src/apply-default-acl.c

   1 /**
   2  * @file apply-default-acl.c
   3  *
   4  * @brief The entire implementation.
   5  *
   6  */
   7
   8 /* On Linux, ftw.h needs this special voodoo to work. */
   9 #define _XOPEN_SOURCE 500
  10 #define _GNU_SOURCE
  11
  12 #include <errno.h>
  13 #include <fcntl.h>  /* AT_FOO constants */
  14 #include <ftw.h>    /* nftw() et al. */
  15 #include <getopt.h>
  16 #include <libgen.h> /* dirname()     */
  17 #include <limits.h> /* PATH_MAX      */
  18 #include <stdbool.h>
  19 #include <stdio.h>
  20 #include <stdlib.h>
  21 #include <string.h>
  22 #include <sys/stat.h>
  23 #include <unistd.h>
  24
  25 /* ACLs */
  26 #include <acl/libacl.h> /* acl_get_perm, not portable */
  27 #include <sys/types.h>
  28 #include <sys/acl.h>
  29
  30 /* Most of the libacl functions return 1 for success, 0 for failure,
  31    and -1 on error */
  32 #define ACL_ERROR -1
  33 #define ACL_FAILURE 0
  34 #define ACL_SUCCESS 1
  35
  36
  37
  38 /**
  39  * @brief Get the mode bits from the given path.
  40  *
  41  * @param path
  42  *   The path (file or directory) whose mode we want.
  43  *
  44  * @return A mode_t (st_mode) structure containing the mode bits.
  45  *   See sys/stat.h for details.
  46  */
  47 mode_t get_mode(const char* path) {
  48   if (path == NULL) {
  49     errno = ENOENT;
  50     return -1;
  51   }
  52
  53   struct stat s;
  54   int result = stat(path, &s);
  55
  56   if (result == 0) {
  57     return s.st_mode;
  58   }
  59   else {
  60     /* errno will be set already by stat() */
  61     return result;
  62   }
  63 }
  64
  65
  66
  67 /**
  68  * @brief Determine whether or not the given path is a regular file.
  69  *
  70  * @param path
  71  *   The path to test.
  72  *
  73  * @return true if @c path is a regular file, false otherwise.
  74  */
  75 bool is_regular_file(const char* path) {
  76   if (path == NULL) {
  77     return false;
  78   }
  79
  80   struct stat s;
  81   int result = stat(path, &s);
  82   if (result == 0) {
  83     return S_ISREG(s.st_mode);
  84   }
  85   else {
  86     return false;
  87   }
  88 }
  89
  90
  91
  92 /**
  93  * @brief Determine whether or not the given path is accessible.
  94  *
  95  * @param path
  96  *   The path to test.
  97  *
  98  * @return true if @c path is accessible to the current effective
  99  *   user/group, false otherwise.
 100  */
 101 bool path_accessible(const char* path) {
 102   if (path == NULL) {
 103     return false;
 104   }
 105
 106   /*  Test for access using the effective user and group rather than
 107       the real one. */
 108   int flags = AT_EACCESS;
 109
 110   /* Don't follow symlinks when checking for a path's existence,
 111      since we won't follow them to set its ACLs either. */
 112   flags |= AT_SYMLINK_NOFOLLOW;
 113
 114   /* If the path is relative, interpret it relative to the current
 115      working directory (just like the access() system call). */
 116   int result = faccessat(AT_FDCWD, path, F_OK, flags);
 117
 118   if (result == 0) {
 119     return true;
 120   }
 121   else {
 122     return false;
 123   }
 124 }
 125
 126
 127
 128 /**
 129  * @brief Determine whether or not the given path is a directory.
 130  *
 131  * @param path
 132  *   The path to test.
 133  *
 134  * @return true if @c path is a directory, false otherwise.
 135  */
 136 bool is_directory(const char* path) {
 137   if (path == NULL) {
 138     return false;
 139   }
 140
 141   struct stat s;
 142   int result = stat(path, &s);
 143   if (result == 0) {
 144     return S_ISDIR(s.st_mode);
 145   }
 146   else {
 147     return false;
 148   }
 149 }
 150
 151
 152
 153 /**
 154  * @brief Update (or create) an entry in an @b minimal ACL.
