4 * @brief The adacl (apply default acl) shared library.
8 /* Enables get_current_dir_name() in unistd.h, the O_PATH flag, and
9 * the asprintf() function.
13 #include <dirent.h> /* readdir(), etc. */
14 #include <errno.h> /* EINVAL, ELOOP, ENOTDIR, etc. */
15 #include <fcntl.h> /* openat() */
16 #include <libgen.h> /* basename(), dirname() */
17 #include <stdbool.h> /* the "bool" type */
18 #include <stdio.h> /* perror(), asprintf() */
19 #include <stdlib.h> /* free() */
20 #include <string.h> /* strdup() */
21 #include <sys/stat.h> /* fstat() */
22 #include <sys/xattr.h> /* fgetxattr(), fsetxattr() */
23 #include <unistd.h> /* get_current_dir_name() */
26 #include <acl/libacl.h> /* acl_get_perm, not portable */
27 #include <sys/acl.h> /* all other acl_foo functions */
29 /* XATTR_NAME_POSIX_ACL_ACCESS and XATTR_NAME_POSIX_ACL_DEFAULT */
30 #include <linux/xattr.h>
35 /* Even though most other library functions reliably return -1 for
36 * error, it feels a little wrong to re-use the ACL_ERROR constant.
38 #define CLOSE_ERROR -1
40 #define ASPRINTF_ERROR -1
42 #define XATTR_ERROR -1
46 int safe_open_ex(int at_fd
, char* pathname
, int flags
);
47 int safe_open(const char* pathname
, int flags
);
48 int acl_update_entry(acl_t aclp
, acl_entry_t updated_entry
);
49 int acl_entry_count(acl_t acl
);
50 int acl_is_minimal(acl_t acl
);
51 int acl_execute_masked(acl_t acl
);
52 int any_can_execute(int fd
, const struct stat
* sp
);
53 int acl_copy_xattr(int src_fd
,
57 int has_default_acl_fd(int fd
);
58 int apply_default_acl_fds(int parent_fd
, int fd
, bool recursive
);
59 int apply_default_acl(const char* path
, bool recursive
);
64 * @brief The recursive portion of the @c safe_open function, used to
65 * open a file descriptor in a symlink-safe way when combined with
66 * the @c O_NOFOLLOW flag.
69 * A file descriptor relative to which @c pathname will be opened.
72 * The path to the file/directory/whatever whose descriptor you want.
75 * File status flags to be passed to @c openat.
77 * @return a file descriptor for @c pathname if everything goes well,
78 * and @c OPEN_ERROR if not.
80 int safe_open_ex(int at_fd
, char* pathname
, int flags
) {
81 if (pathname
== NULL
) {
83 perror("safe_open_ex (args)");
87 char* firstslash
= strchr(pathname
, '/');
88 if (firstslash
== NULL
) {
89 /* No more slashes, this is the base case. */
90 return openat(at_fd
, pathname
, flags
);
92 if (firstslash
[1] == '\0') {
93 /* The first slash is the last character; ensure that we open
96 return openat(at_fd
, pathname
, flags
| O_DIRECTORY
);
99 /* The first slash exists and isn't the last character in the path,
100 so we can split the path wherever that first slash lies and
103 int fd
= openat(at_fd
, pathname
, flags
| O_DIRECTORY
| O_PATH
);
104 if (fd
== OPEN_ERROR
) {
105 if (errno
!= ENOTDIR
) {
106 /* Don't output anything if we ignore a symlink */
107 perror("safe_open_ex (safe_open_ex)");
112 /* The +1 is safe because there needs to be at least one character
113 after the first slash (we checked this above). */
114 int result
= safe_open_ex(fd
, firstslash
+1, flags
);
115 if (close(fd
) == CLOSE_ERROR
) {
116 perror("safe_open_ex (close)");
124 * @brief A version of @c open that is completely symlink-safe when
125 * used with the @c O_NOFOLLOW flag.
