4 * @brief The adacl (apply default acl) shared library.
8 /* Enables get_current_dir_name() in unistd.h and the O_PATH flag. */
11 #include <errno.h> /* EINVAL, ELOOP, ENOTDIR, etc. */
12 #include <fcntl.h> /* openat() */
13 #include <libgen.h> /* basename(), dirname() */
14 #include <limits.h> /* PATH_MAX */
15 #include <stdbool.h> /* the "bool" type */
16 #include <stdio.h> /* perror(), snprintf() */
17 #include <stdlib.h> /* free() */
18 #include <string.h> /* strdup() */
19 #include <sys/stat.h> /* fstat() */
20 #include <sys/xattr.h> /* fgetxattr(), fsetxattr() */
21 #include <unistd.h> /* get_current_dir_name() */
24 #include <acl/libacl.h> /* acl_get_perm, not portable */
25 #include <sys/acl.h> /* all other acl_foo functions */
27 /* XATTR_NAME_POSIX_ACL_ACCESS and XATTR_NAME_POSIX_ACL_DEFAULT */
28 #include <linux/xattr.h>
33 /* Even though most other library functions reliably return -1 for
34 * error, it feels a little wrong to re-use the ACL_ERROR constant.
36 #define CLOSE_ERROR -1
38 #define SNPRINTF_ERROR -1
40 #define XATTR_ERROR -1
44 * @brief The recursive portion of the @c safe_open function, used to
45 * open a file descriptor in a symlink-safe way when combined with
46 * the @c O_NOFOLLOW flag.
49 * A file descriptor relative to which @c pathname will be opened.
52 * The path to the file/directory/whatever whose descriptor you want.
55 * File status flags to be passed to @c openat.
57 * @return a file descriptor for @c pathname if everything goes well,
58 * and @c OPEN_ERROR if not.
60 int safe_open_ex(int at_fd
, char* pathname
, int flags
) {
61 if (pathname
== NULL
) {
63 perror("safe_open_ex (args)");
67 char* firstslash
= strchr(pathname
, '/');
68 if (firstslash
== NULL
) {
69 /* No more slashes, this is the base case. */
70 return openat(at_fd
, pathname
, flags
);
72 if (firstslash
[1] == '\0') {
73 /* The first slash is the last character; ensure that we open
76 return openat(at_fd
, pathname
, flags
| O_DIRECTORY
);
79 /* The first slash exists and isn't the last character in the path,
80 so we can split the path wherever that first slash lies and
83 int fd
= openat(at_fd
, pathname
, flags
| O_DIRECTORY
| O_PATH
);
84 if (fd
== OPEN_ERROR
) {
85 if (errno
!= ENOTDIR
) {
86 /* Don't output anything if we ignore a symlink */
87 perror("safe_open_ex (safe_open_ex)");
92 /* The +1 is safe because there needs to be at least one character
93 after the first slash (we checked this above). */
94 int result
= safe_open_ex(fd
, firstslash
+1, flags
);
95 if (close(fd
) == CLOSE_ERROR
) {
96 perror("safe_open_ex (close)");
104 * @brief A version of @c open that is completely symlink-safe when
105 * used with the @c O_NOFOLLOW flag.
107 * The @c openat function exists to ensure that you can anchor one
108 * path to a particular directory while opening it; however, if you
109 * open "b/c/d" relative to "/a", then even the @c openat function will
110 * still follow symlinks in the "b" component. This can be exploited
111 * by an attacker to make you open the wrong path.
113 * To avoid that problem, this function uses a recursive
114 * implementation that opens every path from the root, one level at a
115 * time. So "a" is opened relative to "/", and then "b" is opened
116 * relative to "/a", and then "c" is opened relative to "/a/b",
117 * etc. When the @c O_NOFOLLOW flag is used, this approach ensures
118 * that no symlinks in any component are followed.
121 * The path to the file/directory/whatever whose descriptor you want.
124 * File status flags to be passed to @c openat.
126 * @return a file descriptor for @c pathname if everything goes well,
127 * and @c OPEN_ERROR if not.
129 int safe_open(const char* pathname
, int flags
) {
130 if (pathname
== NULL
) {
132 perror("safe_open (args)");
136 char abspath
[PATH_MAX
];
137 int snprintf_result
= 0;
138 if (strchr(pathname
, '/') == pathname
) {
139 /* pathname is already absolute; just copy it. */
140 snprintf_result
= snprintf(abspath
, PATH_MAX
, "%s", pathname
);
143 /* Concatenate the current working directory and pathname into an
144 * absolute path. We use realpath() ONLY on the cwd part, and not
145 * on the pathname part, because realpath() resolves symlinks. And
146 * the whole point of all this crap is to avoid following symlinks
149 * Using realpath() on the cwd lets us operate on relative paths
150 * while we're sitting in a directory that happens to have a
151 * symlink in it; for example: cd /var/run && apply-default-acl foo.
