src/apply-default-acl.c

   1 /**
   2  * @file apply-default-acl.c
   3  *
   4  * @brief The entire implementation.
   5  *
   6  */
   7
   8 /* On Linux, ftw.h needs this special voodoo to work. */
   9 #define _XOPEN_SOURCE 500
  10 #define _GNU_SOURCE
  11
  12 #include <errno.h>
  13 #include <fcntl.h>  /* AT_FOO constants */
  14 #include <ftw.h>    /* nftw() et al. */
  15 #include <getopt.h>
  16 #include <libgen.h> /* dirname()     */
  17 #include <limits.h> /* PATH_MAX      */
  18 #include <stdbool.h>
  19 #include <stdio.h>
  20 #include <stdlib.h>
  21 #include <string.h>
  22 #include <sys/stat.h>
  23 #include <unistd.h>
  24
  25 /* ACLs */
  26 #include <acl/libacl.h> /* acl_get_perm, not portable */
  27 #include <sys/types.h>
  28 #include <sys/acl.h>
  29
  30 /* Most of the libacl functions return 1 for success, 0 for failure,
  31    and -1 on error */
  32 #define ACL_ERROR -1
  33 #define ACL_FAILURE 0
  34 #define ACL_SUCCESS 1
  35
  36
  37
  38 /**
  39  * @brief Get the mode bits from the given path.
  40  *
  41  * @param path
  42  *   The path (file or directory) whose mode we want.
  43  *
  44  * @return A mode_t (st_mode) structure containing the mode bits.
  45  *   See sys/stat.h for details.
  46  */
  47 mode_t get_mode(const char* path) {
  48   if (path == NULL) {
  49     errno = ENOENT;
  50     return -1;
  51   }
  52
  53   struct stat s;
  54   int result = lstat(path, &s);
  55
  56   if (result == 0) {
  57     return s.st_mode;
  58   }
  59   else {
  60     /* errno will be set already by lstat() */
  61     return result;
  62   }
  63 }
  64
  65
  66
  67 /**
  68  * @brief Determine if the given path might refer to an (unsafe) hard link.
  69  *
  70  * @param path
  71  *   The path to test.
  72  *
  73  * @return true if we are certain that @c path does not refer to a hard
  74  *   link, and false otherwise. In case of error, false is returned,
  75  *   because we are not sure that @c path is not a hard link.
  76  */
  77 bool is_hardlink_safe(const char* path) {
  78   if (path == NULL) {
  79     return false;
  80   }
  81   struct stat s;
  82   int result = lstat(path, &s);
  83   if (result == 0) {
  84     return (s.st_nlink == 1 || S_ISDIR(s.st_mode));
  85   }
  86   else {
  87     return false;
  88   }
  89 }
  90
  91
  92 /**
  93  * @brief Determine whether or not the given path is a regular file.
  94  *
  95  * @param path
  96  *   The path to test.
  97  *
  98  * @return true if @c path is a regular file, false otherwise.
  99  */
 100 bool is_regular_file(const char* path) {
 101   if (path == NULL) {
 102     return false;
 103   }
 104
 105   struct stat s;
 106   int result = lstat(path, &s);
 107   if (result == 0) {
 108     return S_ISREG(s.st_mode);
 109   }
 110   else {
 111     return false;
 112   }
 113 }
 114
 115
 116
 117 /**
 118  * @brief Determine whether or not the given path is accessible.
 119  *
 120  * @param path
 121  *   The path to test.
 122  *
 123  * @return true if @c path is accessible to the current effective
 124  *   user/group, false otherwise.
 125  */
 126 bool path_accessible(const char* path) {
 127   if (path == NULL) {
 128     return false;
 129   }
 130
 131   /*  Test for access using the effective user and group rather than
 132       the real one. */
 133   int flags = AT_EACCESS;
 134
 135   /* Don't follow symlinks when checking for a path's existence,
 136      since we won't follow them to set its ACLs either. */
 137   flags |= AT_SYMLINK_NOFOLLOW;
 138
 139   /* If the path is relative, interpret it relative to the current
 140      working directory (just like the access() system call). */
 141   int result = faccessat(AT_FDCWD, path, F_OK, flags);
 142
 143   if (result == 0) {
 144     return true;
 145   }
 146   else {
 147     return false;
 148   }
 149 }
 150
 151
 152
 153 /**
 154  * @brief Determine whether or not the given path is a directory.
