src/apply-default-acl.c

   1 /**
   2  * @file apply-default-acl.c
   3  *
   4  * @brief The entire implementation.
   5  *
   6  */
   7
   8 /* On Linux, ftw.h needs this special voodoo to work. */
   9 #define _XOPEN_SOURCE 500
  10 #define _GNU_SOURCE
  11
  12 #include <errno.h>
  13 #include <fcntl.h>  /* AT_FOO constants */
  14 #include <ftw.h>    /* nftw() et al. */
  15 #include <getopt.h>
  16 #include <libgen.h> /* dirname()     */
  17 #include <limits.h> /* PATH_MAX      */
  18 #include <stdbool.h>
  19 #include <stdio.h>
  20 #include <stdlib.h>
  21 #include <string.h>
  22 #include <sys/stat.h>
  23 #include <unistd.h>
  24
  25 /* ACLs */
  26 #include <acl/libacl.h> /* acl_get_perm, not portable */
  27 #include <sys/types.h>
  28 #include <sys/acl.h>
  29
  30 /* Most of the libacl functions return 1 for success, 0 for failure,
  31    and -1 on error */
  32 #define ACL_ERROR -1
  33 #define ACL_FAILURE 0
  34 #define ACL_SUCCESS 1
  35
  36
  37
  38 /**
  39  * @brief Get the mode bits from the given path.
  40  *
  41  * @param path
  42  *   The path (file or directory) whose mode we want.
  43  *
  44  * @return A mode_t (st_mode) structure containing the mode bits.
  45  *   See sys/stat.h for details.
  46  */
  47 mode_t get_mode(const char* path) {
  48   if (path == NULL) {
  49     errno = ENOENT;
  50     return -1;
  51   }
  52
  53   struct stat s;
  54   int result = lstat(path, &s);
  55
  56   if (result == 0) {
  57     return s.st_mode;
  58   }
  59   else {
  60     /* errno will be set already by lstat() */
  61     return result;
  62   }
  63 }
  64
  65
  66
  67 /**
  68  * @brief Determine if the given path might refer to an (unsafe) hard link.
  69  *
  70  * @param path
  71  *   The path to test.
  72  *
  73  * @return true if we are certain that @c path does not refer to a hard
  74  *   link, and false otherwise. In case of error, false is returned,
  75  *   because we are not sure that @c path is not a hard link.
  76  */
  77 bool is_hardlink_safe(const char* path) {
  78   if (path == NULL) {
  79     return false;
  80   }
  81   struct stat s;
  82   int result = lstat(path, &s);
  83   if (result == 0) {
  84     return (s.st_nlink == 1 || S_ISDIR(s.st_mode));
  85   }
  86   else {
  87     return false;
  88   }
  89 }
  90
  91
  92 /**
  93  * @brief Determine whether or not the given path is a regular file.
  94  *
  95  * @param path
  96  *   The path to test.
  97  *
  98  * @return true if @c path is a regular file, false otherwise.
  99  */
 100 bool is_regular_file(const char* path) {
 101   if (path == NULL) {
 102     return false;
 103   }
 104
 105   struct stat s;
 106   int result = lstat(path, &s);
 107   if (result == 0) {
 108     return S_ISREG(s.st_mode);
 109   }
 110   else {
 111     return false;
 112   }
 113 }
 114
 115
 116
 117 /**
 118  * @brief Determine whether or not the given path is accessible.
 119  *
 120  * @param path
 121  *   The path to test.
 122  *
 123  * @return true if @c path is accessible to the current effective
 124  *   user/group, false otherwise.
 125  */
 126 bool path_accessible(const char* path) {
 127   if (path == NULL) {
 128     return false;
 129   }
 130
 131   /*  Test for access using the effective user and group rather than
 132       the real one. */
 133   int flags = AT_EACCESS;
 134
 135   /* Don't follow symlinks when checking for a path's existence,
 136      since we won't follow them to set its ACLs either. */
 137   flags |= AT_SYMLINK_NOFOLLOW;
 138
 139   /* If the path is relative, interpret it relative to the current
 140      working directory (just like the access() system call). */
 141   int result = faccessat(AT_FDCWD, path, F_OK, flags);
 142
 143   if (result == 0) {
 144     return true;
 145   }
 146   else {
 147     return false;
 148   }
 149 }
 150
 151
 152
 153 /**
 154  * @brief Determine whether or not the given path is a directory.