153 char* cwd
= get_current_dir_name();
155 perror("safe_open (get_current_dir_name)");
159 char abs_cwd
[PATH_MAX
];
160 if (realpath(cwd
, abs_cwd
) == NULL
) {
161 perror("safe_open (realpath)");
165 snprintf_result
= snprintf(abspath
, PATH_MAX
, "%s/%s", abs_cwd
, pathname
);
168 if (snprintf_result
== SNPRINTF_ERROR
|| snprintf_result
> PATH_MAX
) {
169 perror("safe_open (snprintf)");
173 bool abspath_is_root
= (strcmp(abspath
, "/") == 0);
174 int rootflags
= flags
| O_DIRECTORY
;
175 if (!abspath_is_root
) {
176 /* Use O_PATH for some added safety if "/" is not our target */
179 int rootfd
= open("/", rootflags
);
180 if (rootfd
== OPEN_ERROR
) {
181 perror("safe_open (open)");
185 if (abspath_is_root
) {
189 int result
= safe_open_ex(rootfd
, abspath
+1, flags
);
190 if (close(rootfd
) == CLOSE_ERROR
) {
191 perror("safe_open (close)");
201 * @brief Update an entry in an @b minimal ACL.
204 * A pointer to the acl_t structure whose entry we want to update.
210 * - @c ACL_SUCCESS - If we update an existing entry.
211 * - @c ACL_FAILURE - If we don't find an entry to update.
212 * - @c ACL_ERROR - Unexpected library error.
214 int acl_update_entry(acl_t aclp
, acl_entry_t entry
) {
215 if (aclp
== NULL
|| entry
== NULL
) {
217 perror("acl_update_entry (args)");
222 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
223 perror("acl_update_entry (acl_get_tag_type)");
227 acl_permset_t entry_permset
;
228 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
229 perror("acl_update_entry (acl_get_permset)");
233 acl_entry_t existing_entry
;
234 /* Loop through the given ACL looking for matching entries. */
235 int result
= acl_get_entry(aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
237 while (result
== ACL_SUCCESS
) {
238 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
240 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
241 perror("set_acl_tag_permset (acl_get_tag_type)");
245 if (existing_tag
== entry_tag
) {
246 /* If we update something, we're done and return ACL_SUCCESS */
247 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
248 perror("acl_update_entry (acl_set_permset)");
255 result
= acl_get_entry(aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
258 /* This catches both the initial acl_get_entry and the ones at the
260 if (result
== ACL_ERROR
) {
261 perror("acl_update_entry (acl_get_entry)");
271 * @brief Determine the number of entries in the given ACL.
274 * The ACL to inspect.
276 * @return Either the non-negative number of entries in @c acl, or
277 * @c ACL_ERROR on error.
279 int acl_entry_count(acl_t acl
) {
283 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
285 while (result
== ACL_SUCCESS
) {
287 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
290 if (result
== ACL_ERROR
) {
291 perror("acl_entry_count (acl_get_entry)");
301 * @brief Determine whether or not the given ACL is minimal.
303 * An ACL is minimal if it has fewer than four entries.
306 * The ACL whose minimality is in question.
309 * - @c ACL_SUCCESS - @c acl is minimal
310 * - @c ACL_FAILURE - @c acl is not minimal
311 * - @c ACL_ERROR - Unexpected library error
313 int acl_is_minimal(acl_t acl
) {
316 perror("acl_is_minimal (args)");
320 int ec
= acl_entry_count(acl
);
322 if (ec
== ACL_ERROR
) {
323 perror("acl_is_minimal (acl_entry_count)");
338 * @brief Determine whether the given ACL's mask denies execute.
341 * The ACL whose mask we want to check.
344 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
345 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
346 * - @c ACL_ERROR - Unexpected library error.
348 int acl_execute_masked(acl_t acl
) {
351 perror("acl_execute_masked (args)");
356 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
358 while (ge_result
== ACL_SUCCESS
) {
359 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
361 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
362 perror("acl_execute_masked (acl_get_tag_type)");
366 if (tag
== ACL_MASK
) {
367 /* This is the mask entry, get its permissions, and see if
368 execute is specified. */
369 acl_permset_t permset
;
371 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
372 perror("acl_execute_masked (acl_get_permset)");
376 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
377 if (gp_result
== ACL_ERROR
) {
378 perror("acl_execute_masked (acl_get_perm)");
382 if (gp_result
== ACL_FAILURE
) {
383 /* No execute bit set in the mask; execute not allowed. */
388 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
397 * @brief Determine whether @c fd is executable by anyone.
