2 * @file apply-default-acl.c
4 * @brief The entire implementation.
8 /* On Linux, ftw.h needs this special voodoo to work. */
9 #define _XOPEN_SOURCE 500
13 #include <fcntl.h> /* AT_FOO constants */
14 #include <ftw.h> /* nftw() et al. */
16 #include <libgen.h> /* basename(), dirname() */
25 #include <acl/libacl.h> /* acl_get_perm, not portable */
26 #include <sys/types.h>
29 /* Most of the libacl functions return 1 for success, 0 for failure,
38 * @brief Get the mode bits from the given file descriptor.
41 * The file descriptor (which may reference a directory) whose
44 * @return A mode_t (st_mode) structure containing the mode bits.
45 * See sys/stat.h for details.
47 mode_t
get_mode(int fd
) {
54 int result
= fstat(fd
, &s
);
60 /* errno will be set already by lstat() */
68 * @brief Determine if the given file descriptor might refer to an
72 * The file descriptor whose link count we want to investigate.
74 * @return true if we are certain that @c fd does not describe a hard
75 * link, and false otherwise. In case of error, false is returned,
76 * because we are not sure that @c fd is not a hard link.
78 bool is_hardlink_safe(int fd
) {
83 if (fstat(fd
, &s
) == 0) {
84 return (s
.st_nlink
== 1 || S_ISDIR(s
.st_mode
));
93 * @brief Determine whether or not the given file descriptor is for
97 * The file descriptor to test for regular-fileness.
99 * @return true if @c fd describes a regular file, and false otherwise.
101 bool is_regular_file(int fd
) {
107 if (fstat(fd
, &s
) == 0) {
108 return S_ISREG(s
.st_mode
);
118 * @brief Determine whether or not the given path is accessible.
123 * @return true if @c path is accessible to the current effective
124 * user/group, false otherwise.
126 bool path_accessible(const char* path
) {
131 /* Test for access using the effective user and group rather than
133 int flags
= AT_EACCESS
;
135 /* Don't follow symlinks when checking for a path's existence,
136 since we won't follow them to set its ACLs either. */
137 flags
|= AT_SYMLINK_NOFOLLOW
;
139 /* If the path is relative, interpret it relative to the current
140 working directory (just like the access() system call). */
141 if (faccessat(AT_FDCWD
, path
, F_OK
, flags
) == 0) {
152 * @brief Determine whether or not the given path is a directory.
157 * @return true if @c path is a directory, false otherwise.
159 bool is_path_directory(const char* path
) {
165 if (lstat(path
, &s
) == 0) {
166 return S_ISDIR(s
.st_mode
);
175 * @brief Determine whether or not the given file descriptor is for
179 * The file descriptor whose directoryness is in question.
181 * @return true if @c fd describes a directory, and false otherwise.
183 bool is_directory(int fd
) {
189 if (fstat(fd
, &s
) == 0) {
190 return S_ISDIR(s
.st_mode
);
200 * @brief Update (or create) an entry in an @b minimal ACL.
202 * This function will not work if @c aclp contains extended
203 * entries. This is fine for our purposes, since we call @c wipe_acls
204 * on each path before applying the default to it.
206 * The assumption that there are no extended entries makes things much
207 * simpler. For example, we only have to update the @c ACL_USER_OBJ,
208 * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
209 * be created anew. This means we don't have to fool around comparing
210 * named-user/group entries.
213 * A pointer to the acl_t structure whose entry we want to modify.
216 * The new entry. If @c entry contains a user/group/other entry, we
217 * update the existing one. Otherwise we create a new entry.
219 * @return If there is an unexpected library error, @c ACL_ERROR is
220 * returned. Otherwise, @c ACL_SUCCESS.