 155  *
 156  * @param path
 157  *   The path to test.
 158  *
 159  * @return true if @c path is a directory, false otherwise.
 160  */
 161 bool is_directory(const char* path) {
 162   if (path == NULL) {
 163     return false;
 164   }
 165
 166   struct stat s;
 167   int result = lstat(path, &s);
 168   if (result == 0) {
 169     return S_ISDIR(s.st_mode);
 170   }
 171   else {
 172     return false;
 173   }
 174 }
 175
 176
 177
 178 /**
 179  * @brief Update (or create) an entry in an @b minimal ACL.
 180  *
 181  * This function will not work if @c aclp contains extended
 182  * entries. This is fine for our purposes, since we call @c wipe_acls
 183  * on each path before applying the default to it.
 184  *
 185  * The assumption that there are no extended entries makes things much
 186  * simpler. For example, we only have to update the @c ACL_USER_OBJ,
 187  * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
 188  * be created anew. This means we don't have to fool around comparing
 189  * named-user/group entries.
 190  *
 191  * @param aclp
 192  *   A pointer to the acl_t structure whose entry we want to modify.
 193  *
 194  * @param entry
 195  *   The new entry. If @c entry contains a user/group/other entry, we
 196  *   update the existing one. Otherwise we create a new entry.
 197  *
 198  * @return If there is an unexpected library error, @c ACL_ERROR is
 199  *   returned. Otherwise, @c ACL_SUCCESS.
 200  *
 201  */
 202 int acl_set_entry(acl_t* aclp,
 203                   acl_entry_t entry) {
 204
 205   acl_tag_t entry_tag;
 206   int gt_result = acl_get_tag_type(entry, &entry_tag);
 207   if (gt_result == ACL_ERROR) {
 208     perror("acl_set_entry (acl_get_tag_type)");
 209     return ACL_ERROR;
 210   }
 211
 212   acl_permset_t entry_permset;
 213   int ps_result = acl_get_permset(entry, &entry_permset);
 214   if (ps_result == ACL_ERROR) {
 215     perror("acl_set_entry (acl_get_permset)");
 216     return ACL_ERROR;
 217   }
 218
 219   acl_entry_t existing_entry;
 220   /* Loop through the given ACL looking for matching entries. */
 221   int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);
 222
 223   while (result == ACL_SUCCESS) {
 224     acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
 225     int tag_result = acl_get_tag_type(existing_entry, &existing_tag);
 226
 227     if (tag_result == ACL_ERROR) {
 228        perror("set_acl_tag_permset (acl_get_tag_type)");
 229        return ACL_ERROR;
 230     }
 231
 232     if (existing_tag == entry_tag) {
 233       if (entry_tag == ACL_USER_OBJ ||
 234           entry_tag == ACL_GROUP_OBJ ||
 235           entry_tag == ACL_OTHER) {
 236         /* Only update for these three since all other tags will have
 237            been wiped. These three are guaranteed to exist, so if we
 238            match one of them, we're allowed to return ACL_SUCCESS
 239            below and bypass the rest of the function. */
 240         acl_permset_t existing_permset;
 241         int gep_result = acl_get_permset(existing_entry, &existing_permset);
 242         if (gep_result == ACL_ERROR) {
 243           perror("acl_set_entry (acl_get_permset)");
 244           return ACL_ERROR;
 245         }
 246
 247         int s_result = acl_set_permset(existing_entry, entry_permset);
 248         if (s_result == ACL_ERROR) {
 249           perror("acl_set_entry (acl_set_permset)");
 250           return ACL_ERROR;
 251         }
 252
 253         return ACL_SUCCESS;
 254       }
 255
 256     }
 257
 258     result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
 259   }
 260
 261   /* This catches both the initial acl_get_entry and the ones at the
 262      end of the loop. */
 263   if (result == ACL_ERROR) {
 264     perror("acl_set_entry (acl_get_entry)");
 265     return ACL_ERROR;
 266   }
 267
 268   /* If we've made it this far, we need to add a new entry to the
 269      ACL. */
 270   acl_entry_t new_entry;
 271
 272   /* We allocate memory here that we should release! */
 273   int c_result = acl_create_entry(aclp, &new_entry);
 274   if (c_result == ACL_ERROR) {
 275     perror("acl_set_entry (acl_create_entry)");
 276     return ACL_ERROR;
 277   }
 278
 279   int st_result = acl_set_tag_type(new_entry, entry_tag);
 280   if (st_result == ACL_ERROR) {
 281     perror("acl_set_entry (acl_set_tag_type)");
 282     return ACL_ERROR;
 283   }
 284
 285   int s_result = acl_set_permset(new_entry, entry_permset);
 286   if (s_result == ACL_ERROR) {
 287     perror("acl_set_entry (acl_set_permset)");
 288     return ACL_ERROR;
 289   }
 290
 291   if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
 292     /* We need to set the qualifier too. */
 293     void* entry_qual = acl_get_qualifier(entry);
 294     if (entry_qual == (void*)NULL) {
 295       perror("acl_set_entry (acl_get_qualifier)");
 296       return ACL_ERROR;
 297     }
 298
 299     int sq_result = acl_set_qualifier(new_entry, entry_qual);
 300     if (sq_result == ACL_ERROR) {
 301       perror("acl_set_entry (acl_set_qualifier)");
 302       return ACL_ERROR;
 303     }
 304   }
 305
 306   return ACL_SUCCESS;
 307 }
 308
 309
 310
 311 /**
 312  * @brief Determine the number of entries in the given ACL.
