on error.
339 int acl_entry_count(acl_t acl
) {
343 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
345 while (result
== ACL_SUCCESS
) {
347 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
350 if (result
== ACL_ERROR
) {
351 perror("acl_entry_count (acl_get_entry)");
361 * @brief Determine whether or not the given ACL is minimal.
363 * An ACL is minimal if it has fewer than four entries.
366 * The ACL whose minimality is in question.
369 * - @c ACL_SUCCESS - @c acl is minimal
370 * - @c ACL_FAILURE - @c acl is not minimal
371 * - @c ACL_ERROR - Unexpected library error
373 int acl_is_minimal(acl_t acl
) {
376 perror("acl_is_minimal (args)");
380 int ec
= acl_entry_count(acl
);
382 if (ec
== ACL_ERROR
) {
383 perror("acl_is_minimal (acl_entry_count)");
398 * @brief Determine whether the given ACL's mask denies execute.
401 * The ACL whose mask we want to check.
404 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
405 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
406 * - @c ACL_ERROR - Unexpected library error.
408 int acl_execute_masked(acl_t acl
) {
411 perror("acl_execute_masked (args)");
416 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
418 while (ge_result
== ACL_SUCCESS
) {
419 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
421 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
422 perror("acl_execute_masked (acl_get_tag_type)");
426 if (tag
== ACL_MASK
) {
427 /* This is the mask entry, get its permissions, and see if
428 execute is specified. */
429 acl_permset_t permset
;
431 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
432 perror("acl_execute_masked (acl_get_permset)");
436 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
437 if (gp_result
== ACL_ERROR
) {
438 perror("acl_execute_masked (acl_get_perm)");
442 if (gp_result
== ACL_FAILURE
) {
443 /* No execute bit set in the mask; execute not allowed. */
448 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
457 * @brief Determine whether @c fd is executable by anyone.
460 * This is used as part of the heuristic to determine whether or not
461 * we should mask the execute bit when inheriting an ACL. If @c fd
462 * describes a file, we check the @a effective permissions, contrary
463 * to what setfacl does.
466 * The file descriptor to check.
469 * A pointer to a stat structure for @c fd.
472 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
473 * - @c ACL_FAILURE - Nobody can execute @c fd.
474 * - @c ACL_ERROR - Unexpected library error.
476 int any_can_execute(int fd
, const struct stat
* sp
) {
479 perror("any_can_execute (args)");
483 acl_t acl
= acl_get_fd(fd
);
485 if (acl
== (acl_t
)NULL
) {
486 perror("any_can_execute (acl_get_file)");
490 /* Our return value. */
491 int result
= ACL_FAILURE
;
493 if (acl_is_minimal(acl
)) {
494 if (sp
->st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
495 result
= ACL_SUCCESS
;
499 result
= ACL_FAILURE
;
505 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
507 while (ge_result
== ACL_SUCCESS
) {
508 /* The first thing we do is check to see if this is a mask
509 entry. If it is, we skip it entirely. */
510 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
512 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
513 perror("any_can_execute_or (acl_get_tag_type)");
518 if (tag
== ACL_MASK
) {
519 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
523 /* Ok, so it's not a mask entry. Check the execute perms. */
524 acl_permset_t permset
;
526 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
527 perror("any_can_execute_or (acl_get_permset)");
532 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
533 if (gp_result
== ACL_ERROR
) {
534 perror("any_can_execute (acl_get_perm)");
539 if (gp_result
== ACL_SUCCESS
) {
540 /* Only return ACL_SUCCESS if this execute bit is not masked. */
541 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
542 result
= ACL_SUCCESS
;
547 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
550 if (ge_result
== ACL_ERROR
) {
551 perror("any_can_execute (acl_get_entry)");
564 * @brief Set @c acl as the default ACL on @c path.
566 * This overwrites any existing default ACL on @c path. If @c path is
567 * not a directory, we return ACL_ERROR and @c errno is set.
570 * The target directory whose ACL we wish to replace or create.