223 int acl_set_entry(acl_t
* aclp
,
227 if (acl_get_tag_type(entry
, &entry_tag
) == ACL_ERROR
) {
228 perror("acl_set_entry (acl_get_tag_type)");
232 acl_permset_t entry_permset
;
233 if (acl_get_permset(entry
, &entry_permset
) == ACL_ERROR
) {
234 perror("acl_set_entry (acl_get_permset)");
238 acl_entry_t existing_entry
;
239 /* Loop through the given ACL looking for matching entries. */
240 int result
= acl_get_entry(*aclp
, ACL_FIRST_ENTRY
, &existing_entry
);
242 while (result
== ACL_SUCCESS
) {
243 acl_tag_t existing_tag
= ACL_UNDEFINED_TAG
;
245 if (acl_get_tag_type(existing_entry
, &existing_tag
) == ACL_ERROR
) {
246 perror("set_acl_tag_permset (acl_get_tag_type)");
250 if (existing_tag
== entry_tag
) {
251 if (entry_tag
== ACL_USER_OBJ
||
252 entry_tag
== ACL_GROUP_OBJ
||
253 entry_tag
== ACL_OTHER
) {
254 /* Only update for these three since all other tags will have
255 been wiped. These three are guaranteed to exist, so if we
256 match one of them, we're allowed to return ACL_SUCCESS
257 below and bypass the rest of the function. */
258 acl_permset_t existing_permset
;
259 if (acl_get_permset(existing_entry
, &existing_permset
) == ACL_ERROR
) {
260 perror("acl_set_entry (acl_get_permset)");
264 if (acl_set_permset(existing_entry
, entry_permset
) == ACL_ERROR
) {
265 perror("acl_set_entry (acl_set_permset)");
274 result
= acl_get_entry(*aclp
, ACL_NEXT_ENTRY
, &existing_entry
);
277 /* This catches both the initial acl_get_entry and the ones at the
279 if (result
== ACL_ERROR
) {
280 perror("acl_set_entry (acl_get_entry)");
284 /* If we've made it this far, we need to add a new entry to the
286 acl_entry_t new_entry
;
288 /* The acl_create_entry() function can allocate new memory and/or
289 * change the location of the ACL structure entirely. When that
290 * happens, the value pointed to by aclp is updated, which means
291 * that a new acl_t gets "passed out" to our caller, eventually to
292 * be fed to acl_free(). In other words, we should still be freeing
293 * the right thing, even if the value pointed to by aclp changes.
295 if (acl_create_entry(aclp
, &new_entry
) == ACL_ERROR
) {
296 perror("acl_set_entry (acl_create_entry)");
300 if (acl_set_tag_type(new_entry
, entry_tag
) == ACL_ERROR
) {
301 perror("acl_set_entry (acl_set_tag_type)");
305 if (acl_set_permset(new_entry
, entry_permset
) == ACL_ERROR
) {
306 perror("acl_set_entry (acl_set_permset)");
310 if (entry_tag
== ACL_USER
|| entry_tag
== ACL_GROUP
) {
311 /* We need to set the qualifier too. */
312 void* entry_qual
= acl_get_qualifier(entry
);
313 if (entry_qual
== (void*)NULL
) {
314 perror("acl_set_entry (acl_get_qualifier)");
318 if (acl_set_qualifier(new_entry
, entry_qual
) == ACL_ERROR
) {
319 perror("acl_set_entry (acl_set_qualifier)");
330 * @brief Determine the number of entries in the given ACL.
333 * The ACL to inspect.
335 * @return Either the non-negative number of entries in @c acl, or
336 * @c ACL_ERROR on error.
338 int acl_entry_count(acl_t acl
) {
342 int result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
344 while (result
== ACL_SUCCESS
) {
346 result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
349 if (result
== ACL_ERROR
) {
350 perror("acl_entry_count (acl_get_entry)");
360 * @brief Determine whether or not the given ACL is minimal.
362 * An ACL is minimal if it has fewer than four entries.
365 * The ACL whose minimality is in question.
368 * - @c ACL_SUCCESS - @c acl is minimal
369 * - @c ACL_FAILURE - @c acl is not minimal
370 * - @c ACL_ERROR - Unexpected library error
372 int acl_is_minimal(acl_t acl
) {
374 int ec
= acl_entry_count(acl
);
376 if (ec
== ACL_ERROR
) {
377 perror("acl_is_minimal (acl_entry_count)");
392 * @brief Determine whether the given ACL's mask denies execute.