127 * The @c openat function exists to ensure that you can anchor one
128 * path to a particular directory while opening it; however, if you
129 * open "b/c/d" relative to "/a", then even the @c openat function will
130 * still follow symlinks in the "b" component. This can be exploited
131 * by an attacker to make you open the wrong path.
133 * To avoid that problem, this function uses a recursive
134 * implementation that opens every path from the root, one level at a
135 * time. So "a" is opened relative to "/", and then "b" is opened
136 * relative to "/a", and then "c" is opened relative to "/a/b",
137 * etc. When the @c O_NOFOLLOW flag is used, this approach ensures
138 * that no symlinks in any component are followed.
141 * The path to the file/directory/whatever whose descriptor you want.
144 * File status flags to be passed to @c openat.
146 * @return a file descriptor for @c pathname if everything goes well,
147 * and @c OPEN_ERROR if not.
149 int safe_open(const char* pathname
, int flags
) {
150 if (pathname
== NULL
) {
152 perror("safe_open (args)");
156 char* abspath
= NULL
;
157 int asprintf_result
= 0;
158 if (strchr(pathname
, '/') == pathname
) {
159 /* pathname is already absolute; just copy it. */
160 asprintf_result
= asprintf(&abspath
, "%s", pathname
);
163 /* Concatenate the current working directory and pathname into an
164 * absolute path. We use realpath() ONLY on the cwd part, and not
165 * on the pathname part, because realpath() resolves symlinks. And
166 * the whole point of all this crap is to avoid following symlinks
169 * Using realpath() on the cwd lets us operate on relative paths
170 * while we're sitting in a directory that happens to have a
171 * symlink in it; for example: cd /var/run && apply-default-acl foo.
173 char* cwd
= get_current_dir_name();
175 perror("safe_open (get_current_dir_name)");
179 char abs_cwd
[PATH_MAX
];
180 if (realpath(cwd
, abs_cwd
) == NULL
) {
181 perror("safe_open (realpath)");
185 asprintf_result
= asprintf(&abspath
, "%s/%s", abs_cwd
, pathname
);
188 if (asprintf_result
== ASPRINTF_ERROR
) {
189 perror("safe_open (asprintf)");
193 /* Beyond here, asprintf() worked, and we need to free abspath. */
194 int result
= OPEN_ERROR
;
196 bool abspath_is_root
= (strcmp(abspath
, "/") == 0);
197 int rootflags
= flags
| O_DIRECTORY
;
198 if (!abspath_is_root
) {
199 /* Use O_PATH for some added safety if "/" is not our target */
202 int rootfd
= open("/", rootflags
);
203 if (rootfd
== OPEN_ERROR
) {
204 perror("safe_open (open)");
209 if (abspath_is_root
) {
214 result
= safe_open_ex(rootfd
, abspath
+1, flags
);
215 if (close(rootfd
) == CLOSE_ERROR
) {
216 perror("safe_open (close)");
230 * @brief Update an entry in an @b minimal ACL.
233 * A pointer to the acl_t structure whose entry we want to update.
235 * @param updated_entry
236 * An updated copy of an existing entry in @c aclp.
239 * - @c ACL_SUCCESS - If we update an existing entry.
240 * - @c ACL_FAILURE - If we don't find an entry to update.
241 * - @c ACL_ERROR - Unexpected library error.