573 * The ACL to set as default on @c path.
576 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
577 * - @c ACL_ERROR - Unexpected library error.
579 int assign_default_acl(const char* path
, acl_t acl
) {
580 if (path
== NULL
|| acl
== NULL
) {
582 perror("assign_default_acl (args)");
586 /* Our return value; success unless something bad happens. */
587 int result
= ACL_SUCCESS
;
588 acl_t path_acl
= acl_dup(acl
);
590 if (path_acl
== (acl_t
)NULL
) {
591 perror("assign_default_acl (acl_dup)");
592 return ACL_ERROR
; /* Nothing to clean up in this case. */
595 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
596 perror("assign_default_acl (acl_set_file)");
607 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
608 * descriptor, leaving the UNIX permission bits.
611 * The file descriptor whose ACLs we want to wipe.
614 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
615 * existed in the first place.
616 * - @c ACL_ERROR - Unexpected library error.
618 int wipe_acls(int fd
) {
619 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
620 acl_t empty_acl
= acl_init(0);
622 if (empty_acl
== (acl_t
)NULL
) {
623 perror("wipe_acls (acl_init)");
627 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
628 perror("wipe_acls (acl_set_fd)");
640 * @brief Apply parent default ACL to a path.
642 * This overwrites any existing ACLs on @c path.
645 * The path whose ACL we would like to reset to its default.
648 * A pointer to a stat structure for @c path, or @c NULL if you don't
651 * @param no_exec_mask
652 * The value (either true or false) of the --no-exec-mask flag.
655 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
656 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
657 * - @c ACL_ERROR - Unexpected library error.
659 int apply_default_acl_ex(const char* path
,
660 const struct stat
* sp
,
665 perror("apply_default_acl_ex (args)");
669 /* Define these next three variables here because we may have to
670 * jump to the cleanup routine which expects them to exist.
673 /* Our return value. */
674 int result
= ACL_SUCCESS
;
676 /* The default ACL on path's parent directory */
677 acl_t defacl
= (acl_t
)NULL
;
679 /* The file descriptor corresponding to "path" */
682 /* Get the parent directory of "path" with dirname(), which happens
683 * to murder its argument and necessitates a path_copy.
685 char* path_copy
= strdup(path
);
686 if (path_copy
== NULL
) {
687 perror("apply_default_acl_ex (strdup)");
690 char* parent
= dirname(path_copy
);
692 fd
= safe_open(path
, O_NOFOLLOW
);
693 if (fd
== OPEN_ERROR
) {
694 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
695 /* We hit a symlink, either in the last path component (ELOOP)
696 or higher up (ENOTDIR). */
697 result
= ACL_FAILURE
;
701 perror("apply_default_acl_ex (open fd)");
708 /* Refuse to operate on hard links, which can be abused by an
709 * attacker to trick us into changing the ACL on a file we didn't
710 * intend to; namely the "target" of the hard link. There is TOCTOU
711 * race condition here, but the window is as small as possible
712 * between when we open the file descriptor (look above) and when we
715 * Note: we only need to call fstat ourselves if we weren't passed a
716 * valid pointer to a stat structure (nftw does that).