395 * The ACL whose mask we want to check.
398 * - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
399 * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
400 * - @c ACL_ERROR - Unexpected library error.
402 int acl_execute_masked(acl_t acl
) {
405 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
407 while (ge_result
== ACL_SUCCESS
) {
408 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
410 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
411 perror("acl_execute_masked (acl_get_tag_type)");
415 if (tag
== ACL_MASK
) {
416 /* This is the mask entry, get its permissions, and see if
417 execute is specified. */
418 acl_permset_t permset
;
420 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
421 perror("acl_execute_masked (acl_get_permset)");
425 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
426 if (gp_result
== ACL_ERROR
) {
427 perror("acl_execute_masked (acl_get_perm)");
431 if (gp_result
== ACL_FAILURE
) {
432 /* No execute bit set in the mask; execute not allowed. */
437 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
446 * @brief Determine whether @c fd is executable (by anyone) or a
449 * This is used as part of the heuristic to determine whether or not
450 * we should mask the execute bit when inheriting an ACL. If @c fd
451 * describes a directory, the answer is a clear-cut yes. This behavior
452 * is modeled after the capital 'X' perms of setfacl.
454 * If @c fd describes a file, we check the @a effective permissions,
455 * contrary to what setfacl does.
458 * The file descriptor to check.
461 * - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective
463 * - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute
465 * - @c ACL_ERROR - Unexpected library error.
467 int any_can_execute_or_dir(int fd
) {
469 if (is_directory(fd
)) {
470 /* That was easy... */
474 acl_t acl
= acl_get_fd(fd
);
476 if (acl
== (acl_t
)NULL
) {
477 perror("any_can_execute_or_dir (acl_get_file)");
481 /* Our return value. */
482 int result
= ACL_FAILURE
;
484 if (acl_is_minimal(acl
)) {
485 mode_t mode
= get_mode(fd
);
486 if (mode
& (S_IXUSR
| S_IXOTH
| S_IXGRP
)) {
487 result
= ACL_SUCCESS
;
491 result
= ACL_FAILURE
;
497 int ge_result
= acl_get_entry(acl
, ACL_FIRST_ENTRY
, &entry
);
499 while (ge_result
== ACL_SUCCESS
) {
500 /* The first thing we do is check to see if this is a mask
501 entry. If it is, we skip it entirely. */
502 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
504 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
505 perror("any_can_execute_or_dir (acl_get_tag_type)");
510 if (tag
== ACL_MASK
) {
511 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
515 /* Ok, so it's not a mask entry. Check the execute perms. */
516 acl_permset_t permset
;
518 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
519 perror("any_can_execute_or_dir (acl_get_permset)");
524 int gp_result
= acl_get_perm(permset
, ACL_EXECUTE
);
525 if (gp_result
== ACL_ERROR
) {
526 perror("any_can_execute_or_dir (acl_get_perm)");
531 if (gp_result
== ACL_SUCCESS
) {
532 /* Only return ACL_SUCCESS if this execute bit is not masked. */
533 if (acl_execute_masked(acl
) != ACL_SUCCESS
) {
534 result
= ACL_SUCCESS
;
539 ge_result
= acl_get_entry(acl
, ACL_NEXT_ENTRY
, &entry
);
542 if (ge_result
== ACL_ERROR
) {
543 perror("any_can_execute_or_dir (acl_get_entry)");
556 * @brief Set @c acl as the default ACL on @c path if it's a directory.
558 * This overwrites any existing default ACL on @c path. If no default
559 * ACL exists, then one is created. If @c path is not a directory, we
560 * return ACL_FAILURE but no error is raised.
563 * The target directory whose ACL we wish to replace or create.
566 * The ACL to set as default on @c path.
569 * - @c ACL_SUCCESS - The default ACL was assigned successfully.