243 int acl_update_entry(acl_t aclp
, acl_entry_t updated_entry
) {
244 if (aclp
== NULL
|| updated_entry
== NULL
) {
246 perror("acl_update_entry (args)");
250 acl_tag_t updated_tag
;
251 if (acl_get_tag_type(updated_entry
, &updated_tag
) == ACL_ERROR
) {
252 perror("acl_update_entry (acl_get_tag_type)");
256 acl_permset_t updated_permset
;
257 if (acl_get_permset(updated_entry
, &updated_permset
) == ACL_ERROR
) {
258 perror("acl_update_entry (acl_get_permset)");
262 /* This can allocate memory, so from here on out we have to jump to
263 the "cleanup" label to exit. */
264 void* updated_qualifier
= acl_get_qualifier(updated_entry
);
265 if (updated_qualifier
== NULL
&&
266 (updated_tag
== ACL_USER
|| updated_tag
== ACL_GROUP
)) {
267 /* acl_get_qualifier() can return NULL, but it shouldn't for
268 ACL_USER or ACL_GROUP entries. */
269 perror("acl_update_entry (acl_get_qualifier)");
273 /* Our return value. Default to failure, and change to success if we
274 actually update something. */
275 int result
= ACL_FAILURE
;
277 acl_entry_t existing_entry
;
278 /* Loop through the given ACL looking for matching entries. */
279 int get_entry_result
= acl_get_entry(aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
281 while (get_entry_result
== ACL_SUCCESS
) {
282 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
284 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
285 perror("set_acl_tag_permset (acl_get_tag_type)");
290 if (existing_tag
== updated_tag
) {
291 /* Our tag types match, but if we have a named user or group
292 entry, then we need to check that the user/group (that is,
293 the qualifier) matches too. */
294 bool qualifiers_match
= false;
296 /* There are three ways the qualifiers can match... */
297 void* existing_qualifier
= acl_get_qualifier(existing_entry
);
298 if (existing_qualifier
== NULL
) {
299 if (existing_tag
== ACL_USER
|| existing_tag
== ACL_GROUP
) {
300 perror("acl_update_entry (acl_get_qualifier)");
305 /* First, we could be dealing with an entry that isn't a
306 named user or group, in which case they "match
308 qualifiers_match
= true;
312 /* Second, they could have matching UIDs. We don't really need to
313 check both tags here, since we know that they're equal. However,
314 clang-tidy can't figure that out, and the redundant equality
315 check prevents it from complaining about a potential null pointer
317 if (updated_tag
== ACL_USER
&& existing_tag
== ACL_USER
) {
318 qualifiers_match
= ( *((uid_t
*)existing_qualifier
)
320 *((uid_t
*)updated_qualifier
) );
323 /* Third, they could have matching GIDs. See above for why
324 we check the redundant condition existing_tag == ACL_GROUP. */
325 if (updated_tag
== ACL_GROUP
&& existing_tag
== ACL_GROUP
) {
326 qualifiers_match
= ( *((gid_t
*)existing_qualifier
)
328 *((gid_t
*)updated_qualifier
) );
331 /* Be sure to free this inside the loop, where memory is allocated. */
332 acl_free(existing_qualifier
);
334 if (qualifiers_match
) {
335 /* If we update something, we're done and return ACL_SUCCESS */
336 if (acl_set_permset(existing_entry
, updated_permset
) == ACL_ERROR
) {
337 perror("acl_update_entry (acl_set_permset)");
342 result
= ACL_SUCCESS
;
347 get_entry_result
= acl_get_entry(aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
350 /* This catches both the initial acl_get_entry and the ones at the
352 if (get_entry_result
== ACL_ERROR
) {
353 perror("acl_update_entry (acl_get_entry)");
358 acl_free(updated_qualifier
);
365 * @brief Determine the number of entries in the given ACL.
368 * The ACL to inspect.
370 * @return Either the non-negative number of entries in @c acl, or
371 * @c ACL_ERROR on error.
373 int acl_entry_count(acl_t acl
) {
377 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
379 while (result
== ACL_SUCCESS
) {
381 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
384 if (result
== ACL_ERROR
) {
385 perror("acl_entry_count (acl_get_entry)");
395 * @brief Determine whether or not the given ACL is minimal.
397 * An ACL is minimal if it has fewer than four entries.
400 * The ACL whose minimality is in question.