 313  *
 314  * @param acl
 315  *   A pointer to an @c acl_t structure.
 316  *
 317  * @return Either the non-negative number of entries in @c acl, or
 318  *   @c ACL_ERROR on error.
 319  */
 320 int acl_entry_count(acl_t* acl) {
 321
 322   acl_entry_t entry;
 323   int entry_count = 0;
 324   int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry);
 325
 326   while (result == ACL_SUCCESS) {
 327     entry_count++;
 328     result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry);
 329   }
 330
 331   if (result == ACL_ERROR) {
 332     perror("acl_entry_count (acl_get_entry)");
 333     return ACL_ERROR;
 334   }
 335
 336   return entry_count;
 337 }
 338
 339
 340
 341 /**
 342  * @brief Determine whether or not the given ACL is minimal.
 343  *
 344  * An ACL is minimal if it has fewer than four entries.
 345  *
 346  * @param acl
 347  *   A pointer to an acl_t structure.
 348  *
 349  * @return
 350  *   - @c ACL_SUCCESS - @c acl is minimal
 351  *   - @c ACL_FAILURE - @c acl is not minimal
 352  *   - @c ACL_ERROR - Unexpected library error
 353  */
 354 int acl_is_minimal(acl_t* acl) {
 355
 356   int ec = acl_entry_count(acl);
 357
 358   if (ec == ACL_ERROR) {
 359     perror("acl_is_minimal (acl_entry_count)");
 360     return ACL_ERROR;
 361   }
 362
 363   if (ec < 4) {
 364     return ACL_SUCCESS;
 365   }
 366   else {
 367     return ACL_FAILURE;
 368   }
 369 }
 370
 371
 372
 373 /**
 374  * @brief Determine whether the given path has an ACL whose mask
 375  *   denies execute.
 376  *
 377  * @param path
 378  *   The path to check.
 379  *
 380  * @return
 381  *   - @c ACL_SUCCESS - @c path has a mask which denies execute.
 382  *   - @c ACL_FAILURE - The ACL for @c path does not deny execute,
 383  *     or @c path has no extended ACL at all.
 384  *   - @c ACL_ERROR - Unexpected library error.