570 * - @c ACL_FAILURE - If @c path is not a directory.
571 * - @c ACL_ERROR - Unexpected library error.
573 int assign_default_acl(const char* path
, acl_t acl
) {
580 if (!is_path_directory(path
)) {
584 /* Our return value; success unless something bad happens. */
585 int result
= ACL_SUCCESS
;
586 acl_t path_acl
= acl_dup(acl
);
588 if (path_acl
== (acl_t
)NULL
) {
589 perror("assign_default_acl (acl_dup)");
590 return ACL_ERROR
; /* Nothing to clean up in this case. */
593 if (acl_set_file(path
, ACL_TYPE_DEFAULT
, path_acl
) == ACL_ERROR
) {
594 perror("assign_default_acl (acl_set_file)");
605 * @brief Remove all @c ACL_TYPE_ACCESS entries from the given file
606 * descriptor, leaving the UNIX permission bits.
609 * The file descriptor whose ACLs we want to wipe.
612 * - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
613 * existed in the first place.
614 * - @c ACL_ERROR - Unexpected library error.
616 int wipe_acls(int fd
) {
617 /* Initialize an empty ACL, and then overwrite the one on "fd" with it. */
618 acl_t empty_acl
= acl_init(0);
620 if (empty_acl
== (acl_t
)NULL
) {
621 perror("wipe_acls (acl_init)");
625 if (acl_set_fd(fd
, empty_acl
) == ACL_ERROR
) {
626 perror("wipe_acls (acl_set_fd)");
638 * @brief Apply parent default ACL to a path.
640 * This overwrites any existing ACLs on @c path.
643 * The path whose ACL we would like to reset to its default.
645 * @param no_exec_mask
646 * The value (either true or false) of the --no-exec-mask flag.
649 * - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
650 * - @c ACL_FAILURE - The target path is not a regular file/directory,
651 * or the parent of @c path is not a directory.
652 * - @c ACL_ERROR - Unexpected library error.
654 int apply_default_acl(const char* path
, bool no_exec_mask
) {
661 /* Define these next three variables here because we may have to
662 * jump to the cleanup routine which expects them to exist.
665 /* Our return value. */
666 int result
= ACL_SUCCESS
;
668 /* The default ACL on path's parent directory */
669 acl_t defacl
= (acl_t
)NULL
;
671 /* The file descriptor corresponding to "path" */
674 /* Split "path" into base/dirname parts to be used with openat().
675 * We duplicate the strings involved because dirname/basename mangle
678 char* path_copy
= strdup(path
);
679 if (path_copy
== NULL
) {
680 perror("apply_default_acl (strdup)");
683 char* parent
= dirname(path_copy
);
685 fd
= open(path
, O_NOFOLLOW
);
687 if (errno
== ELOOP
) {
688 result
= ACL_FAILURE
; /* hit a symlink */
692 perror("apply_default_acl (open fd)");
699 /* Refuse to operate on hard links, which can be abused by an
700 * attacker to trick us into changing the ACL on a file we didn't
701 * intend to; namely the "target" of the hard link. There is TOCTOU
702 * race condition here, but the window is as small as possible
703 * between when we open the file descriptor (look above) and when we
706 if (!is_hardlink_safe(fd
)) {
707 result
= ACL_FAILURE
;
711 if (!is_regular_file(fd
) && !is_directory(fd
)) {
712 result
= ACL_FAILURE
;
716 /* Default to not masking the exec bit; i.e. applying the default
717 ACL literally. If --no-exec-mask was not specified, then we try
718 to "guess" whether or not to mask the exec bit. */
719 bool allow_exec
= true;
722 int ace_result
= any_can_execute_or_dir(fd
);
724 if (ace_result
== ACL_ERROR
) {
725 perror("apply_default_acl (any_can_execute_or_dir)");
730 allow_exec
= (bool)ace_result
;
733 defacl
= acl_get_file(parent
, ACL_TYPE_DEFAULT
);
