+int remove_access_tag_perm(const char* path,
+ acl_tag_t desired_tag,
+ acl_perm_t perm) {
+ /* Attempt to remove perm from tag. Returns one if successful, zero
+ if there was nothing to do, and -1 on errors. */
+ acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
+ if (acl == (acl_t)NULL) {
+ /* Error. */
+ return -1;
+ }
+
+ acl_permset_t permset;
+ bool ps_result = get_access_tag_permset(path, desired_tag, &permset);
+
+ if (ps_result != 1) {
+ /* Failure or error. */
+ return ps_result;
+ }
+
+ int d_result = acl_delete_perm(permset, perm);
+ if (d_result == -1) {
+ perror("remove_access_tag_perm (acl_delete_perm)");
+ return -1;
+ }
+
+ /* We've only removed perm from the permset; now we have to replace
+ the permset. */
+ acl_entry_t entry;
+ int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
+
+ while (result == 1) {
+ acl_tag_t tag = ACL_UNDEFINED_TAG;
+ int tag_result = acl_get_tag_type(entry, &tag);
+
+ if (tag_result == -1) {
+ perror("remove_access_tag_perm (acl_get_tag_type)");
+ return -1;
+ }
+
+ if (tag == desired_tag) {
+ /* We found the right tag. Update the permset. */
+ int s_result = acl_set_permset(entry, permset);
+ if (s_result == -1) {
+ perror("remove_access_tag_perm (acl_set_permset)");
+ return -1;
+ }
+
+ int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
+ if (sf_result == -1) {
+ perror("remove_access_tag_perm (acl_set_file)");
+ return -1;
+ }
+
+ return 1;
+ }
+
+ result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
+ }
+
+ /* This catches both the initial acl_get_entry and the ones at the
+ end of the loop. */
+ if (result == -1) {
+ perror("remove_access_tag_perm (acl_get_entry)");
+ return -1;
+ }
+
+ return 0;
+}
+
+int remove_access_group_obj_execute(const char* path) {
+ return remove_access_tag_perm(path, ACL_GROUP_OBJ, ACL_EXECUTE);
+}
+
+