 155  *
 156  * @param path
 157  *   The path to test.
 158  *
 159  * @return true if @c path is a directory, false otherwise.
 160  */
 161 bool is_directory(const char* path) {
 162   if (path == NULL) {
 163     return false;
 164   }
 165
 166   struct stat s;
 167   int result = lstat(path, &s);
 168   if (result == 0) {
 169     return S_ISDIR(s.st_mode);
 170   }
 171   else {
 172     return false;
 173   }
 174 }
 175
 176
 177
 178 /**
 179  * @brief Update (or create) an entry in an @b minimal ACL.
 180  *
 181  * This function will not work if @c aclp contains extended
 182  * entries. This is fine for our purposes, since we call @c wipe_acls
 183  * on each path before applying the default to it.
 184  *
 185  * The assumption that there are no extended entries makes things much
 186  * simpler. For example, we only have to update the @c ACL_USER_OBJ,
 187  * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
 188  * be created anew. This means we don't have to fool around comparing
 189  * named-user/group entries.
 190  *
 191  * @param aclp
 192  *   A pointer to the acl_t structure whose entry we want to modify.
 193  *
 194  * @param entry
 195  *   The new entry. If @c entry contains a user/group/other entry, we
 196  *   update the existing one. Otherwise we create a new entry.
 197  *
 198  * @return If there is an unexpected library error, @c ACL_ERROR is
 199  *   returned. Otherwise, @c ACL_SUCCESS.
 200  *
 201  */
 202 int acl_set_entry(acl_t* aclp,
 203                   acl_entry_t entry) {
 204
 205   acl_tag_t entry_tag;
 206   int gt_result = acl_get_tag_type(entry, &entry_tag);
 207   if (gt_result == ACL_ERROR) {
 208     perror("acl_set_entry (acl_get_tag_type)");
 209     return ACL_ERROR;
 210   }
 211
 212   acl_permset_t entry_permset;
 213   int ps_result = acl_get_permset(entry, &entry_permset);
 214   if (ps_result == ACL_ERROR) {
 215     perror("acl_set_entry (acl_get_permset)");
 216     return ACL_ERROR;
 217   }
 218
 219   acl_entry_t existing_entry;
 220   /* Loop through the given ACL looking for matching entries. */
 221   int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);
 222
 223   while (result == ACL_SUCCESS) {
 224     acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
 225     int tag_result = acl_get_tag_type(existing_entry, &existing_tag);
 226
 227     if (tag_result == ACL_ERROR) {
 228        perror("set_acl_tag_permset (acl_get_tag_type)");
 229        return ACL_ERROR;
 230     }
 231
 232     if (existing_tag == entry_tag) {
 233       if (entry_tag == ACL_USER_OBJ ||
 234           entry_tag == ACL_GROUP_OBJ ||
 235           entry_tag == ACL_OTHER) {
 236         /* Only update for these three since all other tags will have
 237            been wiped. These three are guaranteed to exist, so if we
 238            match one of them, we're allowed to return ACL_SUCCESS
 239            below and bypass the rest of the function. */
 240         acl_permset_t existing_permset;
 241         int gep_result = acl_get_permset(existing_entry, &existing_permset);
 242         if (gep_result == ACL_ERROR) {
 243           perror("acl_set_entry (acl_get_permset)");
 244           return ACL_ERROR;
 245         }
 246
 247         int s_result = acl_set_permset(existing_entry, entry_permset);
 248         if (s_result == ACL_ERROR) {
 249           perror("acl_set_entry (acl_set_permset)");
 250           return ACL_ERROR;
 251         }
 252
 253         return ACL_SUCCESS;
 254       }
 255