720 if (fstat(fd
, &s
) == STAT_ERROR
) {
721 perror("apply_default_acl_ex (fstat)");
728 if (!S_ISDIR(sp
->st_mode
)) {
729 /* If it's not a directory, make sure it's a regular,
730 non-hard-linked file. */
731 if (!S_ISREG(sp
->st_mode
) || sp
->st_nlink
!= 1) {
732 result
= ACL_FAILURE
;
738 /* Default to not masking the exec bit; i.e. applying the default
739 ACL literally. If --no-exec-mask was not specified, then we try
740 to "guess" whether or not to mask the exec bit. This behavior
741 is modeled after the capital 'X' perms of setfacl. */
742 bool allow_exec
= true;
745 /* Never mask the execute bit on directories. */
746 int ace_result
= any_can_execute(fd
,sp
) || S_ISDIR(sp
->st_mode
);
748 if (ace_result
== ACL_ERROR
) {
749 perror("apply_default_acl_ex (any_can_execute)");
754 allow_exec
= (bool)ace_result
;
757 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
759 if (defacl
== (acl_t
)NULL
) {
760 perror("apply_default_acl_ex (acl_get_file)");
765 if (wipe_acls(fd
) == ACL_ERROR
) {
766 perror("apply_default_acl_ex (wipe_acls)");
771 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
772 ACL with this one. */
773 acl_t acl
= acl_get_fd(fd
);
774 if (acl
== (acl_t
)NULL
) {
775 perror("apply_default_acl_ex (acl_get_fd)");
780 /* If it's a directory, inherit the parent's default. We sure hope
781 * that "path" still points to the same thing that "fd" and this
782 * "sp" describe. If not, we may wind up trying to set a default ACL
783 * on a file, and this will throw an error. I guess that's what we
786 if (S_ISDIR(sp
->st_mode
) && assign_default_acl(path
, defacl
) == ACL_ERROR
) {
787 perror("apply_default_acl_ex (assign_default_acl)");
793 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
795 while (ge_result
== ACL_SUCCESS
) {
796 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
798 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
799 perror("apply_default_acl_ex (acl_get_tag_type)");
805 /* We've got an entry/tag from the default ACL. Get its permset. */
806 acl_permset_t permset
;
807 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
808 perror("apply_default_acl_ex (acl_get_permset)");
813 /* If this is a default mask, fix it up. */
814 if (tag
== ACL_MASK
||
815 tag
== ACL_USER_OBJ
||
816 tag
== ACL_GROUP_OBJ
||
820 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
821 minimal ACLs) or acl_other entries, so if execute should be
822 masked, we have to do it manually. */
823 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
824 perror("apply_default_acl_ex (acl_delete_perm)");
829 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
830 perror("apply_default_acl_ex (acl_set_permset)");
837 /* Finally, add the permset to the access ACL. It's actually
838 * important that we pass in the address of "acl" here, and not
839 * "acl" itself. Why? The call to acl_create_entry() within
840 * acl_set_entry() can allocate new memory for the entry.
841 * Sometimes that can be done in-place, in which case everything
842 * is cool and the new memory gets released when we call
845 * But occasionally, the whole ACL structure will have to be moved
846 * in order to allocate the extra space. When that happens,
847 * acl_create_entry() modifies the pointer it was passed (in this
848 * case, &acl) to point to the new location. We want to call
849 * acl_free() on the new location, and since acl_free() gets
850 * called right here, we need acl_create_entry() to update the
851 * value of "acl". To do that, it needs the address of "acl".
853 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
854 perror("apply_default_acl_ex (acl_set_entry)");
859 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
862 /* Catches the first acl_get_entry as well as the ones at the end of
864 if (ge_result
== ACL_ERROR
) {
865 perror("apply_default_acl_ex (acl_get_entry)");
870 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
871 perror("apply_default_acl_ex (acl_set_fd)");
878 if (defacl
!= (acl_t
)NULL
) {
881 if (fd
>= 0 && close(fd
) == CLOSE_ERROR
) {
882 perror("apply_default_acl_ex (close)");
891 * @brief The friendly interface to @c apply_default_acl_ex.
893 * The @c apply_default_acl_ex function holds the real implementation
894 * of this function, but it takes a weird second argument that most
895 * people won't care about (a stat structure). But, we use that
896 * argument for the recursive mode of the CLI, so it's there.
898 * If you don't have a stat structure for your @c path, use this instead.
901 * The path whose ACL we would like to reset to its default.
903 * @param no_exec_mask
904 * The value (either true or false) of the --no-exec-mask flag.
907 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
908 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
909 * or the parent of @c path is not a directory.
910 * - @c ACL_ERROR - Unexpected library error.
912 int apply_default_acl(const char* path
, bool no_exec_mask
) {
913 return apply_default_acl_ex(path
, NULL
, no_exec_mask
);