735 if (defacl
== (acl_t
)NULL
) {
736 perror("apply_default_acl (acl_get_file)");
741 if (wipe_acls(fd
) == ACL_ERROR
) {
742 perror("apply_default_acl (wipe_acls)");
747 /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
748 ACL with this one. */
749 acl_t acl
= acl_get_fd(fd
);
750 if (acl
== (acl_t
)NULL
) {
751 perror("apply_default_acl (acl_get_fd)");
756 /* If it's a directory, inherit the parent's default. */
757 if (assign_default_acl(path
, defacl
) == ACL_ERROR
) {
758 perror("apply_default_acl (assign_default_acl)");
764 int ge_result
= acl_get_entry(defacl
, ACL_FIRST_ENTRY
, &entry
);
766 while (ge_result
== ACL_SUCCESS
) {
767 acl_tag_t tag
= ACL_UNDEFINED_TAG
;
769 if (acl_get_tag_type(entry
, &tag
) == ACL_ERROR
) {
770 perror("apply_default_acl (acl_get_tag_type)");
776 /* We've got an entry/tag from the default ACL. Get its permset. */
777 acl_permset_t permset
;
778 if (acl_get_permset(entry
, &permset
) == ACL_ERROR
) {
779 perror("apply_default_acl (acl_get_permset)");
784 /* If this is a default mask, fix it up. */
785 if (tag
== ACL_MASK
||
786 tag
== ACL_USER_OBJ
||
787 tag
== ACL_GROUP_OBJ
||
791 /* The mask doesn't affect acl_user_obj, acl_group_obj (in
792 minimal ACLs) or acl_other entries, so if execute should be
793 masked, we have to do it manually. */
794 if (acl_delete_perm(permset
, ACL_EXECUTE
) == ACL_ERROR
) {
795 perror("apply_default_acl (acl_delete_perm)");
800 if (acl_set_permset(entry
, permset
) == ACL_ERROR
) {
801 perror("apply_default_acl (acl_set_permset)");
808 /* Finally, add the permset to the access ACL. It's actually
809 * important that we pass in the address of "acl" here, and not
810 * "acl" itself. Why? The call to acl_create_entry() within
811 * acl_set_entry() can allocate new memory for the entry.
812 * Sometimes that can be done in-place, in which case everything
813 * is cool and the new memory gets released when we call
816 * But occasionally, the whole ACL structure will have to be moved
817 * in order to allocate the extra space. When that happens,
818 * acl_create_entry() modifies the pointer it was passed (in this
819 * case, &acl) to point to the new location. We want to call
820 * acl_free() on the new location, and since acl_free() gets
821 * called right here, we need acl_create_entry() to update the
822 * value of "acl". To do that, it needs the address of "acl".
824 if (acl_set_entry(&acl
, entry
) == ACL_ERROR
) {
825 perror("apply_default_acl (acl_set_entry)");
830 ge_result
= acl_get_entry(defacl
, ACL_NEXT_ENTRY
, &entry
);
833 /* Catches the first acl_get_entry as well as the ones at the end of
835 if (ge_result
== ACL_ERROR
) {
836 perror("apply_default_acl (acl_get_entry)");
841 if (acl_set_fd(fd
, acl
) == ACL_ERROR
) {
842 perror("apply_default_acl (acl_set_fd)");
849 if (defacl
!= (acl_t
)NULL
) {
852 if (fd
>= 0 && close(fd
) == -1) {
853 perror("apply_default_acl (close)");
862 * @brief Display program usage information.
864 * @param program_name
865 * The program name to use in the output.
868 void usage(const char* program_name
) {
869 printf("Apply any applicable default ACLs to the given files or "
871 printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
874 printf(" -h, --help Print this help message\n");
875 printf(" -r, --recursive Act on any given directories recursively\n");
876 printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
883 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
885 * For parameter information, see the @c nftw man page.