 256     }
 257
 258     result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
 259   }
 260
 261   /* This catches both the initial acl_get_entry and the ones at the
 262      end of the loop. */
 263   if (result == ACL_ERROR) {
 264     perror("acl_set_entry (acl_get_entry)");
 265     return ACL_ERROR;
 266   }
 267
 268   /* If we've made it this far, we need to add a new entry to the
 269      ACL. */
 270   acl_entry_t new_entry;
 271
 272   /* We allocate memory here that we should release! */
 273   int c_result = acl_create_entry(aclp, &new_entry);
 274   if (c_result == ACL_ERROR) {
 275     perror("acl_set_entry (acl_create_entry)");
 276     return ACL_ERROR;
 277   }
 278
 279   int st_result = acl_set_tag_type(new_entry, entry_tag);
 280   if (st_result == ACL_ERROR) {
 281     perror("acl_set_entry (acl_set_tag_type)");
 282     return ACL_ERROR;
 283   }
 284
 285   int s_result = acl_set_permset(new_entry, entry_permset);
 286   if (s_result == ACL_ERROR) {
 287     perror("acl_set_entry (acl_set_permset)");
 288     return ACL_ERROR;
 289   }
 290
 291   if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
 292     /* We need to set the qualifier too. */
 293     void* entry_qual = acl_get_qualifier(entry);
 294     if (entry_qual == (void*)NULL) {
 295       perror("acl_set_entry (acl_get_qualifier)");
 296       return ACL_ERROR;
 297     }
 298
 299     int sq_result = acl_set_qualifier(new_entry, entry_qual);
 300     if (sq_result == ACL_ERROR) {
 301       perror("acl_set_entry (acl_set_qualifier)");
 302       return ACL_ERROR;
 303     }
 304   }
 305
 306   return ACL_SUCCESS;
 307 }
 308
 309
 310
 311 /**
 312  * @brief Determine the number of entries in the given ACL.
 313  *
 314  * @param acl
 315  *   A pointer to an @c acl_t structure.
 316  *
 317  * @return Either the non-negative number of entries in @c acl, or
 318  *   @c ACL_ERROR on error.
 319  */
 320 int acl_entry_count(acl_t* acl) {
 321
 322   acl_entry_t entry;
 323   int entry_count = 0;
 324   int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry);
 325
 326   while (result == ACL_SUCCESS) {
 327     entry_count++;
 328     result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry);
 329   }
 330
 331   if (result == ACL_ERROR) {
 332     perror("acl_entry_count (acl_get_entry)");
 333     return ACL_ERROR;
 334   }
 335
 336   return entry_count;
 337 }
 338
 339
 340
 341 /**
 342  * @brief Determine whether or not the given ACL is minimal.
 343  *
 344  * An ACL is minimal if it has fewer than four entries.
 345  *
 346  * @param acl
 347  *   A pointer to an acl_t structure.
 348  *
 349  * @return
 350  *   - @c ACL_SUCCESS - @c acl is minimal
 351  *   - @c ACL_FAILURE - @c acl is not minimal
 352  *   - @c ACL_ERROR - Unexpected library error
 353  */
 354 int acl_is_minimal(acl_t* acl) {
 355
 356   int ec = acl_entry_count(acl);
 357
 358   if (ec == ACL_ERROR) {
 359     perror("acl_is_minimal (acl_entry_count)");
 360     return ACL_ERROR;
 361   }
 362
 363   if (ec < 4) {
 364     return ACL_SUCCESS;
 365   }
 366   else {
 367     return ACL_FAILURE;
 368   }
 369 }
 370
 371
 372
 373 /**
 374  * @brief Determine whether the given ACL's mask denies execute.
 375  *
 376  * @param acl
 377  *   The ACL whose mask we want to check.
 378  *
 379  * @return
 380  *   - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
 381  *   - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
 382  *   - @c ACL_ERROR - Unexpected library error.