 155  *
 156  * This function will not work if @c aclp contains extended
 157  * entries. This is fine for our purposes, since we call @c wipe_acls
 158  * on each path before applying the default to it.
 159  *
 160  * The assumption that there are no extended entries makes things much
 161  * simpler. For example, we only have to update the @c ACL_USER_OBJ,
 162  * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
 163  * be created anew. This means we don't have to fool around comparing
 164  * named-user/group entries.
 165  *
 166  * @param aclp
 167  *   A pointer to the acl_t structure whose entry we want to modify.
 168  *
 169  * @param entry
 170  *   The new entry. If @c entry contains a user/group/other entry, we
 171  *   update the existing one. Otherwise we create a new entry.
 172  *
 173  * @return If there is an unexpected library error, @c ACL_ERROR is
 174  *   returned. Otherwise, @c ACL_SUCCESS.
 175  *
 176  */
 177 int acl_set_entry(acl_t* aclp,
 178                   acl_entry_t entry) {
 179
 180   acl_tag_t entry_tag;
 181   int gt_result = acl_get_tag_type(entry, &entry_tag);
 182   if (gt_result == ACL_ERROR) {
 183     perror("acl_set_entry (acl_get_tag_type)");
 184     return ACL_ERROR;
 185   }
 186
 187   acl_permset_t entry_permset;
 188   int ps_result = acl_get_permset(entry, &entry_permset);
 189   if (ps_result == ACL_ERROR) {
 190     perror("acl_set_entry (acl_get_permset)");
 191     return ACL_ERROR;
 192   }
 193
 194   acl_entry_t existing_entry;
 195   /* Loop through the given ACL looking for matching entries. */
 196   int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);
 197
 198   while (result == ACL_SUCCESS) {
 199     acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
 200     int tag_result = acl_get_tag_type(existing_entry, &existing_tag);
 201
 202     if (tag_result == ACL_ERROR) {
 203        perror("set_acl_tag_permset (acl_get_tag_type)");
 204        return ACL_ERROR;
 205     }
 206
 207     if (existing_tag == entry_tag) {
 208       if (entry_tag == ACL_USER_OBJ ||
 209           entry_tag == ACL_GROUP_OBJ ||
 210           entry_tag == ACL_OTHER) {
 211         /* Only update for these three since all other tags will have
 212            been wiped. These three are guaranteed to exist, so if we
 213            match one of them, we're allowed to return ACL_SUCCESS
 214            below and bypass the rest of the function. */
 215         acl_permset_t existing_permset;
 216         int gep_result = acl_get_permset(existing_entry, &existing_permset);
 217         if (gep_result == ACL_ERROR) {
 218           perror("acl_set_entry (acl_get_permset)");
 219           return ACL_ERROR;
 220         }
 221
 222         int s_result = acl_set_permset(existing_entry, entry_permset);
 223         if (s_result == ACL_ERROR) {
 224           perror("acl_set_entry (acl_set_permset)");
 225           return ACL_ERROR;
 226         }
 227
 228         return ACL_SUCCESS;
 229       }
 230
 231     }
 232
 233     result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
 234   }
 235
 236   /* This catches both the initial acl_get_entry and the ones at the
 237      end of the loop. */
 238   if (result == ACL_ERROR) {
 239     perror("acl_set_entry (acl_get_entry)");
 240     return ACL_ERROR;
 241   }
 242
 243   /* If we've made it this far, we need to add a new entry to the
 244      ACL. */
 245   acl_entry_t new_entry;
 246
 247   /* We allocate memory here that we should release! */
 248   int c_result = acl_create_entry(aclp, &new_entry);
 249   if (c_result == ACL_ERROR) {
 250     perror("acl_set_entry (acl_create_entry)");
 251     return ACL_ERROR;
 252   }
 253
 254   int st_result = acl_set_tag_type(new_entry, entry_tag);
 255   if (st_result == ACL_ERROR) {
 256     perror("acl_set_entry (acl_set_tag_type)");
 257     return ACL_ERROR;
 258   }
 259
 260   int s_result = acl_set_permset(new_entry, entry_permset);
 261   if (s_result == ACL_ERROR) {
 262     perror("acl_set_entry (acl_set_permset)");
 263     return ACL_ERROR;
 264   }
 265
 266   if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
 267     /* We need to set the qualifier too. */
 268     void* entry_qual = acl_get_qualifier(entry);
 269     if (entry_qual == (void*)NULL) {
 270       perror("acl_set_entry (acl_get_qualifier)");
 271       return ACL_ERROR;
 272     }
 273
 274     int sq_result = acl_set_qualifier(new_entry, entry_qual);
 275     if (sq_result == ACL_ERROR) {
 276       perror("acl_set_entry (acl_set_qualifier)");
 277       return ACL_ERROR;
 278     }
 279   }
 280
 281   return ACL_SUCCESS;
 282 }
 283
 284
 285
 286 /**
 287  * @brief Determine the number of entries in the given ACL.