403 * - @c ACL_SUCCESS - @c acl is minimal
404 * - @c ACL_FAILURE - @c acl is not minimal
405 * - @c ACL_ERROR - Unexpected library error
407 int acl_is_minimal(acl_t acl
) {
410 perror("acl_is_minimal (args)");
414 int ec
= acl_entry_count(acl
);
416 if (ec
== ACL_ERROR
) {
417 perror("acl_is_minimal (acl_entry_count)");
432 * @brief Determine whether the given ACL's mask denies execute.
435 * The ACL whose mask we want to check.
438 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
439 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
440 * - @c ACL_ERROR - Unexpected library error.
442 int acl_execute_masked(acl_t acl
) {
445 perror("acl_execute_masked (args)");
450 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
452 while (ge_result
== ACL_SUCCESS
) {
453 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
455 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
456 perror("acl_execute_masked (acl_get_tag_type)");
460 if (tag
== ACL_MASK
) {
461 /* This is the mask entry, get its permissions, and see if
462 execute is specified. */
463 acl_permset_t permset
;
465 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
466 perror("acl_execute_masked (acl_get_permset)");
470 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
471 if (gp_result
== ACL_ERROR
) {
472 perror("acl_execute_masked (acl_get_perm)");
476 if (gp_result
== ACL_FAILURE
) {
477 /* No execute bit set in the mask; execute not allowed. */
482 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
491 * @brief Determine whether @c fd is executable by anyone.
494 * This is used as part of the heuristic to determine whether or not
495 * we should mask the execute bit when inheriting an ACL. If @c fd
496 * describes a file, we check the @a effective permissions, contrary
497 * to what setfacl does.
500 * The file descriptor to check.
503 * A pointer to a stat structure for @c fd.
506 * - @c ACL_SUCCESS - Someone has effective execute permissions on @c fd.
507 * - @c ACL_FAILURE - Nobody can execute @c fd.
508 * - @c ACL_ERROR - Unexpected library error.
510 int any_can_execute(int fd
, const struct stat
* sp
) {
513 perror("any_can_execute (args)");
517 acl_t acl
= acl_get_fd(fd
);
519 if (acl
== (acl_t
)NULL
) {
520 perror("any_can_execute (acl_get_fd)");
524 /* Our return value. */
525 int result
= ACL_FAILURE
;
527 if (acl_is_minimal(acl
)) {
528 if (sp
->st_mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
529 result
= ACL_SUCCESS
;
533 result
= ACL_FAILURE
;
539 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
541 while (ge_result
== ACL_SUCCESS
) {
542 /* The first thing we do is check to see if this is a mask
543 entry. If it is, we skip it entirely. */
544 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
546 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
547 perror("any_can_execute_or (acl_get_tag_type)");
552 if (tag
== ACL_MASK
) {
553 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
557 /* Ok, so it's not a mask entry. Check the execute perms. */
558 acl_permset_t permset
;
560 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
561 perror("any_can_execute_or (acl_get_permset)");
566 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
567 if (gp_result
== ACL_ERROR
) {
568 perror("any_can_execute (acl_get_perm)");
573 if (gp_result
== ACL_SUCCESS
) {
574 /* Only return ACL_SUCCESS if this execute bit is not masked. */
575 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
576 result
= ACL_SUCCESS
;
581 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
584 if (ge_result
== ACL_ERROR
) {
585 perror("any_can_execute (acl_get_entry)");
598 * @brief Copy ACLs between file descriptors as xattrs, verbatim.
600 * There is a small deficiency in libacl, namely that there is no way
601 * to get or set default ACLs through file descriptors. The @c
602 * acl_get_file and @c acl_set_file functions can do it, but they use
603 * paths, and are vulnerable to symlink attacks.
605 * Fortunately, when inheriting an ACL, we don't really need to look
606 * at what it contains. That means that we can copy the on-disk xattrs
607 * from the source directory to the destination file/directory without
608 * passing through libacl, and this can be done with file descriptors
609 * through @c fgetxattr and @c fsetxattr. That's what this function
613 * The file descriptor from which the ACL will be copied.