 383  */
 384 int acl_execute_masked(acl_t acl) {
 385
 386   acl_entry_t entry;
 387   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 388
 389   while (ge_result == ACL_SUCCESS) {
 390     acl_tag_t tag = ACL_UNDEFINED_TAG;
 391     int tag_result = acl_get_tag_type(entry, &tag);
 392
 393     if (tag_result == ACL_ERROR) {
 394        perror("acl_execute_masked (acl_get_tag_type)");
 395        return ACL_ERROR;
 396     }
 397
 398     if (tag == ACL_MASK) {
 399       /* This is the mask entry, get its permissions, and see if
 400          execute is specified. */
 401       acl_permset_t permset;
 402
 403       int ps_result = acl_get_permset(entry, &permset);
 404       if (ps_result == ACL_ERROR) {
 405         perror("acl_execute_masked (acl_get_permset)");
 406         return ACL_ERROR;
 407       }
 408
 409       int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 410       if (gp_result == ACL_ERROR) {
 411         perror("acl_execute_masked (acl_get_perm)");
 412         return ACL_ERROR;
 413       }
 414
 415       if (gp_result == ACL_FAILURE) {
 416         /* No execute bit set in the mask; execute not allowed. */
 417         return ACL_SUCCESS;
 418       }
 419     }
 420
 421     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 422   }
 423
 424   return ACL_FAILURE;
 425 }
 426
 427
 428
 429 /**
 430  * @brief Determine whether @c path is executable (by anyone) or a
 431  *   directory.
 432  *
 433  * This is used as part of the heuristic to determine whether or not
 434  * we should mask the execute bit when inheriting an ACL. If @c path
 435  * is a directory, the answer is a clear-cut yes. This behavior is
 436  * modeled after the capital 'X' perms of setfacl.
 437  *
 438  * If @c path is a file, we check the @a effective permissions,
 439  * contrary to what setfacl does.
 440  *
 441  * @param path
 442  *   The path to check.
 443  *
 444  * @return
 445  *   - @c ACL_SUCCESS - @c path is a directory, or someone has effective
 446        execute permissions.
 447  *   - @c ACL_FAILURE - @c path is a regular file and nobody can execute
 448        it.
 449  *   - @c ACL_ERROR - Unexpected library error.
 450  */
 451 int any_can_execute_or_dir(const char* path) {
 452
 453   if (is_directory(path)) {
 454     /* That was easy... */
 455     return ACL_SUCCESS;
 456   }
 457
 458   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 459
 460   if (acl == (acl_t)NULL) {
 461     perror("any_can_execute_or_dir (acl_get_file)");
 462     return ACL_ERROR;
 463   }
 464
 465   /* Our return value. */
 466   int result = ACL_FAILURE;
 467
 468   if (acl_is_minimal(&acl)) {
 469     mode_t mode = get_mode(path);
 470     if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
 471       result = ACL_SUCCESS;
 472       goto cleanup;
 473     }
 474     else {
 475       result = ACL_FAILURE;
 476       goto cleanup;
 477     }
 478   }
 479
 480   acl_entry_t entry;
 481   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 482
 483   while (ge_result == ACL_SUCCESS) {
 484     /* The first thing we do is check to see if this is a mask
 485        entry. If it is, we skip it entirely. */
 486     acl_tag_t tag = ACL_UNDEFINED_TAG;
 487     int tag_result = acl_get_tag_type(entry, &tag);
 488
 489     if (tag_result == ACL_ERROR) {
 490       perror("any_can_execute_or_dir (acl_get_tag_type)");
 491       result = ACL_ERROR;
 492       goto cleanup;
 493     }
 494
 495     if (tag == ACL_MASK) {
 496       ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 497       continue;
 498     }
 499
 500     /* Ok, so it's not a mask entry. Check the execute perms. */
 501     acl_permset_t permset;
 502
 503     int ps_result = acl_get_permset(entry, &permset);
 504     if (ps_result == ACL_ERROR) {
 505       perror("any_can_execute_or_dir (acl_get_permset)");
 506       result = ACL_ERROR;
 507       goto cleanup;
 508     }
 509
 510     int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 511     if (gp_result == ACL_ERROR) {
 512       perror("any_can_execute_or_dir (acl_get_perm)");
 513       result = ACL_ERROR;
 514       goto cleanup;
 515     }
 516
 517     if (gp_result == ACL_SUCCESS) {
 518       /* Only return ACL_SUCCESS if this execute bit is not masked. */
 519       if (acl_execute_masked(acl) != ACL_SUCCESS) {
 520         result = ACL_SUCCESS;
 521         goto cleanup;
 522       }
 523     }
 524
 525     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 526   }
 527
 528   if (ge_result == ACL_ERROR) {
 529     perror("any_can_execute_or_dir (acl_get_entry)");
 530     result = ACL_ERROR;
 531     goto cleanup;
 532   }
 533
 534  cleanup:
 535   acl_free(acl);
 536   return result;
 537 }
 538
 539
 540
 541 /**
 542  * @brief Set @c acl as the default ACL on @c path if it's a directory.