 288  *
 289  * @param acl
 290  *   A pointer to an @c acl_t structure.
 291  *
 292  * @return Either the non-negative number of entries in @c acl, or
 293  *   @c ACL_ERROR on error.
 294  */
 295 int acl_entry_count(acl_t* acl) {
 296
 297   acl_entry_t entry;
 298   int entry_count = 0;
 299   int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry);
 300
 301   while (result == ACL_SUCCESS) {
 302     entry_count++;
 303     result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry);
 304   }
 305
 306   if (result == ACL_ERROR) {
 307     perror("acl_entry_count (acl_get_entry)");
 308     return ACL_ERROR;
 309   }
 310
 311   return entry_count;
 312 }
 313
 314
 315
 316 /**
 317  * @brief Determine whether or not the given ACL is minimal.
 318  *
 319  * An ACL is minimal if it has fewer than four entries.
 320  *
 321  * @param acl
 322  *   A pointer to an acl_t structure.
 323  *
 324  * @return
 325  *   - @c ACL_SUCCESS - @c acl is minimal
 326  *   - @c ACL_FAILURE - @c acl is not minimal
 327  *   - @c ACL_ERROR - Unexpected library error
 328  */
 329 int acl_is_minimal(acl_t* acl) {
 330
 331   int ec = acl_entry_count(acl);
 332
 333   if (ec == ACL_ERROR) {
 334     perror("acl_is_minimal (acl_entry_count)");
 335     return ACL_ERROR;
 336   }
 337
 338   if (ec < 4) {
 339     return ACL_SUCCESS;
 340   }
 341   else {
 342     return ACL_FAILURE;
 343   }
 344 }
 345
 346
 347
 348 /**
 349  * @brief Determine whether the given path has an ACL whose mask
 350  *   denies execute.
 351  *
 352  * @param path
 353  *   The path to check.
 354  *
 355  * @return
 356  *   - @c ACL_SUCCESS - @c path has a mask which denies execute.
 357  *   - @c ACL_FAILURE - The ACL for @c path does not deny execute,
 358  *     or @c path has no extended ACL at all.
 359  *   - @c ACL_ERROR - Unexpected library error.