616 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
617 * to copy from @c src_fd.
620 * The file descriptor whose ACL will be overwritten with the one
624 * The type of ACL (either @c ACL_TYPE_ACCESS or @c ACL_TYPE_DEFAULT)
625 * to replace on @c dst_fd.
628 * - @c ACL_SUCCESS - The ACL was copied successfully.
629 * - @c ACL_FAILURE - There was no ACL on @c src_fd.
630 * - @c ACL_ERROR - Unexpected library error.
632 int acl_copy_xattr(int src_fd
,
635 acl_type_t dst_type
) {
637 const char* src_name
;
638 if (src_type
== ACL_TYPE_ACCESS
) {
639 src_name
= XATTR_NAME_POSIX_ACL_ACCESS
;
641 else if (src_type
== ACL_TYPE_DEFAULT
) {
642 src_name
= XATTR_NAME_POSIX_ACL_DEFAULT
;
646 perror("acl_copy_xattr (src type)");
650 const char* dst_name
;
651 if (dst_type
== ACL_TYPE_ACCESS
) {
652 dst_name
= XATTR_NAME_POSIX_ACL_ACCESS
;
654 else if (dst_type
== ACL_TYPE_DEFAULT
) {
655 dst_name
= XATTR_NAME_POSIX_ACL_DEFAULT
;
659 perror("acl_copy_xattr (dst type)");
663 ssize_t src_size_guess
= fgetxattr(src_fd
, src_name
, NULL
, 0);
664 if (src_size_guess
== XATTR_ERROR
) {
665 if (errno
== ENODATA
) {
666 /* A missing ACL isn't really an error. ENOATTR and ENODATA are
667 synonyms, but using ENODATA here lets us avoid another
668 "include" directive. */
671 perror("acl_copy_xattr (fgetxattr size guess)");
674 char* src_acl_p
= alloca(src_size_guess
);
675 /* The actual size may be smaller than our guess? I don't know. The
676 return value from fgetxattr() will either be nonnegative, or
677 XATTR_ERROR (which we've already ruled out), so it's safe to cast
678 it to an unsigned size_t here to avoid a compiler warning. */
679 ssize_t src_size
= fgetxattr(src_fd
,
682 (size_t)src_size_guess
);
683 if (src_size
== XATTR_ERROR
) {
684 if (errno
== ENODATA
) {
685 /* A missing ACL isn't an error. */
688 perror("acl_copy_xattr (fgetxattr)");
692 /* See above: src_size must be nonnegative at this point,so we cast
693 it to size_t to avoid a compiler warning. */
694 if (fsetxattr(dst_fd
,
700 perror("acl_copy_xattr (fsetxattr)");
709 * @brief Determine if a file descriptor has a default ACL.
712 * The file descriptor whose default ACL is in question.
715 * - @c ACL_SUCCESS - If @c fd has a default ACL.
716 * - @c ACL_FAILURE - If @c fd does not have a default ACL.
717 * - @c ACL_ERROR - Unexpected library error.
719 int has_default_acl_fd(int fd
) {
720 if (fgetxattr(fd
, XATTR_NAME_POSIX_ACL_DEFAULT
, NULL
, 0) == XATTR_ERROR
) {
721 if (errno
== ENODATA
) {
724 perror("has_default_acl_fd (fgetxattr)");
734 * @brief The recursive portion of @c apply_default_acl.
736 * The @c apply_default_acl function takes a path, but then opens file
737 * descriptors for the path and its parent. Afterwards, everything is
738 * done using file descriptors, including the recursive application on
739 * the path's children. This function encapsulates the portion of @c
740 * apply_default_acl that uses only file descriptors; for the
741 * recursion, this function ultimately calls itself.
743 * This overwrites any existing ACLs on @c fd and, if @c recursive is
744 * @c true, its children. When @c recursive is @c true, the "worst"
745 * result encountered is returned as the overall result.
