X-Git-Url: https://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=f6aa5be75e860a6cf459fbf788d77614dfabcbe5;hb=4a9f4deb191a691978a1ee57ca7580f39ad5c9e6;hp=10bdb328a487bc4696af11424e85801129b63453;hpb=d89f22c28473cd2e201500af0f970478105c632a;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 10bdb32..f6aa5be 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -1,3 +1,10 @@ +/** + * @file apply-default-acl.c + * + * @brief The entire implementation. + * + */ + /* On Linux, ftw.h needs this special voodoo to work. */ #define _XOPEN_SOURCE 500 @@ -19,10 +26,20 @@ #include +/* Command-line options */ +static bool no_exec_mask = false; + + +/** + * @brief Get the mode bits from the given path. + * + * @param path + * The path (file or directory) whose mode we want. + * + * @return A mode_t (st_mode) structure containing the mode bits. + * See sys/stat.h for details. + */ mode_t get_mode(const char* path) { - /* - * Get the mode bits from path. - */ if (path == NULL) { errno = ENOENT; return -1; @@ -41,10 +58,15 @@ mode_t get_mode(const char* path) { } +/** + * @brief Determine whether or not the given path is a regular file. + * + * @param path + * The path to test. + * + * @return true if @c path is a regular file, false otherwise. + */ bool is_regular_file(const char* path) { - /* - * Returns true if path is a regular file, false otherwise. - */ if (path == NULL) { return false; } @@ -59,10 +81,16 @@ bool is_regular_file(const char* path) { } } + +/** + * @brief Determine whether or not the given path is a directory. + * + * @param path + * The path to test. + * + * @return true if @c path is a directory, false otherwise. + */ bool is_directory(const char* path) { - /* - * Returns true if path is a directory, false otherwise. - */ if (path == NULL) { return false; } @@ -231,10 +259,83 @@ int acl_is_minimal(acl_t* acl) { } -int any_can_execute(const char* path) { - /* Returns 1 if any ACL entry has execute access, 0 if none do, and +int acl_execute_masked(const char* path) { + /* Returns 1 i the given path has an ACL mask which denies + execute. Returns 0 if it does not (or if it has no ACL/mask at + all), and -1 on error. */ + + acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); + + if (acl == (acl_t)NULL) { + return 0; + } + + /* Our return value. */ + int result = 0; + + acl_entry_t entry; + int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); + + while (ge_result == 1) { + acl_tag_t tag = ACL_UNDEFINED_TAG; + int tag_result = acl_get_tag_type(entry, &tag); + + if (tag_result == -1) { + perror("acl_execute_masked (acl_get_tag_type)"); + result = -1; + goto cleanup; + } + + if (tag == ACL_MASK) { + /* This is the mask entry, get its permissions, and see if + execute is specified. */ + acl_permset_t permset; + + int ps_result = acl_get_permset(entry, &permset); + if (ps_result == -1) { + perror("acl_execute_masked (acl_get_permset)"); + result = -1; + goto cleanup; + } + + int gp_result = acl_get_perm(permset, ACL_EXECUTE); + if (gp_result == -1) { + perror("acl_execute_masked (acl_get_perm)"); + result = -1; + goto cleanup; + } + + if (gp_result == 0) { + /* No execute bit set in the mask; execute not allowed. */ + return 1; + } + } + + ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); + } + + cleanup: + acl_free(acl); + return result; +} + + +int any_can_execute_or_dir(const char* path) { + /* If the given path is a directory, returns 1. Otherwise, returns 1 + * if any ACL entry has EFFECTIVE execute access, 0 if none do, and * -1 on error. + * + * This is meant to somewhat mimic setfacl's handling of the capital + * 'X' perm, which allows execute access if the target is a + * directory or someone can already execute it. We differ in that we + * check the effective execute rather than just the execute