400 * This is used as part of the heuristic to determine whether or not
401 * we should mask the execute bit when inheriting an ACL. If @c fd
402 * describes a file, we check the @a effective permissions, contrary
403 * to what setfacl does.
406 * The file descriptor to check.
409 * A pointer to a stat structure for @c fd.
412 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
413 * - @c ACL_FAILURE - Nobody can execute @c fd.
414 * - @c ACL_ERROR - Unexpected library error.
416 int any_can_execute(int fd
, const struct stat
* sp
) {
419 perror("any_can_execute (args)");
423 acl_t acl
= acl_get_fd(fd
);
425 if (acl
== (acl_t
)NULL
) {
426 perror("any_can_execute (acl_get_fd)");
430 /* Our return value. */
431 int result
= ACL_FAILURE
;
433 if (acl_is_minimal(acl
)) {
434 if (sp
->st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
435 result
= ACL_SUCCESS
;
439 result
= ACL_FAILURE
;
445 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
447 while (ge_result
== ACL_SUCCESS
) {
448 /* The first thing we do is check to see if this is a mask
449 entry. If it is, we skip it entirely. */
450 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
452 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
453 perror("any_can_execute_or (acl_get_tag_type)");
458 if (tag
== ACL_MASK
) {
459 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
463 /* Ok, so it's not a mask entry. Check the execute perms. */
464 acl_permset_t permset
;
466 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
467 perror("any_can_execute_or (acl_get_permset)");
472 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
473 if (gp_result
== ACL_ERROR
) {
474 perror("any_can_execute (acl_get_perm)");
479 if (gp_result
== ACL_SUCCESS
) {
480 /* Only return ACL_SUCCESS if this execute bit is not masked. */
481 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
482 result
= ACL_SUCCESS
;
487 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
490 if (ge_result
== ACL_ERROR
) {
491 perror("any_can_execute (acl_get_entry)");
504 * @brief Copy ACLs between file descriptors as xattrs, verbatim.
506 * There is a small deficiency in libacl, namely that there is no way
507 * to get or set default ACLs through file descriptors. The @c
508 * acl_get_file and @c acl_set_file functions can do it, but they use
509 * paths, and are vulnerable to symlink attacks.
511 * Fortunately, when inheriting an ACL, we don't really need to look
512 * at what it contains. That means that we can copy the on-disk xattrs
513 * from the source directory to the destination file/directory without
514 * passing through libacl, and this can be done with file descriptors
515 * through @c fgetxattr and @c fsetxattr. That's what this function
519 * The file descriptor from which the ACL will be copied.
522 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
523 * to copy from @c src_fd.
526 * The file descriptor whose ACL will be overwritten with the one
530 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
531 * to replace on @c dst_fd.
534 * - @c ACL_SUCCESS - The ACL was copied successfully.
535 * - @c ACL_FAILURE - There was no ACL on @c src_fd.
536 * - @c ACL_ERROR - Unexpected library error.
538 int acl_copy_xattr(int src_fd
,
541 acl_type_t dst_type
) {
543 const char* src_name
;
544 if (src_type
== ACL_TYPE_ACCESS
) {
545 src_name
= XATTR_NAME_POSIX_ACL_ACCESS
;
547 else if (src_type
== ACL_TYPE_DEFAULT
) {
548 src_name
= XATTR_NAME_POSIX_ACL_DEFAULT
;
552 perror("acl_copy_xattr (src type)");
556 const char* dst_name
;
557 if (dst_type
== ACL_TYPE_ACCESS
) {
558 dst_name
= XATTR_NAME_POSIX_ACL_ACCESS
;
560 else if (dst_type
== ACL_TYPE_DEFAULT
) {
561 dst_name
= XATTR_NAME_POSIX_ACL_DEFAULT
;
565 perror("acl_copy_xattr (dst type)");
569 ssize_t src_size_guess
= fgetxattr(src_fd
, src_name
, NULL
, 0);
570 if (src_size_guess
== XATTR_ERROR
) {
571 if (errno
== ENODATA
) {
572 /* A missing ACL isn't really an error. ENOATTR and ENODATA are
573 synonyms, but using ENODATA here lets us avoid another
574 "include" directive. */
577 perror("acl_copy_xattr (fgetxattr size guess)");
580 char* src_acl_p
= alloca(src_size_guess
);
581 /* The actual size may be smaller than our guess? I don't know. */
582 ssize_t src_size
= fgetxattr(src_fd
, src_name
, src_acl_p
, src_size_guess
);
583 if (src_size
== XATTR_ERROR
) {
584 if (errno
== ENODATA
) {
585 /* A missing ACL isn't an error. */
588 perror("acl_copy_xattr (fgetxattr)");
592 if (fsetxattr(dst_fd
, dst_name
, src_acl_p
, src_size
, 0) == XATTR_ERROR
) {
593 perror("acl_copy_xattr (fsetxattr)");
602 * @brief Determine if a file descriptor has a default ACL.
