- /* Honor the mask execute unconditionally. */
- if (has_default_mask_execute(parent)) {
- if (mode_has_perm(path_mode, S_IXGRP)) {
- path_mode |= S_IXGRP;
+ acl_entry_t entry;
+ int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
+
+ while (ge_result == 1) {
+ acl_tag_t tag = ACL_UNDEFINED_TAG;
+ int tag_result = acl_get_tag_type(entry, &tag);
+
+ if (tag_result == -1) {
+ perror("has_default_tag_acl (acl_get_tag_type)");
+ result = -1;
+ goto cleanup;
+ }
+
+
+ /* We've got an entry/tag from the default ACL. Get its permset. */
+ acl_permset_t permset;
+ int ps_result = acl_get_permset(entry, &permset);
+ if (ps_result == -1) {
+ perror("reapply_default_acl_ng (acl_get_permset)");
+ result = -1;
+ goto cleanup;
+ }
+
+ /* If this is a default mask, fix it up. */
+ if (tag == ACL_MASK ||
+ tag == ACL_USER_OBJ ||
+ tag == ACL_GROUP_OBJ ||
+ tag == ACL_OTHER) {
+ if (!allow_exec) {
+ /* The mask doesn't affect acl_user_obj, acl_group_obj (in
+ minimal ACLs) or acl_other entries, so if execute should be
+ masked, we have to do it manually. */
+ int d_result = acl_delete_perm(permset, ACL_EXECUTE);
+ if (d_result == -1) {
+ perror("reapply_default_acl_ng (acl_delete_perm)");
+ result = -1;
+ goto cleanup;
+ }
+
+ int sp_result = acl_set_permset(entry, permset);
+ if (sp_result == -1) {
+ perror("reapply_default_acl_ng (acl_set_permset)");
+ result = -1;
+ goto cleanup;
+ }
+ }