748 * A file descriptor for the parent directory of @c fd.
751 * The file descriptor that should inherit its parent's default ACL.
754 * Should we recurse into subdirectories?
757 * - @c ACL_SUCCESS - The parent default ACLs were inherited successfully.
758 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
759 * - @c ACL_ERROR - Unexpected library error.
761 int apply_default_acl_fds(int parent_fd
, int fd
, bool recursive
) {
762 int result
= ACL_SUCCESS
;
764 /* The new ACL for this path */
765 acl_t new_acl
= (acl_t
)NULL
;
767 /* A copy of new_acl, to be made before we begin mangling new_acl in
768 order to mask the execute bit. */
769 acl_t new_acl_unmasked
= (acl_t
)NULL
;
771 /* Refuse to operate on hard links, which can be abused by an
772 * attacker to trick us into changing the ACL on a file we didn't
773 * intend to; namely the "target" of the hard link. There is TOCTOU
774 * race condition here, but the window is as small as possible
775 * between when we open the file descriptor (look above) and when we
779 if (fstat(fd
, &s
) == STAT_ERROR
) {
780 perror("apply_default_acl_fds (fstat)");
781 /* We can't recurse without the stat struct for fd */
786 /* Check to make sure the parent descriptor actually has a default
787 ACL. If it doesn't, then we can "succeed" immediately, saving a
788 little work, particularly in any_can_execute(). Note that we
789 can't skip the fstat() above, because we need it in case we
791 if (has_default_acl_fd(parent_fd
) == ACL_FAILURE
) {
792 result
= ACL_SUCCESS
;
793 /* Just because this target can't inherit anything doesn't mean
794 that one of it's children can't. For example, if there's a
795 default on "c" in "a/b/c/d", then we don't want to skip all
801 if (!S_ISDIR(s
.st_mode
)) {
802 /* If it's not a directory, make sure it's a regular,
803 non-hard-linked file. */
804 if (!S_ISREG(s
.st_mode
) || s
.st_nlink
!= 1) {
805 result
= ACL_FAILURE
;
806 goto cleanup
; /* It's not a directory, so we can skip the recursion. */
811 /* Next We try to guess whether or not to strip the execute bits.
812 * This behavior is modeled after the capital 'X' perms of setfacl.
814 int ace_result
= any_can_execute(fd
, &s
);
816 if (ace_result
== ACL_ERROR
) {
817 perror("apply_default_acl_fds (any_can_execute)");
822 /* Never mask the execute bit on directories. */
823 bool allow_exec
= (bool)ace_result
|| S_ISDIR(s
.st_mode
);
826 /* If it's a directory, inherit the parent's default. */
827 if (S_ISDIR(s
.st_mode
)) {
828 if (acl_copy_xattr(parent_fd
,
831 ACL_TYPE_DEFAULT
) == ACL_ERROR
) {
832 perror("apply_default_acl_fds (acl_copy_xattr default)");
838 /* If it's anything, _apply_ the parent's default. */
839 if (acl_copy_xattr(parent_fd
,
842 ACL_TYPE_ACCESS
) == ACL_ERROR
) {
843 perror("apply_default_acl_fds (acl_copy_xattr access)");
848 /* There's a good reason why we saved the ACL above, even though
849 * we're about to read it back into memory and mess with it on the
850 * next line. The acl_copy_xattr() function is already a hack to let
851 * us copy default ACLs without resorting to path names; we simply
852 * have no way to read the parent's default ACL into memory using
853 * parent_fd. We can, however, copy the parent's ACL to a file (with
854 * acl_copy_xattr), and then read the ACL from a file using
855 * "fd". It's quite the circus, but it works and should be safe from
856 * sym/hardlink attacks.