605 * The file descriptor whose default ACL is in question.
608 * - @c ACL_SUCCESS - If @c fd has a default ACL.
609 * - @c ACL_FAILURE - If @c fd does not have a default ACL.
610 * - @c ACL_ERROR - Unexpected library error.
612 int has_default_acl_fd(int fd
) {
613 if (fgetxattr(fd
, XATTR_NAME_POSIX_ACL_DEFAULT
, NULL
, 0) == XATTR_ERROR
) {
614 if (errno
== ENODATA
) {
617 perror("has_default_acl_fd (fgetxattr)");
626 * @brief Apply parent default ACL to a path.
628 * This overwrites any existing ACLs on @c path.
631 * The path whose ACL we would like to reset to its default.
633 * @param no_exec_mask
634 * The value (either true or false) of the --no-exec-mask flag.
637 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
638 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
639 * - @c ACL_ERROR - Unexpected library error.
641 int apply_default_acl(const char* path
, bool no_exec_mask
) {
645 perror("apply_default_acl (args)");
649 /* Define these next three variables here because we may have to
650 * jump to the cleanup routine which expects them to exist.
653 /* Our return value. */
654 int result
= ACL_SUCCESS
;
656 /* The new ACL for this path */
657 acl_t new_acl
= (acl_t
)NULL
;
659 /* A copy of new_acl, to be made before we begin mangling new_acl in
660 order to mask the execute bit. */
661 acl_t new_acl_unmasked
= (acl_t
)NULL
;
663 /* The file descriptor corresponding to "path" */
666 /* The file descriptor for the directory containing "path" */
669 /* dirname() and basename() mangle their arguments, so we need
670 to make copies of "path" before using them. */
671 char* dirname_path_copy
= NULL
;
672 char* basename_path_copy
= NULL
;
674 /* Get the parent directory of "path" with dirname(), which happens
675 * to murder its argument and necessitates a path_copy. */
676 dirname_path_copy
= strdup(path
);
677 if (dirname_path_copy
== NULL
) {
678 perror("apply_default_acl (strdup)");
681 char* parent
= dirname(dirname_path_copy
);
682 parent_fd
= safe_open(parent
, O_DIRECTORY
| O_NOFOLLOW
);
683 if (parent_fd
== OPEN_ERROR
) {
684 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
685 /* We hit a symlink, either in the last path component (ELOOP)
686 or higher up (ENOTDIR). */
687 result
= ACL_FAILURE
;
691 perror("apply_default_acl (open parent fd)");
697 /* Check to make sure the parent descriptor actually has a default
698 ACL. If it doesn't, then we can "succeed" immediately. */
699 if (has_default_acl_fd(parent_fd
) == ACL_FAILURE
) {
700 result
= ACL_SUCCESS
;
704 /* We already obtained the parent fd safely, so if we use the
705 basename of path here instead of the full thing, then we can get
706 away with using openat() and spare ourselves the slowness of
707 another safe_open(). */
708 basename_path_copy
= strdup(path
);
709 if (basename_path_copy
== NULL
) {
710 perror("apply_default_acl (strdup)");
713 fd
= openat(parent_fd
, basename(basename_path_copy
), O_NOFOLLOW
);
714 if (fd
== OPEN_ERROR
) {
715 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
716 /* We hit a symlink, either in the last path component (ELOOP)
717 or higher up (ENOTDIR). */
718 result
= ACL_FAILURE
;
722 perror("apply_default_acl (open fd)");
728 /* Refuse to operate on hard links, which can be abused by an
729 * attacker to trick us into changing the ACL on a file we didn't
730 * intend to; namely the "target" of the hard link. There is TOCTOU
731 * race condition here, but the window is as small as possible
732 * between when we open the file descriptor (look above) and when we
736 if (fstat(fd
, &s
) == STAT_ERROR
) {
737 perror("apply_default_acl (fstat)");
741 if (!S_ISDIR(s
.st_mode
)) {
742 /* If it's not a directory, make sure it's a regular,
743 non-hard-linked file. */
744 if (!S_ISREG(s
.st_mode
) || s
.st_nlink
!= 1) {
745 result
= ACL_FAILURE
