X-Git-Url: https://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=19505282c2acda17960281e966a9d347a5bc1611;hb=5a1f29cb6c306e9d8b19c4b3d964c4a05c0bc27d;hp=9c48b977d77adc90eb59306d12ed2549c24e6348;hpb=56883e0b8096b29cc545702f063f28619b593fe0;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 9c48b97..1950528 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -10,6 +10,7 @@ #define _GNU_SOURCE #include +#include /* AT_FOO constants */ #include /* nftw() et al. */ #include #include /* dirname() */ @@ -33,10 +34,6 @@ #define ACL_SUCCESS 1 -/* Command-line options */ -static bool no_exec_mask = false; - - /** * @brief Get the mode bits from the given path. @@ -54,13 +51,13 @@ mode_t get_mode(const char* path) { } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return s.st_mode; } else { - /* errno will be set already by stat() */ + /* errno will be set already by lstat() */ return result; } } @@ -81,7 +78,7 @@ bool is_regular_file(const char* path) { } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return S_ISREG(s.st_mode); } @@ -92,6 +89,42 @@ bool is_regular_file(const char* path) { +/** + * @brief Determine whether or not the given path is accessible. + * + * @param path + * The path to test. + * + * @return true if @c path is accessible to the current effective + * user/group, false otherwise. + */ +bool path_accessible(const char* path) { + if (path == NULL) { + return false; + } + + /* Test for access using the effective user and group rather than + the real one. */ + int flags = AT_EACCESS; + + /* Don't follow symlinks when checking for a path's existence, + since we won't follow them to set its ACLs either. */ + flags |= AT_SYMLINK_NOFOLLOW; + + /* If the path is relative, interpret it relative to the current + working directory (just like the access() system call). */ + int result = faccessat(AT_FDCWD, path, F_OK, flags); + + if (result == 0) { + return true; + } + else { + return false; + } +} + + + /** * @brief Determine whether or not the given path is a directory. * @@ -106,7 +139,7 @@ bool is_directory(const char* path) { } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return S_ISDIR(s.st_mode); } @@ -125,9 +158,9 @@ bool is_directory(const char* path) { * on each path before applying the default to it. * * The assumption that there are no extended entries makes things much - * simpler. For example, we only have to update the ACL_USER_OBJ, - * ACL_GROUP_OBJ, and ACL_OTHER entries -- all others can simply be - * created anew. This means we don't have to fool around comparing + * simpler. For example, we only have to update the @c ACL_USER_OBJ, + * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply + * be created anew. This means we don't have to fool around comparing * named-user/group entries. * * @param aclp @@ -137,8 +170,8 @@ bool is_directory(const char* path) { * The new entry. If @c entry contains a user/group/other entry, we * update the existing one. Otherwise we create a new entry. * - * @return If there is an unexpected library error, ACL_ERROR is - * returned. Otherwise, ACL_SUCCESS. + * @return If there is an unexpected library error, @c ACL_ERROR is + * returned. Otherwise, @c ACL_SUCCESS. * */ int acl_set_entry(acl_t* aclp, @@ -254,10 +287,10 @@ int acl_set_entry(acl_t* aclp, * @brief Determine the number of entries in the given ACL. * * @param acl - * A pointer to an acl_t structure. + * A pointer to an @c acl_t structure. * * @return Either the non-negative number of entries in @c acl, or - * ACL_ERROR on error. + * @c ACL_ERROR on error. */ int acl_entry_count(acl_t* acl) { @@ -289,9 +322,9 @@ int acl_entry_count(acl_t* acl) { * A pointer to an acl_t structure. * * @return - * - ACL_SUCCESS - @c acl is minimal - * - ACL_FAILURE - @c acl is not minimal - * - ACL_ERROR - Unexpected library error + * - @c ACL_SUCCESS - @c acl is minimal + * - @c ACL_FAILURE - @c acl is not minimal + * - @c ACL_ERROR - Unexpected library error */ int acl_is_minimal(acl_t* acl) { @@ -320,10 +353,10 @@ int acl_is_minimal(acl_t* acl) { * The path to check. * * @return - * - ACL_SUCCESS - @c path has a mask which denies execute. - * - ACL_FAILURE - The ACL for @c path does not deny execute, + * - @c ACL_SUCCESS - @c path has a mask which denies execute. + * - @c ACL_FAILURE - The ACL for @c path does not deny execute, * or @c path has no extended ACL at all. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_ERROR - Unexpected library error. */ int acl_execute_masked(const char* path) { @@ -384,6 +417,7 @@ int acl_execute_masked(const char* path) { } + /** * @brief Determine whether @c path is executable (by anyone) or a * directory. @@ -400,10 +434,11 @@ int acl_execute_masked(const char* path) { * The path to check. * * @return - * - ACL_SUCCESS - @c path is a directory, or someone has effective + * - @c ACL_SUCCESS - @c path is a directory, or someone has effective execute permissions. - * - ACL_FAILURE - @c path is a regular file and nobody can execute it. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_FAILURE - @c path is a regular file and nobody can execute + it. + * - @c ACL_ERROR - Unexpected library error. */ int any_can_execute_or_dir(const char* path) { @@ -438,6 +473,23 @@ int any_can_execute_or_dir(const char* path) { int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); while (ge_result == ACL_SUCCESS) { + /* The first thing we do is check to see if this is a mask + entry. If it is, we skip it entirely. */ + acl_tag_t tag = ACL_UNDEFINED_TAG; + int tag_result = acl_get_tag_type(entry, &tag); + + if (tag_result == ACL_ERROR) { + perror("any_can_execute_or_dir (acl_get_tag_type)"); + result = ACL_ERROR; + goto cleanup; + } + + if (tag == ACL_MASK) { + ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); + continue; + } + + /* Ok, so it's not a mask entry. Check the execute perms. */ acl_permset_t permset; int ps_result = acl_get_permset(entry, &permset); @@ -455,7 +507,7 @@ int any_can_execute_or_dir(const char* path) { } if (gp_result == ACL_SUCCESS) { - /* Only return one if this execute bit is not masked. */ + /* Only return ACL_SUCCESS if this execute bit is not masked. */ if (acl_execute_masked(path) != ACL_SUCCESS) { result = ACL_SUCCESS; goto cleanup; @@ -492,15 +544,11 @@ int any_can_execute_or_dir(const char* path) { * The target directory whose ACL we wish to overwrite (or create). * * @return - * - ACL_SUCCESS - The default ACL was inherited successfully. - * - ACL_FAILURE - Either @c parent or @c path is not a directory. - * - ACL_ERROR - Unexpected library error. + * - @c ACL_SUCCESS - The default ACL was inherited successfully. + * - @c ACL_FAILURE - Either @c parent or @c path is not a directory. + * - @c ACL_ERROR - Unexpected library error. */ int inherit_default_acl(const char* path, const char* parent) { - /* Inherit the default ACL from parent to path. This overwrites any - * existing default ACL. Returns 1 for success, 0 for failure, and - * -1 on error. - */ /* Our return value. */ int result = ACL_SUCCESS; @@ -541,16 +589,26 @@ int inherit_default_acl(const char* path, const char* parent) { } + +/** + * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries + * from the given path. + * + * @param path + * The path whose ACLs we want to wipe. + * + * @return + * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none + * existed in the first place. + * - @c ACL_ERROR - Unexpected library error. + */ int wipe_acls(const char* path) { - /* Remove ACL_USER, ACL_GROUP, and ACL_MASK entries from - path. Returns 1 for success, 0 for failure, and -1 on error. */ if (path == NULL) { errno = ENOENT; return ACL_ERROR; } - /* Finally, remove individual named/mask entries. */ acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); if (acl == (acl_t)NULL) { perror("wipe_acls (acl_get_file)"); @@ -595,14 +653,29 @@ int wipe_acls(const char* path) { } -int apply_default_acl(const char* path) { - /* Really apply the default ACL by looping through it. Returns one - * for success, zero for failure (i.e. no ACL), and -1 on unexpected - * errors. - */ +/** + * @brief Apply parent default ACL to a path. + * + * This overwrites any existing ACLs on @c path. + * + * @param path + * The path whose ACL we would like to reset to its default. + * + * @param no_exec_mask + * The value (either true or false) of the --no-exec-mask flag. + * + * @return + * - @c ACL_SUCCESS - The parent default ACL was inherited successfully. + * - @c ACL_FAILURE - The target path is not a regular file/directory, + * or the parent of @c path is not a directory. + * - @c ACL_ERROR - Unexpected library error. + */ +int apply_default_acl(const char* path, bool no_exec_mask) { + if (path == NULL) { - return ACL_FAILURE; + errno = ENOENT; + return ACL_ERROR; } if (!is_regular_file(path) && !is_directory(path)) { @@ -629,9 +702,10 @@ int apply_default_acl(const char* path) { int ace_result = any_can_execute_or_dir(path); if (ace_result == ACL_ERROR) { - perror("apply_default_acl (any_can_execute_or_dir)"); - return ACL_ERROR; - } + perror("apply_default_acl (any_can_execute_or_dir)"); + return ACL_ERROR; + } + allow_exec = (bool)ace_result; } @@ -749,10 +823,15 @@ int apply_default_acl(const char* path) { } -void usage(char* program_name) { - /* - * Print usage information. - */ + +/** + * @brief Display program usage information. + * + * @param program_name + * The program name to use in the output. + * + */ +void usage(const char* program_name) { printf("Apply any applicable default ACLs to the given files or " "directories.\n\n"); printf("Usage: %s [flags] [ [ ...]]