 385  */
 386 int acl_execute_masked(const char* path) {
 387
 388   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 389
 390   if (acl == (acl_t)NULL) {
 391     perror("acl_execute_masked (acl_get_file)");
 392     return ACL_ERROR;
 393   }
 394
 395   /* Our return value. */
 396   int result = ACL_FAILURE;
 397
 398   acl_entry_t entry;
 399   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 400
 401   while (ge_result == ACL_SUCCESS) {
 402     acl_tag_t tag = ACL_UNDEFINED_TAG;
 403     int tag_result = acl_get_tag_type(entry, &tag);
 404
 405     if (tag_result == ACL_ERROR) {
 406        perror("acl_execute_masked (acl_get_tag_type)");
 407        result = ACL_ERROR;
 408        goto cleanup;
 409     }
 410
 411     if (tag == ACL_MASK) {
 412       /* This is the mask entry, get its permissions, and see if
 413          execute is specified. */
 414       acl_permset_t permset;
 415
 416       int ps_result = acl_get_permset(entry, &permset);
 417       if (ps_result == ACL_ERROR) {
 418         perror("acl_execute_masked (acl_get_permset)");
 419         result = ACL_ERROR;
 420         goto cleanup;
 421       }
 422
 423       int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 424       if (gp_result == ACL_ERROR) {
 425         perror("acl_execute_masked (acl_get_perm)");
 426         result = ACL_ERROR;
 427         goto cleanup;
 428       }
 429
 430       if (gp_result == ACL_FAILURE) {
 431         /* No execute bit set in the mask; execute not allowed. */
 432         return ACL_SUCCESS;
 433       }
 434     }
 435
 436     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 437   }
 438
 439  cleanup:
 440   acl_free(acl);
 441   return result;
 442 }
 443
 444
 445
 446 /**
 447  * @brief Determine whether @c path is executable (by anyone) or a
 448  *   directory.
 449  *
 450  * This is used as part of the heuristic to determine whether or not
 451  * we should mask the execute bit when inheriting an ACL. If @c path
 452  * is a directory, the answer is a clear-cut yes. This behavior is
 453  * modeled after the capital 'X' perms of setfacl.
 454  *
 455  * If @c path is a file, we check the @a effective permissions,
 456  * contrary to what setfacl does.
 457  *
 458  * @param path
 459  *   The path to check.
 460  *
 461  * @return
 462  *   - @c ACL_SUCCESS - @c path is a directory, or someone has effective
 463        execute permissions.
 464  *   - @c ACL_FAILURE - @c path is a regular file and nobody can execute
 465        it.
 466  *   - @c ACL_ERROR - Unexpected library error.
 467  */
 468 int any_can_execute_or_dir(const char* path) {
 469
 470   if (is_directory(path)) {
 471     /* That was easy... */
 472     return ACL_SUCCESS;
 473   }
 474
 475   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 476
 477   if (acl == (acl_t)NULL) {
 478     perror("any_can_execute_or_dir (acl_get_file)");
 479     return ACL_ERROR;
 480   }
 481
 482   /* Our return value. */
 483   int result = ACL_FAILURE;
 484
 485   if (acl_is_minimal(&acl)) {
 486     mode_t mode = get_mode(path);
 487     if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
 488       result = ACL_SUCCESS;
 489       goto cleanup;
 490     }
 491     else {
 492       result = ACL_FAILURE;
 493       goto cleanup;
 494     }
 495   }
 496
 497   acl_entry_t entry;
 498   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 499
 500   while (ge_result == ACL_SUCCESS) {
 501     /* The first thing we do is check to see if this is a mask
 502        entry. If it is, we skip it entirely. */
 503     acl_tag_t tag = ACL_UNDEFINED_TAG;
 504     int tag_result = acl_get_tag_type(entry, &tag);
 505
 506     if (tag_result == ACL_ERROR) {
 507       perror("any_can_execute_or_dir (acl_get_tag_type)");
 508       result = ACL_ERROR;
 509       goto cleanup;
 510     }
 511
 512     if (tag == ACL_MASK) {
 513       ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 514       continue;
 515     }
 516
 517     /* Ok, so it's not a mask entry. Check the execute perms. */
 518     acl_permset_t permset;
 519
 520     int ps_result = acl_get_permset(entry, &permset);
 521     if (ps_result == ACL_ERROR) {
 522       perror("any_can_execute_or_dir (acl_get_permset)");
 523       result = ACL_ERROR;
 524       goto cleanup;
 525     }
 526
 527     int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 528     if (gp_result == ACL_ERROR) {
 529       perror("any_can_execute_or_dir (acl_get_perm)");
 530       result = ACL_ERROR;
 531       goto cleanup;
 532     }
 533
 534     if (gp_result == ACL_SUCCESS) {
 535       /* Only return ACL_SUCCESS if this execute bit is not masked. */
 536       if (acl_execute_masked(path) != ACL_SUCCESS) {
 537         result = ACL_SUCCESS;
 538         goto cleanup;
 539       }
 540     }
 541
 542     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 543   }
 544
 545   if (ge_result == ACL_ERROR) {
 546     perror("any_can_execute_or_dir (acl_get_entry)");
 547     result = ACL_ERROR;
 548     goto cleanup;
 549   }
 550
 551  cleanup:
 552   acl_free(acl);
 553   return result;
 554 }
 555
 556
 557
 558 /**
 559  * @brief Inherit the default ACL from @c parent to @c path.