859 /* Now we potentially need to mask the execute permissions in the
860 ACL on fd; or maybe not. */
862 /* Skip the mask code for this target, but don't skip its children! */
866 /* OK, we need to mask some execute permissions. First obtain the
868 new_acl
= acl_get_fd(fd
);
869 if (new_acl
== (acl_t
)NULL
) {
870 perror("apply_default_acl_fds (acl_get_fd)");
875 /* ...and now make a copy of it, because otherwise when we loop
876 below, some shit gets stuck (modifying the structure while
877 looping over it no worky). */
878 new_acl_unmasked
= acl_dup(new_acl
);
879 if (new_acl_unmasked
== (acl_t
)NULL
) {
880 perror("apply_default_acl_fds (acl_dup)");
886 int ge_result
= acl_get_entry(new_acl_unmasked
, ACL_FIRST_ENTRY
, &entry
);
888 while (ge_result
== ACL_SUCCESS
) {
889 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
891 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
892 perror("apply_default_acl_fds (acl_get_tag_type)");
898 /* We've got an entry/tag from the default ACL. Get its permset. */
899 acl_permset_t permset
;
900 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
901 perror("apply_default_acl_fds (acl_get_permset)");
906 /* To mimic what the kernel does, I think we could drop
907 ACL_GROUP_OBJ from the list below? */
908 if (tag
== ACL_MASK
||
909 tag
== ACL_USER_OBJ
||
910 tag
== ACL_GROUP_OBJ
||
913 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
914 minimal ACLs) or acl_other entries, so if execute should be
915 masked, we have to do it manually. */
916 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
917 perror("apply_default_acl_fds (acl_delete_perm)");
922 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
923 perror("apply_default_acl_fds (acl_set_permset)");
929 if (acl_update_entry(new_acl
, entry
) == ACL_ERROR
) {
930 perror("apply_default_acl_fds (acl_update_entry)");
935 ge_result
= acl_get_entry(new_acl_unmasked
, ACL_NEXT_ENTRY
, &entry
);
938 /* Catches the first acl_get_entry as well as the ones at the end of
940 if (ge_result
== ACL_ERROR
) {
941 perror("apply_default_acl_fds (acl_get_entry)");
946 if (acl_set_fd(fd
, new_acl
) == ACL_ERROR
) {
947 perror("apply_default_acl_fds (acl_set_fd)");
953 if (recursive
&& S_ISDIR(s
.st_mode
)) {
954 /* Recurse into subdirectories. Don't call closedir() on d! It
955 closes the open file descriptor as well, and subsequent calls
956 to close() then throw errors. */
957 DIR* d
= fdopendir(fd
);
959 perror("apply_default_acl_fds (fdopendir)");
966 while ((de
= readdir(d
)) != NULL
) {
967 if (de
->d_type
!= DT_DIR
&& de
->d_type
!= DT_REG
) {
968 /* Hit a symlink or whatever. */
969 result
= ACL_FAILURE
;
972 if (strcmp(de
->d_name
, ".") == 0) { continue; }
973 if (strcmp(de
->d_name
, "..") == 0) { continue; }
975 /* Be careful not to "return" out of this loop and leave the
977 new_fd
= openat(fd
, de
->d_name
, O_NOFOLLOW
);
978 if (new_fd
== OPEN_ERROR
) {
979 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
980 /* We hit a symlink, either in the last path component (ELOOP)
981 or higher up (ENOTDIR). */
982 if (result
== ACL_SUCCESS
) {
983 /* Don't overwrite an error result with success/failure. */
984 result
= ACL_FAILURE
;
989 perror("apply_default_acl_fds (openat)");
994 switch (apply_default_acl_fds(fd
, new_fd
, recursive
)) {
995 /* Don't overwrite an error result with success/failure. */
997 if (result
== ACL_SUCCESS
) {
998 result
= ACL_FAILURE
;
1004 if (close(new_fd
) == CLOSE_ERROR
) {
1005 perror("apply_default_acl_fds (close)");
1014 acl_free(new_acl_unmasked
);
1020 * @brief Apply parent default ACL to a path and optionally its children.