 543  *
 544  * This overwrites any existing default ACL on @c path. If no default
 545  * ACL exists, then one is created. If @c path is not a directory, we
 546  * return ACL_FAILURE but no error is raised.
 547  *
 548  * @param path
 549  *   The target directory whose ACL we wish to replace or create.
 550  *
 551   * @param acl
 552  *   The ACL to set as default on @c path.
 553  *
 554  * @return
 555  *   - @c ACL_SUCCESS - The default ACL was assigned successfully.
 556  *   - @c ACL_FAILURE - If @c path is not a directory.
 557  *   - @c ACL_ERROR - Unexpected library error.
 558  */
 559 int assign_default_acl(const char* path, acl_t acl) {
 560
 561   if (path == NULL) {
 562     errno = ENOENT;
 563     return ACL_ERROR;
 564   }
 565
 566   if (!is_directory(path)) {
 567     return ACL_FAILURE;
 568   }
 569
 570     /* Our return value; success unless something bad happens. */
 571   int result = ACL_SUCCESS;
 572   acl_t path_acl = acl_dup(acl);
 573
 574   if (path_acl == (acl_t)NULL) {
 575     perror("inherit_default_acl (acl_dup)");
 576     return ACL_ERROR; /* Nothing to clean up in this case. */
 577   }
 578
 579   int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
 580   if (sf_result == -1) {
 581     perror("inherit_default_acl (acl_set_file)");
 582     result = ACL_ERROR;
 583   }
 584
 585   acl_free(path_acl);
 586   return result;
 587 }
 588
 589
 590
 591 /**
 592  * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
 593  *   from the given path.
 594  *
 595  * @param path
 596  *   The path whose ACLs we want to wipe.
 597  *
 598  * @return
 599  *   - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
 600  *     existed in the first place.
 601  *   - @c ACL_ERROR - Unexpected library error.
 602  */
 603 int wipe_acls(const char* path) {
 604
 605   if (path == NULL) {
 606     errno = ENOENT;
 607     return ACL_ERROR;
 608   }
 609
 610   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 611   if (acl == (acl_t)NULL) {
 612     perror("wipe_acls (acl_get_file)");
 613     return ACL_ERROR;
 614   }
 615
 616   /* Our return value. */
 617   int result = ACL_SUCCESS;
 618
 619   acl_entry_t entry;
 620   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 621
 622   while (ge_result == ACL_SUCCESS) {
 623     int d_result = acl_delete_entry(acl, entry);
 624     if (d_result == ACL_ERROR) {
 625       perror("wipe_acls (acl_delete_entry)");
 626       result = ACL_ERROR;
 627       goto cleanup;
 628     }
 629
 630     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 631   }
 632
 633   /* Catches the first acl_get_entry as well as the ones at the end of
 634      the loop. */
 635   if (ge_result == ACL_ERROR) {
 636     perror("wipe_acls (acl_get_entry)");
 637     result = ACL_ERROR;
 638     goto cleanup;
 639   }
 640
 641   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 642   if (sf_result == ACL_ERROR) {
 643     perror("wipe_acls (acl_set_file)");
 644     result = ACL_ERROR;
 645     goto cleanup;
 646   }
 647
 648  cleanup:
 649   acl_free(acl);
 650   return result;
 651 }
 652
 653
 654
 655 /**
 656  * @brief Apply parent default ACL to a path.
 657  *
 658  * This overwrites any existing ACLs on @c path.
 659  *
 660  * @param path
 661  *   The path whose ACL we would like to reset to its default.
 662  *
 663  * @param no_exec_mask
 664  *   The value (either true or false) of the --no-exec-mask flag.
 665  *
 666  * @return
 667  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 668  *   - @c ACL_FAILURE - The target path is not a regular file/directory,
 669  *     or the parent of @c path is not a directory.
 670  *   - @c ACL_ERROR - Unexpected library error.