 560  *
 561  * The @c parent parameter does not necessarily need to be the parent
 562  * of @c path, although that will usually be the case. This overwrites
 563  * any existing default ACL on @c path.
 564  *
 565  * @param parent
 566  *   The parent directory whose ACL we want to inherit.
 567  *
 568  * @param path
 569  *   The target directory whose ACL we wish to overwrite (or create).
 570  *
 571  * @return
 572  *   - @c ACL_SUCCESS - The default ACL was inherited successfully.
 573  *   - @c ACL_FAILURE - Either @c parent or @c path is not a directory.
 574  *   - @c ACL_ERROR - Unexpected library error.
 575  */
 576 int inherit_default_acl(const char* path, const char* parent) {
 577
 578   /* Our return value. */
 579   int result = ACL_SUCCESS;
 580
 581   if (path == NULL) {
 582     errno = ENOENT;
 583     return ACL_ERROR;
 584   }
 585
 586   if (!is_directory(path) || !is_directory(parent)) {
 587     return ACL_FAILURE;
 588   }
 589
 590   acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 591   if (parent_acl == (acl_t)NULL) {
 592     perror("inherit_default_acl (acl_get_file)");
 593     return ACL_ERROR;
 594   }
 595
 596   acl_t path_acl = acl_dup(parent_acl);
 597
 598   if (path_acl == (acl_t)NULL) {
 599     perror("inherit_default_acl (acl_dup)");
 600     acl_free(parent_acl);
 601     return ACL_ERROR;
 602   }
 603
 604   int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
 605   if (sf_result == -1) {
 606     perror("inherit_default_acl (acl_set_file)");
 607     result = ACL_ERROR;
 608     goto cleanup;
 609   }
 610
 611  cleanup:
 612   acl_free(path_acl);
 613   return result;
 614 }
 615
 616
 617
 618 /**
 619  * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
 620  *   from the given path.
 621  *
 622  * @param path
 623  *   The path whose ACLs we want to wipe.
 624  *
 625  * @return
 626  *   - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
 627  *     existed in the first place.
 628  *   - @c ACL_ERROR - Unexpected library error.
 629  */
 630 int wipe_acls(const char* path) {
 631
 632   if (path == NULL) {
 633     errno = ENOENT;
 634     return ACL_ERROR;
 635   }
 636
 637   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 638   if (acl == (acl_t)NULL) {
 639     perror("wipe_acls (acl_get_file)");
 640     return ACL_ERROR;
 641   }
 642
 643   /* Our return value. */
 644   int result = ACL_SUCCESS;
 645
 646   acl_entry_t entry;
 647   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 648
 649   while (ge_result == ACL_SUCCESS) {
 650     int d_result = acl_delete_entry(acl, entry);
 651     if (d_result == ACL_ERROR) {
 652       perror("wipe_acls (acl_delete_entry)");
 653       result = ACL_ERROR;
 654       goto cleanup;
 655     }
 656
 657     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 658   }
 659
 660   /* Catches the first acl_get_entry as well as the ones at the end of
 661      the loop. */
 662   if (ge_result == ACL_ERROR) {
 663     perror("wipe_acls (acl_get_entry)");
 664     result = ACL_ERROR;
 665     goto cleanup;
 666   }
 667
 668   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 669   if (sf_result == ACL_ERROR) {
 670     perror("wipe_acls (acl_set_file)");
 671     result = ACL_ERROR;
 672     goto cleanup;
 673   }
 674
 675  cleanup:
 676   acl_free(acl);
 677   return result;
 678 }
 679
 680
 681
 682 /**
 683  * @brief Apply parent default ACL to a path.
 684  *
 685  * This overwrites any existing ACLs on @c path.
 686  *
 687  * @param path
 688  *   The path whose ACL we would like to reset to its default.
 689  *
 690  * @param no_exec_mask
 691  *   The value (either true or false) of the --no-exec-mask flag.
 692  *
 693  * @return
 694  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 695  *   - @c ACL_FAILURE - The target path is not a regular file/directory,
 696  *     or the parent of @c path is not a directory.