;
751 /* Default to not masking the exec bit; i.e. applying the default
752 ACL literally. If --no-exec-mask was not specified, then we try
753 to "guess" whether or not to mask the exec bit. This behavior
754 is modeled after the capital 'X' perms of setfacl. */
755 bool allow_exec
= true;
758 /* Never mask the execute bit on directories. */
759 int ace_result
= any_can_execute(fd
,&s
) || S_ISDIR(s
.st_mode
);
761 if (ace_result
== ACL_ERROR
) {
762 perror("apply_default_acl (any_can_execute)");
767 allow_exec
= (bool)ace_result
;
770 /* If it's a directory, inherit the parent's default. */
771 if (S_ISDIR(s
.st_mode
)) {
772 if (acl_copy_xattr(parent_fd
,
775 ACL_TYPE_DEFAULT
) == ACL_ERROR
) {
776 perror("apply_default_acl (acl_copy_xattr default)");
782 /* If it's anything, _apply_ the parent's default. */
783 if (acl_copy_xattr(parent_fd
,
786 ACL_TYPE_ACCESS
) == ACL_ERROR
) {
787 perror("apply_default_acl (acl_copy_xattr access)");
792 /* There's a good reason why we saved the ACL above, even though
793 * we're about to read it back into memory and mess with it on the
794 * next line. The acl_copy_xattr() function is already a hack to let
795 * us copy default ACLs without resorting to path names; we simply
796 * have no way to read the parent's default ACL into memory using
797 * parent_fd. We can, however, copy the parent's ACL to a file (with
798 * acl_copy_xattr), and then read the ACL from a file using
799 * "fd". It's quite the circus, but it works and should be safe from
800 * sym/hardlink attacks.
803 /* Now we potentially need to mask the execute permissions in the
804 ACL on fd; or maybe not. */
809 /* OK, we need to mask some execute permissions. First obtain the
811 new_acl
= acl_get_fd(fd
);
812 if (new_acl
== (acl_t
)NULL
) {
813 perror("apply_default_acl (acl_get_fd)");
818 /* ...and now make a copy of it, because otherwise when we loop
819 below, some shit gets stuck (modifying the structure while
820 looping over it no worky). */
821 new_acl_unmasked
= acl_dup(new_acl
);
822 if (new_acl_unmasked
== (acl_t
)NULL
) {
823 perror("apply_default_acl (acl_dup)");
829 int ge_result
= acl_get_entry(new_acl_unmasked
, ACL_FIRST_ENTRY
, &entry
);
831 while (ge_result
== ACL_SUCCESS
) {
832 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
834 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
835 perror("apply_default_acl (acl_get_tag_type)");
841 /* We've got an entry/tag from the default ACL. Get its permset. */
842 acl_permset_t permset
;
843 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
844 perror("apply_default_acl (acl_get_permset)");
849 if (tag
== ACL_MASK
||
850 tag
== ACL_USER_OBJ
||
851 tag
== ACL_GROUP_OBJ
||
854 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
855 minimal ACLs) or acl_other entries, so if execute should be
856 masked, we have to do it manually. */
857 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
858 perror("apply_default_acl (acl_delete_perm)");
863 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
864 perror("apply_default_acl (acl_set_permset)");
870 if (acl_update_entry(new_acl
, entry
) == ACL_ERROR
) {
871 perror("apply_default_acl (acl_update_entry)");
876 ge_result
= acl_get_entry(new_acl_unmasked
, ACL_NEXT_ENTRY
, &entry
);
879 /* Catches the first acl_get_entry as well as the ones at the end of
881 if (ge_result
== ACL_ERROR
) {
882 perror("apply_default_acl (acl_get_entry)");
887 if (acl_set_fd(fd
, new_acl
) == ACL_ERROR
) {
888 perror("apply_default_acl (acl_set_fd)");
894 free(dirname_path_copy
);
895 free(basename_path_copy
);
897 acl_free(new_acl_unmasked
);
899 if (fd
> 0 && close(fd
) == CLOSE_ERROR
) {
900 perror("apply_default_acl (close fd)");
903 if (parent_fd
> 0 && close(parent_fd
) == CLOSE_ERROR
) {
904 perror("apply_default_acl (close parent_fd)");