 360  */
 361 int acl_execute_masked(const char* path) {
 362
 363   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 364
 365   if (acl == (acl_t)NULL) {
 366     perror("acl_execute_masked (acl_get_file)");
 367     return ACL_ERROR;
 368   }
 369
 370   /* Our return value. */
 371   int result = ACL_FAILURE;
 372
 373   acl_entry_t entry;
 374   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 375
 376   while (ge_result == ACL_SUCCESS) {
 377     acl_tag_t tag = ACL_UNDEFINED_TAG;
 378     int tag_result = acl_get_tag_type(entry, &tag);
 379
 380     if (tag_result == ACL_ERROR) {
 381        perror("acl_execute_masked (acl_get_tag_type)");
 382        result = ACL_ERROR;
 383        goto cleanup;
 384     }
 385
 386     if (tag == ACL_MASK) {
 387       /* This is the mask entry, get its permissions, and see if
 388          execute is specified. */
 389       acl_permset_t permset;
 390
 391       int ps_result = acl_get_permset(entry, &permset);
 392       if (ps_result == ACL_ERROR) {
 393         perror("acl_execute_masked (acl_get_permset)");
 394         result = ACL_ERROR;
 395         goto cleanup;
 396       }
 397
 398       int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 399       if (gp_result == ACL_ERROR) {
 400         perror("acl_execute_masked (acl_get_perm)");
 401         result = ACL_ERROR;
 402         goto cleanup;
 403       }
 404
 405       if (gp_result == ACL_FAILURE) {
 406         /* No execute bit set in the mask; execute not allowed. */
 407         return ACL_SUCCESS;
 408       }
 409     }
 410
 411     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 412   }
 413
 414  cleanup:
 415   acl_free(acl);
 416   return result;
 417 }
 418
 419
 420
 421 /**
 422  * @brief Determine whether @c path is executable (by anyone) or a
 423  *   directory.
 424  *
 425  * This is used as part of the heuristic to determine whether or not
 426  * we should mask the execute bit when inheriting an ACL. If @c path
 427  * is a directory, the answer is a clear-cut yes. This behavior is
 428  * modeled after the capital 'X' perms of setfacl.
 429  *
 430  * If @c path is a file, we check the @a effective permissions,
 431  * contrary to what setfacl does.
 432  *
 433  * @param path
 434  *   The path to check.
 435  *
 436  * @return
 437  *   - @c ACL_SUCCESS - @c path is a directory, or someone has effective
 438        execute permissions.
 439  *   - @c ACL_FAILURE - @c path is a regular file and nobody can execute
 440        it.
 441  *   - @c ACL_ERROR - Unexpected library error.
 442  */
 443 int any_can_execute_or_dir(const char* path) {
 444
 445   if (is_directory(path)) {
 446     /* That was easy... */
 447     return ACL_SUCCESS;
 448   }
 449
 450   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 451
 452   if (acl == (acl_t)NULL) {
 453     perror("any_can_execute_or_dir (acl_get_file)");
 454     return ACL_ERROR;
 455   }
 456
 457   /* Our return value. */
 458   int result = ACL_FAILURE;
 459
 460   if (acl_is_minimal(&acl)) {
 461     mode_t mode = get_mode(path);
 462     if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
 463       result = ACL_SUCCESS;
 464       goto cleanup;
 465     }
 466     else {
 467       result = ACL_FAILURE;
 468       goto cleanup;
 469     }
 470   }
 471
 472   acl_entry_t entry;
 473   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 474
 475   while (ge_result == ACL_SUCCESS) {
 476     /* The first thing we do is check to see if this is a mask
 477        entry. If it is, we skip it entirely. */
 478     acl_tag_t tag = ACL_UNDEFINED_TAG;
 479     int tag_result = acl_get_tag_type(entry, &tag);
 480
 481     if (tag_result == ACL_ERROR) {
 482       perror("any_can_execute_or_dir (acl_get_tag_type)");
 483       result = ACL_ERROR;
 484       goto cleanup;
 485     }
 486
 487     if (tag == ACL_MASK) {
 488       ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 489       continue;
 490     }
 491
 492     /* Ok, so it's not a mask entry. Check the execute perms. */
 493     acl_permset_t permset;
 494
 495     int ps_result = acl_get_permset(entry, &permset);
 496     if (ps_result == ACL_ERROR) {
 497       perror("any_can_execute_or_dir (acl_get_permset)");
 498       result = ACL_ERROR;
 499       goto cleanup;
 500     }
 501
 502     int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 503     if (gp_result == ACL_ERROR) {
 504       perror("any_can_execute_or_dir (acl_get_perm)");
 505       result = ACL_ERROR;
 506       goto cleanup;
 507     }
 508
 509     if (gp_result == ACL_SUCCESS) {
 510       /* Only return ACL_SUCCESS if this execute bit is not masked. */
 511       if (acl_execute_masked(path) != ACL_SUCCESS) {
 512         result = ACL_SUCCESS;
 513         goto cleanup;
 514       }
 515     }
 516
 517     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 518   }
 519
 520   if (ge_result == ACL_ERROR) {
 521     perror("any_can_execute_or_dir (acl_get_entry)");
 522     result = ACL_ERROR;
 523     goto cleanup;
 524   }
 525
 526  cleanup:
 527   acl_free(acl);
 528   return result;
 529 }
 530
 531
 532
 533 /**
 534  * @brief Inherit the default ACL from @c parent to @c path.