887 * @return If the ACL was applied to @c target successfully, we return
888 * @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
889 * the next file or directory. Otherwise, we return @c FTW_STOP to
893 int apply_default_acl_nftw(const char *target
,
894 const struct stat
*s
,
898 if (apply_default_acl(target
, false)) {
909 * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
911 * This is identical to @c apply_default_acl_nftw(), except it passes
912 * @c true to @c apply_default_acl() as its no_exec_mask argument.
915 int apply_default_acl_nftw_x(const char *target
,
916 const struct stat
*s
,
920 if (apply_default_acl(target
, true)) {
931 * @brief Recursive version of @c apply_default_acl().
933 * If @c target is a directory, we use @c nftw() to call @c
934 * apply_default_acl() recursively on all of its children. Otherwise,
935 * we just delegate to @c apply_default_acl().
937 * We ignore symlinks for consistency with chmod -r.
940 * The root (path) of the recursive application.
942 * @param no_exec_mask
943 * The value (either true or false) of the --no-exec-mask flag.
946 * If @c target is not a directory, we return the result of
947 * calling @c apply_default_acl() on @c target. Otherwise, we convert
948 * the return value of @c nftw(). If @c nftw() succeeds (returns 0),
949 * then we return @c true. Otherwise, we return @c false.
951 * If there is an error, it will be reported via @c perror, but
952 * we still return @c false.
954 bool apply_default_acl_recursive(const char *target
, bool no_exec_mask
) {
956 if (!is_path_directory(target
)) {
957 return apply_default_acl(target
, no_exec_mask
);
960 int max_levels
= 256;
961 int flags
= FTW_PHYS
; /* Don't follow links. */
963 /* There are two separate functions that could be passed to
964 nftw(). One passes no_exec_mask = true to apply_default_acl(),
965 and the other passes no_exec_mask = false. Since the function we
966 pass to nftw() cannot have parameters, we have to create separate
967 options and make the decision here. */
968 int (*fn
)(const char *, const struct stat
*, int, struct FTW
*) = NULL
;
969 fn
= no_exec_mask
? apply_default_acl_nftw_x
: apply_default_acl_nftw
;
971 int nftw_result
= nftw(target
, fn
, max_levels
, flags
);
973 if (nftw_result
== 0) {
978 /* nftw will return -1 on error, or if the supplied function
979 * (apply_default_acl_nftw) returns a non-zero result, nftw will
982 if (nftw_result
== -1) {
983 perror("apply_default_acl_recursive (nftw)");
992 * @brief Call apply_default_acl (possibly recursively) on each
993 * command-line argument.
995 * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
996 * goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
999 int main(int argc
, char* argv
[]) {
1003 return EXIT_FAILURE
;
1006 bool recursive
= false;
1007 bool no_exec_mask
= false;
1009 struct option long_options
[] = {
1010 /* These options set a flag. */
1011 {"help", no_argument
, NULL
, 'h'},
1012 {"recursive", no_argument
, NULL
, 'r'},
1013 {"no-exec-mask", no_argument
, NULL
, 'x'},
1019 while ((opt
= getopt_long(argc
, argv
, "hrx", long_options
, NULL
)) != -1) {
1023 return EXIT_SUCCESS
;
1028 no_exec_mask
= true;
1032 return EXIT_FAILURE
;
1036 int result
= EXIT_SUCCESS
;
1039 for (arg_index
= optind
; arg_index
< argc
; arg_index
++) {
1040 const char* target
= argv
[arg_index
];
1041 bool reapp_result
= false;
1043 /* Make sure we can access the given path before we go out of our
1044 * way to please it. Doing this check outside of
1045 * apply_default_acl() lets us spit out a better error message for
1048 if (!path_accessible(target
)) {
1049 fprintf(stderr
, "%s: %s: No such file or directory\n", argv
[0], target
);
1050 result
= EXIT_FAILURE
;
1055 reapp_result
= apply_default_acl_recursive(target
, no_exec_mask
);
1058 /* It's either a normal file, or we're not operating recursively. */
1059 reapp_result
= apply_default_acl(target
, no_exec_mask
);
1062 if (!reapp_result
) {
1063 result
= EXIT_FAILURE
;