 671  */
 672 int apply_default_acl(const char* path, bool no_exec_mask) {
 673
 674   if (path == NULL) {
 675     errno = ENOENT;
 676     return ACL_ERROR;
 677   }
 678
 679   /* Refuse to operate on hard links, which can be abused by an
 680    * attacker to trick us into changing the ACL on a file we didn't
 681    * intend to; namely the "target" of the hard link. To truly prevent
 682    * that sort of mischief, we should be using file descriptors for
 683    * the target and its parent directory. Then modulo a tiny race
 684    * condition, we would be sure that "path" and "parent" don't change
 685    * their nature between the time that we test them and when we
 686    * utilize them. For contrast, the same attacker is free to replace
 687    * "path" with a hard link after is_hardlink_safe() has returned
 688    * "true" below.
 689    *
 690    * Unfortunately, our API is lacking in this area. For example,
 691    * acl_set_fd() is only capable of setting the ACL_TYPE_ACCESS list,
 692    * and not the ACL_TYPE_DEFAULT. Apparently the only way to operate
 693    * on default ACLs is through the path name, which is inherently
 694    * unreliable since the acl_*_file() calls themselves might follow
 695    * links (both hard and symbolic).
 696    *
 697    * Some improvement could still be made by using descriptors where
 698    * possible -- this would shrink the exploit window -- but for now
 699    * we use a naive implementation that only keeps honest men honest.
 700   */
 701   if (!is_hardlink_safe(path)) {
 702     return ACL_FAILURE;
 703   }
 704
 705   if (!is_regular_file(path) && !is_directory(path)) {
 706     return ACL_FAILURE;
 707   }
 708
 709   /* dirname mangles its argument */
 710   char path_copy[PATH_MAX];
 711   strncpy(path_copy, path, PATH_MAX-1);
 712   path_copy[PATH_MAX-1] = 0;
 713
 714   char* parent = dirname(path_copy);
 715   if (!is_directory(parent)) {
 716     /* Make sure dirname() did what we think it did. */
 717     return ACL_FAILURE;
 718   }
 719
 720   /* Default to not masking the exec bit; i.e. applying the default
 721      ACL literally. If --no-exec-mask was not specified, then we try
 722      to "guess" whether or not to mask the exec bit. */
 723   bool allow_exec = true;
 724
 725   if (!no_exec_mask) {
 726     int ace_result = any_can_execute_or_dir(path);
 727
 728     if (ace_result == ACL_ERROR) {
 729       perror("apply_default_acl (any_can_execute_or_dir)");
 730       return ACL_ERROR;
 731     }
 732
 733     allow_exec = (bool)ace_result;
 734   }
 735
 736   acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 737
 738   if (defacl == (acl_t)NULL) {
 739     perror("apply_default_acl (acl_get_file)");
 740     return ACL_ERROR;
 741   }
 742
 743   /* Our return value. */
 744   int result = ACL_SUCCESS;
 745
 746   int wipe_result = wipe_acls(path);
 747   if (wipe_result == ACL_ERROR) {
 748     perror("apply_default_acl (wipe_acls)");
 749     result = ACL_ERROR;
 750     goto cleanup;
 751   }
 752
 753   /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
 754      ACL with this one. */
 755   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 756   if (acl == (acl_t)NULL) {
 757     perror("apply_default_acl (acl_get_file)");
 758     return ACL_ERROR;
 759   }
 760
 761   /* If it's a directory, inherit the parent's default. */
 762   int inherit_result = assign_default_acl(path, defacl);
 763   if (inherit_result == ACL_ERROR) {
 764     perror("apply_default_acl (inherit_acls)");
 765     result = ACL_ERROR;
 766     goto cleanup;
 767   }
 768
 769   acl_entry_t entry;
 770   int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
 771
 772   while (ge_result == ACL_SUCCESS) {
 773     acl_tag_t tag = ACL_UNDEFINED_TAG;
 774     int tag_result = acl_get_tag_type(entry, &tag);
 775
 776     if (tag_result == ACL_ERROR) {
 777        perror("apply_default_acl (acl_get_tag_type)");
 778        result = ACL_ERROR;
 779        goto cleanup;
 780     }
 781
 782
 783     /* We've got an entry/tag from the default ACL. Get its permset. */
 784     acl_permset_t permset;
 785     int ps_result = acl_get_permset(entry, &permset);
 786     if (ps_result == ACL_ERROR) {
 787       perror("apply_default_acl (acl_get_permset)");
 788       result = ACL_ERROR;