 535  *
 536  * The @c parent parameter does not necessarily need to be the parent
 537  * of @c path, although that will usually be the case. This overwrites
 538  * any existing default ACL on @c path.
 539  *
 540  * @param parent
 541  *   The parent directory whose ACL we want to inherit.
 542  *
 543  * @param path
 544  *   The target directory whose ACL we wish to overwrite (or create).
 545  *
 546  * @return
 547  *   - @c ACL_SUCCESS - The default ACL was inherited successfully.
 548  *   - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
 549  *   - @c ACL_ERROR - Unexpected library error.
 550  */
 551 int inherit_default_acl(const char* path, const char* parent) {
 552
 553   /* Our return value. */
 554   int result = ACL_SUCCESS;
 555
 556   if (path == NULL) {
 557     errno = ENOENT;
 558     return ACL_ERROR;
 559   }
 560
 561   if (!is_directory(path) || !is_directory(parent)) {
 562     return ACL_FAILURE;
 563   }
 564
 565   acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 566   if (parent_acl == (acl_t)NULL) {
 567     perror("inherit_default_acl (acl_get_file)");
 568     return ACL_ERROR;
 569   }
 570
 571   acl_t path_acl = acl_dup(parent_acl);
 572
 573   if (path_acl == (acl_t)NULL) {
 574     perror("inherit_default_acl (acl_dup)");
 575     acl_free(parent_acl);
 576     return ACL_ERROR;
 577   }
 578
 579   int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
 580   if (sf_result == -1) {
 581     perror("inherit_default_acl (acl_set_file)");
 582     result = ACL_ERROR;
 583     goto cleanup;
 584   }
 585
 586  cleanup:
 587   acl_free(path_acl);
 588   return result;
 589 }
 590
 591
 592
 593 /**
 594  * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
 595  *   from the given path.
 596  *
 597  * @param path
 598  *   The path whose ACLs we want to wipe.
 599  *
 600  * @return
 601  *   - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
 602  *     existed in the first place.
 603  *   - @c ACL_ERROR - Unexpected library error.
 604  */
 605 int wipe_acls(const char* path) {
 606
 607   if (path == NULL) {
 608     errno = ENOENT;
 609     return ACL_ERROR;
 610   }
 611
 612   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 613   if (acl == (acl_t)NULL) {
 614     perror("wipe_acls (acl_get_file)");
 615     return ACL_ERROR;
 616   }
 617
 618   /* Our return value. */
 619   int result = ACL_SUCCESS;
 620
 621   acl_entry_t entry;
 622   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 623
 624   while (ge_result == ACL_SUCCESS) {
 625     int d_result = acl_delete_entry(acl, entry);
 626     if (d_result == ACL_ERROR) {
 627       perror("wipe_acls (acl_delete_entry)");
 628       result = ACL_ERROR;
 629       goto cleanup;
 630     }
 631
 632     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 633   }
 634
 635   /* Catches the first acl_get_entry as well as the ones at the end of
 636      the loop. */
 637   if (ge_result == ACL_ERROR) {
 638     perror("wipe_acls (acl_get_entry)");
 639     result = ACL_ERROR;
 640     goto cleanup;
 641   }
 642
 643   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 644   if (sf_result == ACL_ERROR) {
 645     perror("wipe_acls (acl_set_file)");
 646     result = ACL_ERROR;
 647     goto cleanup;
 648   }
 649
 650  cleanup:
 651   acl_free(acl);
 652   return result;
 653 }
 654
 655
 656
 657 /**
 658  * @brief Apply parent default ACL to a path.