1022 * This overwrites any existing ACLs on the target, and, if @c
1023 * recursive is @c true, its children. When @c recursive is @c true,
1024 * the "worst" result encountered is returned as the overall result.
1027 * The path whose ACL we would like to reset to its default.
1030 * Should we recurse into subdirectories?
1033 * - @c ACL_SUCCESS - The parent default ACLs were inherited successfully.
1034 * - @c ACL_FAILURE - If symlinks or hard links are encountered.
1035 * - @c ACL_ERROR - Unexpected library error.
1037 int apply_default_acl(const char* path
, bool recursive
) {
1041 perror("apply_default_acl (args)");
1045 /* Define these next three variables here because we may have to
1046 * jump to the cleanup routine which expects them to exist.
1049 /* Our return value. */
1050 int result
= ACL_SUCCESS
;
1052 /* The file descriptor corresponding to "path" */
1055 /* The file descriptor for the directory containing "path" */
1058 /* dirname() and basename() mangle their arguments, so we need
1059 to make copies of "path" before using them. */
1060 char* dirname_path_copy
= NULL
;
1061 char* basename_path_copy
= NULL
;
1063 /* Get the parent directory of "path" with dirname(), which happens
1064 * to murder its argument and necessitates a path_copy. */
1065 dirname_path_copy
= strdup(path
);
1066 if (dirname_path_copy
== NULL
) {
1067 perror("apply_default_acl (strdup)");
1070 char* parent
= dirname(dirname_path_copy
);
1072 basename_path_copy
= strdup(path
);
1073 if (basename_path_copy
== NULL
) {
1074 perror("apply_default_acl (strdup)");
1078 char* child
= basename(basename_path_copy
);
1080 /* Just kidding, if the path is "." or "..", then dirname will do
1081 * the wrong thing and give us "." as its parent, too. So, we handle
1082 * those as special cases. We use "child" instead of "path" here to
1083 * catch things like "./" and "../"
1085 bool path_is_dots
= strcmp(child
, ".") == 0 || strcmp(child
, "..") == 0;
1086 char dots_parent
[6] = "../";
1088 /* We know that "child" contains no more than two characters here, and
1089 using strncat to enforce that belief keeps clang-tidy happy. */
1090 parent
= strncat(dots_parent
, child
, 2);
1093 parent_fd
= safe_open(parent
, O_DIRECTORY
| O_NOFOLLOW
);
1095 if (parent_fd
== OPEN_ERROR
) {
1096 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
1097 /* We hit a symlink, either in the last path component (ELOOP)
1098 or higher up (ENOTDIR). */
1099 result
= ACL_FAILURE
;
1103 perror("apply_default_acl (open parent fd)");
1109 /* We already obtained the parent fd safely, so if we use the
1110 * basename of path here instead of the full thing, then we can get
1111 * away with using openat() and spare ourselves the slowness of
1112 * another safe_open().
1114 * Note that if the basename is "." or "..", then we don't want to
1115 * open it relative to the parent_fd, so we need another special
1116 * case for those paths here.
1119 fd
= open(child
, O_NOFOLLOW
);
1122 fd
= openat(parent_fd
, child
, O_NOFOLLOW
);
1124 if (fd
== OPEN_ERROR
) {
1125 if (errno
== ELOOP
|| errno
== ENOTDIR
) {
1126 /* We hit a symlink, either in the last path component (ELOOP)
1127 or higher up (ENOTDIR). */
1128 result
= ACL_FAILURE
;
1132 perror("apply_default_acl (open fd)");
1138 result
= apply_default_acl_fds(parent_fd
, fd
, recursive
);
1141 free(dirname_path_copy
);
1142 free(basename_path_copy
);
1144 if (parent_fd
> 0 && close(parent_fd
) == CLOSE_ERROR
) {
1145 perror("apply_default_acl (close parent_fd)");
1148 if (fd
> 0 && close(fd
) == CLOSE_ERROR
) {
1149 perror("apply_default_acl (close fd)");