 789       goto cleanup;
 790     }
 791
 792     /* If this is a default mask, fix it up. */
 793     if (tag == ACL_MASK ||
 794         tag == ACL_USER_OBJ ||
 795         tag == ACL_GROUP_OBJ ||
 796         tag == ACL_OTHER) {
 797
 798       if (!allow_exec) {
 799         /* The mask doesn't affect acl_user_obj, acl_group_obj (in
 800            minimal ACLs) or acl_other entries, so if execute should be
 801            masked, we have to do it manually. */
 802         int d_result = acl_delete_perm(permset, ACL_EXECUTE);
 803         if (d_result == ACL_ERROR) {
 804           perror("apply_default_acl (acl_delete_perm)");
 805           result = ACL_ERROR;
 806           goto cleanup;
 807         }
 808
 809         int sp_result = acl_set_permset(entry, permset);
 810         if (sp_result == ACL_ERROR) {
 811           perror("apply_default_acl (acl_set_permset)");
 812           result = ACL_ERROR;
 813           goto cleanup;
 814         }
 815       }
 816     }
 817
 818     /* Finally, add the permset to the access ACL. */
 819     int set_result = acl_set_entry(&acl, entry);
 820     if (set_result == ACL_ERROR) {
 821       perror("apply_default_acl (acl_set_entry)");
 822       result = ACL_ERROR;
 823       goto cleanup;
 824     }
 825
 826     ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
 827   }
 828
 829   /* Catches the first acl_get_entry as well as the ones at the end of
 830      the loop. */
 831   if (ge_result == ACL_ERROR) {
 832     perror("apply_default_acl (acl_get_entry)");
 833     result = ACL_ERROR;
 834     goto cleanup;
 835   }
 836
 837   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 838   if (sf_result == ACL_ERROR) {
 839     perror("apply_default_acl (acl_set_file)");
 840     result = ACL_ERROR;
 841     goto cleanup;
 842   }
 843
 844  cleanup:
 845   acl_free(defacl);
 846   return result;
 847 }
 848
 849
 850
 851 /**
 852  * @brief Display program usage information.
 853  *
 854  * @param program_name
 855  *   The program name to use in the output.
 856  *
 857  */
 858 void usage(const char* program_name) {
 859   printf("Apply any applicable default ACLs to the given files or "
 860          "directories.\n\n");
 861   printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
 862          program_name);
 863   printf("Flags:\n");
 864   printf(" -h, --help         Print this help message\n");
 865   printf(" -r, --recursive    Act on any given directories recursively\n");
 866   printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
 867
 868   return;
 869 }
 870
 871
 872 /**
 873  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 874  *
 875  * For parameter information, see the @c nftw man page.
 876  *
 877  * @return If the ACL was applied to @c target successfully, we return
 878  *   @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
 879  *   the next file or directory. Otherwise, we return @c FTW_STOP to
 880  *   signal failure.
 881  *
 882  */
 883 int apply_default_acl_nftw(const char *target,
 884                            const struct stat *s,
 885                            int info,
 886                            struct FTW *ftw) {
 887
 888   bool app_result = apply_default_acl(target, false);
 889   if (app_result) {
 890     return FTW_CONTINUE;
 891   }
 892   else {
 893     return FTW_STOP;
 894   }
 895 }
 896
 897
 898
 899 /**
 900  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 901  *
 902  * This is identical to @c apply_default_acl_nftw(), except it passes
 903  * @c true to @c apply_default_acl() as its no_exec_mask argument.
 904  *
 905  */
 906 int apply_default_acl_nftw_x(const char *target,
 907                              const struct stat *s,
 908                              int info,
 909                              struct FTW *ftw) {
 910
 911   bool app_result = apply_default_acl(target, true);
 912   if (app_result) {
 913     return FTW_CONTINUE;
 914   }
 915   else {
 916     return FTW_STOP;
 917   }
 918 }
 919
 920
 921
 922 /**
 923  * @brief Recursive version of @c apply_default_acl().
 924  *
 925  * If @c target is a directory, we use @c nftw() to call @c
 926  * apply_default_acl() recursively on all of its children. Otherwise,
 927  * we just delegate to @c apply_default_acl().