 659  *
 660  * This overwrites any existing ACLs on @c path.
 661  *
 662  * @param path
 663  *   The path whose ACL we would like to reset to its default.
 664  *
 665  * @param no_exec_mask
 666  *   The value (either true or false) of the --no-exec-mask flag.
 667  *
 668  * @return
 669  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 670  *   - @c ACL_FAILURE - The target path is not a regular file/directory,
 671  *     or the parent of @c path is not a directory.
 672  *   - @c ACL_ERROR - Unexpected library error.
 673  */
 674 int apply_default_acl(const char* path, bool no_exec_mask) {
 675
 676   if (path == NULL) {
 677     errno = ENOENT;
 678     return ACL_ERROR;
 679   }
 680
 681   if (!is_regular_file(path) && !is_directory(path)) {
 682     return ACL_FAILURE;
 683   }
 684
 685   /* dirname mangles its argument */
 686   char path_copy[PATH_MAX];
 687   strncpy(path_copy, path, PATH_MAX-1);
 688   path_copy[PATH_MAX-1] = 0;
 689
 690   char* parent = dirname(path_copy);
 691   if (!is_directory(parent)) {
 692     /* Make sure dirname() did what we think it did. */
 693     return ACL_FAILURE;
 694   }
 695
 696   /* Default to not masking the exec bit; i.e. applying the default
 697      ACL literally. If --no-exec-mask was not specified, then we try
 698      to "guess" whether or not to mask the exec bit. */
 699   bool allow_exec = true;
 700
 701   if (!no_exec_mask) {
 702     int ace_result = any_can_execute_or_dir(path);
 703
 704     if (ace_result == ACL_ERROR) {
 705       perror("apply_default_acl (any_can_execute_or_dir)");
 706       return ACL_ERROR;
 707     }
 708
 709     allow_exec = (bool)ace_result;
 710   }
 711
 712   acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 713
 714   if (defacl == (acl_t)NULL) {
 715     perror("apply_default_acl (acl_get_file)");
 716     return ACL_ERROR;
 717   }
 718
 719   /* Our return value. */
 720   int result = ACL_SUCCESS;
 721
 722   int wipe_result = wipe_acls(path);
 723   if (wipe_result == ACL_ERROR) {
 724     perror("apply_default_acl (wipe_acls)");
 725     result = ACL_ERROR;
 726     goto cleanup;
 727   }
 728
 729   /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
 730      ACL with this one. */
 731   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 732   if (acl == (acl_t)NULL) {
 733     perror("apply_default_acl (acl_get_file)");
 734     return ACL_ERROR;
 735   }
 736
 737   /* If it's a directory, inherit the parent's default. */
 738   int inherit_result = inherit_default_acl(path, parent);
 739   if (inherit_result == ACL_ERROR) {
 740     perror("apply_default_acl (inherit_acls)");
 741     result = ACL_ERROR;
 742     goto cleanup;
 743   }
 744
 745   acl_entry_t entry;
 746   int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
 747
 748   while (ge_result == ACL_SUCCESS) {
 749     acl_tag_t tag = ACL_UNDEFINED_TAG;
 750     int tag_result = acl_get_tag_type(entry, &tag);
 751
 752     if (tag_result == ACL_ERROR) {
 753        perror("apply_default_acl (acl_get_tag_type)");
 754        result = ACL_ERROR;
 755        goto cleanup;
 756     }
 757
 758
 759     /* We've got an entry/tag from the default ACL. Get its permset. */
 760     acl_permset_t permset;
 761     int ps_result = acl_get_permset(entry, &permset);
 762     if (ps_result == ACL_ERROR) {
 763       perror("apply_default_acl (acl_get_permset)");
 764       result = ACL_ERROR;
 765       goto cleanup;
 766     }
 767
 768     /* If this is a default mask, fix it up. */
 769     if (tag == ACL_MASK ||
 770         tag == ACL_USER_OBJ ||
 771         tag == ACL_GROUP_OBJ ||
 772         tag == ACL_OTHER) {
 773
 774       if (!allow_exec) {
 775         /* The mask doesn't affect acl_user_obj, acl_group_obj (in
 776            minimal ACLs) or acl_other entries, so if execute should be
 777            masked, we have to do it manually. */
 778         int d_result = acl_delete_perm(permset, ACL_EXECUTE);