\n\n", @@ -766,16 +845,24 @@ void usage(char* program_name) { } +/** + * @brief Wrapper around @c apply_default_acl() for use with @c nftw(). + * + * For parameter information, see the @c nftw man page. + * + * @return If the ACL was applied to @c target successfully, we return + * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto + * the next file or directory. Otherwise, we return @c FTW_STOP to + * signal failure. + * + */ int apply_default_acl_nftw(const char *target, const struct stat *s, int info, struct FTW *ftw) { - /* A wrapper around the apply_default_acl() function for use with - * nftw(). We need to adjust the return value so that nftw() doesn't - * think we've failed. - */ - bool reapp_result = apply_default_acl(target); - if (reapp_result) { + + bool app_result = apply_default_acl(target, false); + if (app_result) { return FTW_CONTINUE; } else { @@ -784,25 +871,72 @@ int apply_default_acl_nftw(const char *target, } -bool apply_default_acl_recursive(const char *target) { - /* Attempt to apply default ACLs recursively. If target is a - * directory, we recurse through its entries. If not, we just - * apply the default ACL to target. - * - * We ignore symlinks for consistency with chmod -r. - * - */ + +/** + * @brief Wrapper around @c apply_default_acl() for use with @c nftw(). + * + * This is identical to @c apply_default_acl_nftw(), except it passes + * @c true to @c apply_default_acl() as its no_exec_mask argument. + * + */ +int apply_default_acl_nftw_x(const char *target, + const struct stat *s, + int info, + struct FTW *ftw) { + + bool app_result = apply_default_acl(target, true); + if (app_result) { + return FTW_CONTINUE; + } + else { + return FTW_STOP; + } +} + + + +/** + * @brief Recursive version of @c apply_default_acl(). + * + * If @c target is a directory, we use @c nftw() to call @c + * apply_default_acl() recursively on all of its children. Otherwise, + * we just delegate to @c apply_default_acl(). + * + * We ignore symlinks for consistency with chmod -r. + * + * @param target + * The root (path) of the recursive application. + * + * @param no_exec_mask + * The value (either true or false) of the --no-exec-mask flag. + * + * @return + * If @c target is not a directory, we return the result of + * calling @c apply_default_acl() on @c target. Otherwise, we convert + * the return value of @c nftw(). If @c nftw() succeeds (returns 0), + * then we return @c true. Otherwise, we return @c false. + * \n\n + * If there is an error, it will be reported via @c perror, but + * we still return @c false. + */ +bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { + if (!is_directory(target)) { - return apply_default_acl(target); + return apply_default_acl(target, no_exec_mask); } int max_levels = 256; int flags = FTW_PHYS; /* Don't follow links. */ - int nftw_result = nftw(target, - apply_default_acl_nftw, - max_levels, - flags); + /* There are two separate functions that could be passed to + nftw(). One passes no_exec_mask = true to apply_default_acl(), + and the other passes no_exec_mask = false. Since the function we + pass to nftw() cannot have parameters, we have to create separate + options and make the decision here. */ + int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL; + fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw; + + int nftw_result = nftw(target, fn, max_levels, flags); if (nftw_result == 0) { /* Success */ @@ -821,17 +955,24 @@ bool apply_default_acl_recursive(const char *target) { } + +/** + * @brief Call apply_default_acl (possibly recursively) on each + * command-line argument. + * + * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything + * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return + * @c EXIT_FAILURE. + */ int main(int argc, char* argv[]) { - /* - * Call apply_default_acl on each command-line argument. - */ + if (argc < 2) { usage(argv[0]); return EXIT_FAILURE; } bool recursive = false; - /* bool no_exec_mask is declared static/global */ + bool no_exec_mask = false; struct option long_options[] = { /* These options set a flag. */ @@ -867,12 +1008,23 @@ int main(int argc, char* argv[]) { const char* target = argv[arg_index]; bool reapp_result = false; + /* Make sure we can access the given path before we go out of our + * way to please it. Doing this check outside of + * apply_default_acl() lets us spit out a better error message for + * typos, too. + */ + if (!path_accessible(target)) { + fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target); + result = EXIT_FAILURE; + continue; + } + if (recursive) { - reapp_result = apply_default_acl_recursive(target); + reapp_result = apply_default_acl_recursive(target, no_exec_mask); } else { - /* It's either normal file, or we're not operating recursively. */ - reapp_result = apply_default_acl(target); + /* It's either a normal file, or we're not operating recursively. */ + reapp_result = apply_default_acl(target, no_exec_mask); } if (!reapp_result) {