 928  *
 929  * We ignore symlinks for consistency with chmod -r.
 930  *
 931  * @param target
 932  *   The root (path) of the recursive application.
 933  *
 934  * @param no_exec_mask
 935  *   The value (either true or false) of the --no-exec-mask flag.
 936  *
 937  * @return
 938  *   If @c target is not a directory, we return the result of
 939  *   calling @c apply_default_acl() on @c target. Otherwise, we convert
 940  *   the return value of @c nftw(). If @c nftw() succeeds (returns 0),
 941  *   then we return @c true. Otherwise, we return @c false.
 942  *   \n\n
 943  *   If there is an error, it will be reported via @c perror, but
 944  *   we still return @c false.
 945  */
 946 bool apply_default_acl_recursive(const char *target, bool no_exec_mask) {
 947
 948   if (!is_directory(target)) {
 949     return apply_default_acl(target, no_exec_mask);
 950   }
 951
 952   int max_levels = 256;
 953   int flags = FTW_PHYS; /* Don't follow links. */
 954
 955   /* There are two separate functions that could be passed to
 956      nftw(). One passes no_exec_mask = true to apply_default_acl(),
 957      and the other passes no_exec_mask = false. Since the function we
 958      pass to nftw() cannot have parameters, we have to create separate
 959      options and make the decision here. */
 960   int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL;
 961   fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw;
 962
 963   int nftw_result = nftw(target, fn, max_levels, flags);
 964
 965   if (nftw_result == 0) {
 966     /* Success */
 967     return true;
 968   }
 969
 970   /* nftw will return -1 on error, or if the supplied function
 971    * (apply_default_acl_nftw) returns a non-zero result, nftw will
 972    * return that.
 973    */
 974   if (nftw_result == -1) {
 975     perror("apply_default_acl_recursive (nftw)");
 976   }
 977
 978   return false;
 979 }
 980
 981
 982
 983 /**
 984  * @brief Call apply_default_acl (possibly recursively) on each
 985  * command-line argument.
 986  *
 987  * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
 988  *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
 989  *   @c EXIT_FAILURE.
 990  */
 991 int main(int argc, char* argv[]) {
 992
 993   if (argc < 2) {
 994     usage(argv[0]);
 995     return EXIT_FAILURE;
 996   }
 997
 998   bool recursive = false;
 999   bool no_exec_mask = false;
1000
1001   struct option long_options[] = {
1002     /* These options set a flag. */
1003     {"help",      no_argument, NULL, 'h'},
1004     {"recursive", no_argument, NULL, 'r'},
1005     {"no-exec-mask", no_argument, NULL, 'x'},
1006     {NULL,        0,           NULL, 0}
1007   };
1008
1009   int opt = 0;
1010
1011   while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
1012     switch (opt) {
1013     case 'h':
1014       usage(argv[0]);
1015       return EXIT_SUCCESS;
1016     case 'r':
1017       recursive = true;
1018       break;
1019     case 'x':
1020       no_exec_mask = true;
1021       break;
1022     default:
1023       usage(argv[0]);
1024       return EXIT_FAILURE;
1025     }
1026   }
1027
1028   int result = EXIT_SUCCESS;
1029
1030   int arg_index = 1;
1031   for (arg_index = optind; arg_index < argc; arg_index++) {
1032     const char* target = argv[arg_index];
1033     bool reapp_result = false;
1034
1035     /* Make sure we can access the given path before we go out of our
1036      * way to please it. Doing this check outside of
1037      * apply_default_acl() lets us spit out a better error message for
1038      * typos, too.
1039      */
1040     if (!path_accessible(target)) {
1041       fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target);
1042       result = EXIT_FAILURE;
1043       continue;
1044     }
1045
1046     if (recursive) {
1047       reapp_result = apply_default_acl_recursive(target, no_exec_mask);
1048     }
1049     else {
1050       /* It's either a normal file, or we're not operating recursively. */
1051       reapp_result = apply_default_acl(target, no_exec_mask);
1052     }
1053
1054     if (!reapp_result) {
1055       result = EXIT_FAILURE;
1056     }
1057   }
1058
1059   return result;
1060 }