 779         if (d_result == ACL_ERROR) {
 780           perror("apply_default_acl (acl_delete_perm)");
 781           result = ACL_ERROR;
 782           goto cleanup;
 783         }
 784
 785         int sp_result = acl_set_permset(entry, permset);
 786         if (sp_result == ACL_ERROR) {
 787           perror("apply_default_acl (acl_set_permset)");
 788           result = ACL_ERROR;
 789           goto cleanup;
 790         }
 791       }
 792     }
 793
 794     /* Finally, add the permset to the access ACL. */
 795     int set_result = acl_set_entry(&acl, entry);
 796     if (set_result == ACL_ERROR) {
 797       perror("apply_default_acl (acl_set_entry)");
 798       result = ACL_ERROR;
 799       goto cleanup;
 800     }
 801
 802     ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
 803   }
 804
 805   /* Catches the first acl_get_entry as well as the ones at the end of
 806      the loop. */
 807   if (ge_result == ACL_ERROR) {
 808     perror("apply_default_acl (acl_get_entry)");
 809     result = ACL_ERROR;
 810     goto cleanup;
 811   }
 812
 813   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 814   if (sf_result == ACL_ERROR) {
 815     perror("apply_default_acl (acl_set_file)");
 816     result = ACL_ERROR;
 817     goto cleanup;
 818   }
 819
 820  cleanup:
 821   acl_free(defacl);
 822   return result;
 823 }
 824
 825
 826
 827 /**
 828  * @brief Display program usage information.
 829  *
 830  * @param program_name
 831  *   The program name to use in the output.
 832  *
 833  */
 834 void usage(const char* program_name) {
 835   printf("Apply any applicable default ACLs to the given files or "
 836          "directories.\n\n");
 837   printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
 838          program_name);
 839   printf("Flags:\n");
 840   printf(" -h, --help         Print this help message\n");
 841   printf(" -r, --recursive    Act on any given directories recursively\n");
 842   printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
 843
 844   return;
 845 }
 846
 847
 848 /**
 849  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 850  *
 851  * For parameter information, see the @c nftw man page.
 852  *
 853  * @return If the ACL was applied to @c target successfully, we return
 854  *   @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
 855  *   the next file or directory. Otherwise, we return @c FTW_STOP to
 856  *   signal failure.
 857  *
 858  */
 859 int apply_default_acl_nftw(const char *target,
 860                            const struct stat *s,
 861                            int info,
 862                            struct FTW *ftw) {
 863
 864   bool app_result = apply_default_acl(target, false);
 865   if (app_result) {
 866     return FTW_CONTINUE;
 867   }
 868   else {
 869     return FTW_STOP;
 870   }
 871 }
 872
 873
 874
 875 /**
 876  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 877  *
 878  * This is identical to @c apply_default_acl_nftw(), except it passes
 879  * @c true to @c apply_default_acl() as its no_exec_mask argument.
 880  *
 881  */
 882 int apply_default_acl_nftw_x(const char *target,
 883                              const struct stat *s,
 884                              int info,
 885                              struct FTW *ftw) {
 886
 887   bool app_result = apply_default_acl(target, true);
 888   if (app_result) {
 889     return FTW_CONTINUE;
 890   }
 891   else {
 892     return FTW_STOP;
 893   }
 894 }
 895
 896
 897
 898 /**
 899  * @brief Recursive version of @c apply_default_acl().
 900  *
 901  * If @c target is a directory, we use @c nftw() to call @c
 902  * apply_default_acl() recursively on all of its children. Otherwise,
 903  * we just delegate to @c apply_default_acl().
 904  *
 905  * We ignore symlinks for consistency with chmod -r.
 906  *
 907  * @param target
 908  *   The root (path) of the recursive application.