 697  *   - @c ACL_ERROR - Unexpected library error.
 698  */
 699 int apply_default_acl(const char* path, bool no_exec_mask) {
 700
 701   if (path == NULL) {
 702     errno = ENOENT;
 703     return ACL_ERROR;
 704   }
 705
 706   /* Refuse to operate on hard links, which can be abused by an
 707    * attacker to trick us into changing the ACL on a file we didn't
 708    * intend to; namely the "target" of the hard link. To truly prevent
 709    * that sort of mischief, we should be using file descriptors for
 710    * the target and its parent directory. Then modulo a tiny race
 711    * condition, we would be sure that "path" and "parent" don't change
 712    * their nature between the time that we test them and when we
 713    * utilize them. For contrast, the same attacker is free to replace
 714    * "path" with a hard link after is_hardlink_safe() has returned
 715    * "true" below.
 716    *
 717    * Unfortunately, our API is lacking in this area. For example,
 718    * acl_set_fd() is only capable of setting the ACL_TYPE_ACCESS list,
 719    * and not the ACL_TYPE_DEFAULT. Apparently the only way to operate
 720    * on default ACLs is through the path name, which is inherently
 721    * unreliable since the acl_*_file() calls themselves might follow
 722    * links (both hard and symbolic).
 723    *
 724    * Some improvement could still be made by using descriptors where
 725    * possible -- this would shrink the exploit window -- but for now
 726    * we use a naive implementation that only keeps honest men honest.
 727   */
 728   if (!is_hardlink_safe(path)) {
 729     return ACL_FAILURE;
 730   }
 731
 732   if (!is_regular_file(path) && !is_directory(path)) {
 733     return ACL_FAILURE;
 734   }
 735
 736   /* dirname mangles its argument */
 737   char path_copy[PATH_MAX];
 738   strncpy(path_copy, path, PATH_MAX-1);
 739   path_copy[PATH_MAX-1] = 0;
 740
 741   char* parent = dirname(path_copy);
 742   if (!is_directory(parent)) {
 743     /* Make sure dirname() did what we think it did. */
 744     return ACL_FAILURE;
 745   }
 746
 747   /* Default to not masking the exec bit; i.e. applying the default
 748      ACL literally. If --no-exec-mask was not specified, then we try
 749      to "guess" whether or not to mask the exec bit. */
 750   bool allow_exec = true;
 751
 752   if (!no_exec_mask) {
 753     int ace_result = any_can_execute_or_dir(path);
 754
 755     if (ace_result == ACL_ERROR) {
 756       perror("apply_default_acl (any_can_execute_or_dir)");
 757       return ACL_ERROR;
 758     }
 759
 760     allow_exec = (bool)ace_result;
 761   }
 762
 763   acl_t defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 764
 765   if (defacl == (acl_t)NULL) {
 766     perror("apply_default_acl (acl_get_file)");
 767     return ACL_ERROR;
 768   }
 769
 770   /* Our return value. */
 771   int result = ACL_SUCCESS;
 772
 773   int wipe_result = wipe_acls(path);
 774   if (wipe_result == ACL_ERROR) {
 775     perror("apply_default_acl (wipe_acls)");
 776     result = ACL_ERROR;
 777     goto cleanup;
 778   }
 779
 780   /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
 781      ACL with this one. */
 782   acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS);
 783   if (acl == (acl_t)NULL) {
 784     perror("apply_default_acl (acl_get_file)");
 785     return ACL_ERROR;
 786   }
 787
 788   /* If it's a directory, inherit the parent's default. */
 789   int inherit_result = inherit_default_acl(path, parent);
 790   if (inherit_result == ACL_ERROR) {
 791     perror("apply_default_acl (inherit_acls)");
 792     result = ACL_ERROR;
 793     goto cleanup;
 794   }
 795
 796   acl_entry_t entry;
 797   int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
 798
 799   while (ge_result == ACL_SUCCESS) {
 800     acl_tag_t tag = ACL_UNDEFINED_TAG;
 801     int tag_result = acl_get_tag_type(entry, &tag);
 802
 803     if (tag_result == ACL_ERROR) {
 804        perror("apply_default_acl (acl_get_tag_type)");
 805        result = ACL_ERROR;
 806        goto cleanup;
 807     }
 808
 809
 810     /* We've got an entry/tag from the default ACL. Get its permset. */
 811     acl_permset_t permset;
 812     int ps_result = acl_get_permset(entry, &permset);