bits. */ + + if (is_directory(path)) { + /* That was easy... */ + return 1; + } + acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); if (acl == (acl_t)NULL) { @@ -264,28 +365,31 @@ int any_can_execute(const char* path) { int ps_result = acl_get_permset(entry, &permset); if (ps_result == -1) { - perror("any_can_execute (acl_get_permset)"); + perror("any_can_execute_or_dir (acl_get_permset)"); result = -1; goto cleanup; } int gp_result = acl_get_perm(permset, ACL_EXECUTE); if (gp_result == -1) { - perror("any_can_execute (acl_get_perm)"); + perror("any_can_execute_or_dir (acl_get_perm)"); result = -1; goto cleanup; } if (gp_result == 1) { - result = 1; - goto cleanup; + /* Only return one if this execute bit is not masked. */ + if (acl_execute_masked(path) != 1) { + result = 1; + goto cleanup; + } } ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); } if (ge_result == -1) { - perror("any_can_execute (acl_get_entry)"); + perror("any_can_execute_or_dir (acl_get_entry)"); result = -1; goto cleanup; } @@ -398,6 +502,7 @@ int apply_default_acl(const char* path) { /* Really apply the default ACL by looping through it. Returns one * for success, zero for failure (i.e. no ACL), and -1 on unexpected * errors. + */ if (path == NULL) { return 0; @@ -418,13 +523,20 @@ int apply_default_acl(const char* path) { return 0; } - int ace_result = any_can_execute(path); - if (ace_result == -1) { - perror("apply_default_acl (any_can_execute)"); + /* Default to not masking the exec bit; i.e. applying the default + ACL literally. If --no-exec-mask was not specified, then we try + to "guess" whether or not to mask the exec bit. */ + bool allow_exec = true; + + if (!no_exec_mask) { + int ace_result = any_can_execute_or_dir(path); + + if (ace_result == -1) { + perror("apply_default_acl (any_can_execute_or_dir)"); return -1; } - - bool allow_exec = (bool)ace_result; + allow_exec = (bool)ace_result; + } acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT); @@ -467,7 +579,7 @@ int apply_default_acl(const char* path) { int tag_result = acl_get_tag_type(entry, &tag); if (tag_result == -1) { - perror("has_default_tag_acl (acl_get_tag_type)"); + perror("apply_default_acl (acl_get_tag_type)"); result = -1; goto cleanup; } @@ -487,6 +599,7 @@ int apply_default_acl(const char* path) { tag == ACL_USER_OBJ || tag == ACL_GROUP_OBJ || tag == ACL_OTHER) { + if (!allow_exec) { /* The mask doesn't affect acl_user_obj, acl_group_obj (in minimal ACLs) or acl_other entries, so if execute should be @@ -550,13 +663,16 @@ void usage(char* program_name) { printf("Flags:\n"); printf(" -h, --help Print this help message\n"); printf(" -r, --recursive Act on any given directories recursively\n"); + printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n"); + + return; } int apply_default_acl_nftw(const char *target, - const struct stat *s, - int info, - struct FTW *ftw) { + const struct stat *s, + int info, + struct FTW *ftw) { /* A wrapper around the apply_default_acl() function for use with * nftw(). We need to adjust the return value so that nftw() doesn't * think we've failed. @@ -617,19 +733,20 @@ int main(int argc, char* argv[]) { return EXIT_FAILURE; } - bool recursive = false; + /* bool no_exec_mask is declared static/global */ struct option long_options[] = { /* These options set a flag. */ {"help", no_argument, NULL, 'h'}, {"recursive", no_argument, NULL, 'r'}, + {"no-exec-mask", no_argument, NULL, 'x'}, {NULL, 0, NULL, 0} }; int opt = 0; - while ((opt = getopt_long(argc, argv, "hr", long_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) { switch (opt) { case 'h': usage(argv[0]); @@ -637,6 +754,9 @@ int main(int argc, char* argv[]) { case 'r': recursive = true; break; + case 'x': + no_exec_mask = true; + break; default: usage(argv[0]); return EXIT_FAILURE;