 909  *
 910  * @param no_exec_mask
 911  *   The value (either true or false) of the --no-exec-mask flag.
 912  *
 913  * @return
 914  *   If @c target is not a directory, we return the result of
 915  *   calling @c apply_default_acl() on @c target. Otherwise, we convert
 916  *   the return value of @c nftw(). If @c nftw() succeeds (returns 0),
 917  *   then we return @c true. Otherwise, we return @c false.
 918  *   \n\n
 919  *   If there is an error, it will be reported via @c perror, but
 920  *   we still return @c false.
 921  */
 922 bool apply_default_acl_recursive(const char *target, bool no_exec_mask) {
 923
 924   if (!is_directory(target)) {
 925     return apply_default_acl(target, no_exec_mask);
 926   }
 927
 928   int max_levels = 256;
 929   int flags = FTW_PHYS; /* Don't follow links. */
 930
 931   /* There are two separate functions that could be passed to
 932      nftw(). One passes no_exec_mask = true to apply_default_acl(),
 933      and the other passes no_exec_mask = false. Since the function we
 934      pass to nftw() cannot have parameters, we have to create separate
 935      options and make the decision here. */
 936   int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL;
 937   fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw;
 938
 939   int nftw_result = nftw(target, fn, max_levels, flags);
 940
 941   if (nftw_result == 0) {
 942     /* Success */
 943     return true;
 944   }
 945
 946   /* nftw will return -1 on error, or if the supplied function
 947    * (apply_default_acl_nftw) returns a non-zero result, nftw will
 948    * return that.
 949    */
 950   if (nftw_result == -1) {
 951     perror("apply_default_acl_recursive (nftw)");
 952   }
 953
 954   return false;
 955 }
 956
 957
 958
 959 /**
 960  * @brief Call apply_default_acl (possibly recursively) on each
 961  * command-line argument.
 962  *
 963  * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
 964  *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
 965  *   @c EXIT_FAILURE.
 966  */
 967 int main(int argc, char* argv[]) {
 968
 969   if (argc < 2) {
 970     usage(argv[0]);
 971     return EXIT_FAILURE;
 972   }
 973
 974   bool recursive = false;
 975   bool no_exec_mask = false;
 976
 977   struct option long_options[] = {
 978     /* These options set a flag. */
 979     {"help",      no_argument, NULL, 'h'},
 980     {"recursive", no_argument, NULL, 'r'},
 981     {"no-exec-mask", no_argument, NULL, 'x'},
 982     {NULL,        0,           NULL, 0}
 983   };
 984
 985   int opt = 0;
 986
 987   while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
 988     switch (opt) {
 989     case 'h':
 990       usage(argv[0]);
 991       return EXIT_SUCCESS;
 992     case 'r':
 993       recursive = true;
 994       break;
 995     case 'x':
 996       no_exec_mask = true;
 997       break;
 998     default:
 999       usage(argv[0]);
1000       return EXIT_FAILURE;
1001     }
1002   }
1003
1004   int result = EXIT_SUCCESS;
1005
1006   int arg_index = 1;
1007   for (arg_index = optind; arg_index < argc; arg_index++) {
1008     const char* target = argv[arg_index];
1009     bool reapp_result = false;
1010
1011     /* Make sure we can access the given path before we go out of our
1012      * way to please it. Doing this check outside of
1013      * apply_default_acl() lets us spit out a better error message for
1014      * typos, too.
1015      */
1016     if (!path_accessible(target)) {
1017       fprintf(stderr, "%s: %s: no such file or directory\n", argv[0], target);
1018       result = EXIT_FAILURE;
1019       continue;
1020     }
1021
1022     if (recursive) {
1023       reapp_result = apply_default_acl_recursive(target, no_exec_mask);
1024     }
1025     else {
1026       /* It's either a normal file, or we're not operating recursively. */
1027       reapp_result = apply_default_acl(target, no_exec_mask);
1028     }
1029
1030     if (!reapp_result) {
1031       result = EXIT_FAILURE;
1032     }
1033   }
1034
1035   return result;
1036 }