 813     if (ps_result == ACL_ERROR) {
 814       perror("apply_default_acl (acl_get_permset)");
 815       result = ACL_ERROR;
 816       goto cleanup;
 817     }
 818
 819     /* If this is a default mask, fix it up. */
 820     if (tag == ACL_MASK ||
 821         tag == ACL_USER_OBJ ||
 822         tag == ACL_GROUP_OBJ ||
 823         tag == ACL_OTHER) {
 824
 825       if (!allow_exec) {
 826         /* The mask doesn't affect acl_user_obj, acl_group_obj (in
 827            minimal ACLs) or acl_other entries, so if execute should be
 828            masked, we have to do it manually. */
 829         int d_result = acl_delete_perm(permset, ACL_EXECUTE);
 830         if (d_result == ACL_ERROR) {
 831           perror("apply_default_acl (acl_delete_perm)");
 832           result = ACL_ERROR;
 833           goto cleanup;
 834         }
 835
 836         int sp_result = acl_set_permset(entry, permset);
 837         if (sp_result == ACL_ERROR) {
 838           perror("apply_default_acl (acl_set_permset)");
 839           result = ACL_ERROR;
 840           goto cleanup;
 841         }
 842       }
 843     }
 844
 845     /* Finally, add the permset to the access ACL. */
 846     int set_result = acl_set_entry(&acl, entry);
 847     if (set_result == ACL_ERROR) {
 848       perror("apply_default_acl (acl_set_entry)");
 849       result = ACL_ERROR;
 850       goto cleanup;
 851     }
 852
 853     ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
 854   }
 855
 856   /* Catches the first acl_get_entry as well as the ones at the end of
 857      the loop. */
 858   if (ge_result == ACL_ERROR) {
 859     perror("apply_default_acl (acl_get_entry)");
 860     result = ACL_ERROR;
 861     goto cleanup;
 862   }
 863
 864   int sf_result = acl_set_file(path, ACL_TYPE_ACCESS, acl);
 865   if (sf_result == ACL_ERROR) {
 866     perror("apply_default_acl (acl_set_file)");
 867     result = ACL_ERROR;
 868     goto cleanup;
 869   }
 870
 871  cleanup:
 872   acl_free(defacl);
 873   return result;
 874 }
 875
 876
 877
 878 /**
 879  * @brief Display program usage information.
 880  *
 881  * @param program_name
 882  *   The program name to use in the output.
 883  *
 884  */
 885 void usage(const char* program_name) {
 886   printf("Apply any applicable default ACLs to the given files or "
 887          "directories.\n\n");
 888   printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
 889          program_name);
 890   printf("Flags:\n");
 891   printf(" -h, --help         Print this help message\n");
 892   printf(" -r, --recursive    Act on any given directories recursively\n");
 893   printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
 894
 895   return;
 896 }
 897
 898
 899 /**
 900  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 901  *
 902  * For parameter information, see the @c nftw man page.
 903  *
 904  * @return If the ACL was applied to @c target successfully, we return
 905  *   @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
 906  *   the next file or directory. Otherwise, we return @c FTW_STOP to
 907  *   signal failure.
 908  *
 909  */
 910 int apply_default_acl_nftw(const char *target,
 911                            const struct stat *s,
 912                            int info,
 913                            struct FTW *ftw) {
 914
 915   bool app_result = apply_default_acl(target, false);
 916   if (app_result) {
 917     return FTW_CONTINUE;
 918   }
 919   else {
 920     return FTW_STOP;
 921   }
 922 }
 923
 924
 925
 926 /**
 927  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 928  *
 929  * This is identical to @c apply_default_acl_nftw(), except it passes
 930  * @c true to @c apply_default_acl() as its no_exec_mask argument.
 931  *
 932  */
 933 int apply_default_acl_nftw_x(const char *target,
 934                              const struct stat *s,
 935                              int info,
 936                              struct FTW *ftw) {
 937
 938   bool app_result = apply_default_acl(target, true);
 939   if (app_result) {
 940     return FTW_CONTINUE;
 941   }
 942   else {
 943     return FTW_STOP;
 944   }
 945 }
 946
 947
 948
 949 /**
 950  * @brief Recursive version of @c apply_default_acl().
 951  *
 952  * If @c target is a directory, we use @c nftw() to call @c
 953  * apply_default_acl() recursively on all of its children. Otherwise,
 954  * we just delegate to @c apply_default_acl().
 955  *
 956  * We ignore symlinks for consistency with chmod -r.
 957  *
 958  * @param target
 959  *   The root (path) of the recursive application.
 960  *
 961  * @param no_exec_mask
 962  *   The value (either true or false) of the --no-exec-mask flag.
 963  *
 964  * @return
 965  *   If @c target is not a directory, we return the result of
 966  *   calling @c apply_default_acl() on @c target. Otherwise, we convert
 967  *   the return value of @c nftw(). If @c nftw() succeeds (returns 0),
 968  *   then we return @c true. Otherwise, we return @c false.
 969  *   \n\n
 970  *   If there is an error, it will be reported via @c perror, but
 971  *   we still return @c false.
 972  */
 973 bool apply_default_acl_recursive(const char *target, bool no_exec_mask) {
 974
 975   if (!is_directory(target)) {
 976     return apply_default_acl(target, no_exec_mask);
 977   }
 978
 979   int max_levels = 256;
 980   int flags = FTW_PHYS; /* Don't follow links. */
 981
 982   /* There are two separate functions that could be passed to
 983      nftw(). One passes no_exec_mask = true to apply_default_acl(),
 984      and the other passes no_exec_mask = false. Since the function we
 985      pass to nftw() cannot have parameters, we have to create separate
 986      options and make the decision here. */
 987   int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL;
 988   fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw;
 989
 990   int nftw_result = nftw(target, fn, max_levels, flags);
 991
 992   if (nftw_result == 0) {
 993     /* Success */
 994     return true;
 995   }
 996
 997   /* nftw will return -1 on error, or if the supplied function
 998    * (apply_default_acl_nftw) returns a non-zero result, nftw will
 999    * return that.
1000    */
1001   if (nftw_result == -1) {
1002     perror("apply_default_acl_recursive (nftw)");
1003   }
1004
1005   return false;
1006 }
1007
1008
1009
1010 /**
1011  * @brief Call apply_default_acl (possibly recursively) on each
1012  * command-line argument.
1013  *
1014  * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
1015  *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
1016  *   @c EXIT_FAILURE.
1017  */
1018 int main(int argc, char* argv[]) {
1019
1020   if (argc < 2) {
1021     usage(argv[0]);
1022     return EXIT_FAILURE;
1023   }
1024
1025   bool recursive = false;
1026   bool no_exec_mask = false;
1027
1028   struct option long_options[] = {
1029     /* These options set a flag. */
1030     {"help",      no_argument, NULL, 'h'},
1031     {"recursive", no_argument, NULL, 'r'},
1032     {"no-exec-mask", no_argument, NULL, 'x'},
1033     {NULL,        0,           NULL, 0}
1034   };
1035
1036   int opt = 0;
1037
1038   while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
1039     switch (opt) {
1040     case 'h':
1041       usage(argv[0]);
1042       return EXIT_SUCCESS;
1043     case 'r':
1044       recursive = true;
1045       break;
1046     case 'x':
1047       no_exec_mask = true;
1048       break;
1049     default:
1050       usage(argv[0]);
1051       return EXIT_FAILURE;
1052     }
1053   }
1054
1055   int result = EXIT_SUCCESS;
1056
1057   int arg_index = 1;
1058   for (arg_index = optind; arg_index < argc; arg_index++) {
1059     const char* target = argv[arg_index];
1060     bool reapp_result = false;
1061
1062     /* Make sure we can access the given path before we go out of our
1063      * way to please it. Doing this check outside of
1064      * apply_default_acl() lets us spit out a better error message for
1065      * typos, too.
1066      */
1067     if (!path_accessible(target)) {
1068       fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target);
1069       result = EXIT_FAILURE;
1070       continue;
1071     }
1072
1073     if (recursive) {
1074       reapp_result = apply_default_acl_recursive(target, no_exec_mask);
1075     }
1076     else {
1077       /* It's either a normal file, or we're not operating recursively. */
1078       reapp_result = apply_default_acl(target, no_exec_mask);
1079     }
1080
1081     if (!reapp_result) {
1082       result = EXIT_FAILURE;
1083     }
1084   }
1085
1086   return result;
1087 }