src/apply-default-acl.c

   1 /**
   2  * @file apply-default-acl.c
   3  *
   4  * @brief The entire implementation.
   5  *
   6  */
   7
   8 /* On Linux, ftw.h needs this special voodoo to work. */
   9 #define _XOPEN_SOURCE 500
  10 #define _GNU_SOURCE
  11
  12 #include <errno.h>
  13 #include <fcntl.h>  /* AT_FOO constants */
  14 #include <ftw.h>    /* nftw() et al. */
  15 #include <getopt.h>
  16 #include <libgen.h> /* basename(), dirname() */
  17 #include <stdbool.h>
  18 #include <stdio.h>
  19 #include <stdlib.h>
  20 #include <string.h>
  21 #include <sys/stat.h>
  22 #include <unistd.h>
  23
  24 /* ACLs */
  25 #include <acl/libacl.h> /* acl_get_perm, not portable */
  26 #include <sys/types.h>
  27 #include <sys/acl.h>
  28
  29 /* Most of the libacl functions return 1 for success, 0 for failure,
  30    and -1 on error */
  31 #define ACL_ERROR -1
  32 #define ACL_FAILURE 0
  33 #define ACL_SUCCESS 1
  34
  35
  36
  37 /**
  38  * @brief Get the mode bits from the given file descriptor.
  39  *
  40  * @param fd
  41  *   The file descriptor (which may reference a directory) whose
  42  *   mode we want.
  43  *
  44  * @return A mode_t (st_mode) structure containing the mode bits.
  45  *   See sys/stat.h for details.
  46  */
  47 mode_t get_mode(int fd) {
  48   if (fd <= 0) {
  49     errno = ENOENT;
  50     return ACL_ERROR;
  51   }
  52
  53   struct stat s;
  54   int result = fstat(fd, &s);
  55
  56   if (result == 0) {
  57     return s.st_mode;
  58   }
  59   else {
  60     /* errno will be set already by lstat() */
  61     return result;
  62   }
  63 }
  64
  65
  66
  67 /**
  68  * @brief Determine if the given file descriptor might refer to an
  69  *   (unsafe) hard link.
  70  *
  71  * @param fd
  72  *   The file descriptor whose link count we want to investigate.
  73  *
  74  * @return true if we are certain that @c fd does not describe a hard
  75  *   link, and false otherwise. In case of error, false is returned,
  76  *   because we are not sure that @c fd is not a hard link.
  77  */
  78 bool is_hardlink_safe(int fd) {
  79   if (fd <= 0) {
  80     return false;
  81   }
  82   struct stat s;
  83   int result = fstat(fd, &s);
  84   if (result == 0) {
  85     return (s.st_nlink == 1 || S_ISDIR(s.st_mode));
  86   }
  87   else {
  88     return false;
  89   }
  90 }
  91
  92
  93 /**
  94  * @brief Determine whether or not the given file descriptor is for
  95  *   a regular file.
  96  *
  97  * @param fd
  98  *   The file descriptor to test for regular-fileness.
  99  *
 100  * @return true if @c fd describes a regular file, and false otherwise.
 101  */
 102 bool is_regular_file(int fd) {
 103   if (fd <= 0) {
 104     return false;
 105   }
 106
 107   struct stat s;
 108   int result = fstat(fd, &s);
 109   if (result == 0) {
 110     return S_ISREG(s.st_mode);
 111   }
 112   else {
 113     return false;
 114   }
 115 }
 116
 117
 118
 119 /**
 120  * @brief Determine whether or not the given path is accessible.
 121  *
 122  * @param path
 123  *   The path to test.
 124  *
 125  * @return true if @c path is accessible to the current effective
 126  *   user/group, false otherwise.
 127  */
 128 bool path_accessible(const char* path) {
 129   if (path == NULL) {
 130     return false;
 131   }
 132
 133   /*  Test for access using the effective user and group rather than
 134       the real one. */
 135   int flags = AT_EACCESS;
 136
 137   /* Don't follow symlinks when checking for a path's existence,
 138      since we won't follow them to set its ACLs either. */
 139   flags |= AT_SYMLINK_NOFOLLOW;
 140
 141   /* If the path is relative, interpret it relative to the current
 142      working directory (just like the access() system call). */
 143   int result = faccessat(AT_FDCWD, path, F_OK, flags);
 144
 145   if (result == 0) {
 146     return true;
 147   }
 148   else {
 149     return false;
 150   }
 151 }
 152
 153
 154
 155 /**
 156  * @brief Determine whether or not the given path is a directory.
 157  *
 158  * @param path
 159  *   The path to test.
 160  *
 161  * @return true if @c path is a directory, false otherwise.
 162  */
 163 bool is_path_directory(const char* path) {
 164   if (path == NULL) {
 165     return false;
 166   }
 167
 168   struct stat s;
 169   int result = lstat(path, &s);
 170   if (result == 0) {
 171     return S_ISDIR(s.st_mode);
 172   }
 173   else {
 174     return false;
 175   }
 176 }
 177
 178
 179 /**
 180  * @brief Determine whether or not the given file descriptor is for
 181  *   a directory.
 182  *
 183  * @param fd
 184  *   The file descriptor whose directoryness is in question.
 185  *
 186  * @return true if @c fd describes a directory, and false otherwise.
 187  */
 188 bool is_directory(int fd) {
 189   if (fd <= 0) {
 190     return false;
 191   }
 192
 193   struct stat s;
 194   int result = fstat(fd, &s);
 195   if (result == 0) {
 196     return S_ISDIR(s.st_mode);
 197   }
 198   else {
 199     return false;
 200   }
 201 }
 202
 203
 204
 205 /**
 206  * @brief Update (or create) an entry in an @b minimal ACL.
 207  *
 208  * This function will not work if @c aclp contains extended
 209  * entries. This is fine for our purposes, since we call @c wipe_acls
 210  * on each path before applying the default to it.
 211  *
 212  * The assumption that there are no extended entries makes things much
 213  * simpler. For example, we only have to update the @c ACL_USER_OBJ,
 214  * @c ACL_GROUP_OBJ, and @c ACL_OTHER entries -- all others can simply
 215  * be created anew. This means we don't have to fool around comparing
 216  * named-user/group entries.
 217  *
 218  * @param aclp
 219  *   A pointer to the acl_t structure whose entry we want to modify.
 220  *
 221  * @param entry
 222  *   The new entry. If @c entry contains a user/group/other entry, we
 223  *   update the existing one. Otherwise we create a new entry.
 224  *
 225  * @return If there is an unexpected library error, @c ACL_ERROR is
 226  *   returned. Otherwise, @c ACL_SUCCESS.
 227  *
 228  */
 229 int acl_set_entry(acl_t* aclp,
 230                   acl_entry_t entry) {
 231
 232   acl_tag_t entry_tag;
 233   int gt_result = acl_get_tag_type(entry, &entry_tag);
 234   if (gt_result == ACL_ERROR) {
 235     perror("acl_set_entry (acl_get_tag_type)");
 236     return ACL_ERROR;
 237   }
 238
 239   acl_permset_t entry_permset;
 240   int ps_result = acl_get_permset(entry, &entry_permset);
 241   if (ps_result == ACL_ERROR) {
 242     perror("acl_set_entry (acl_get_permset)");
 243     return ACL_ERROR;
 244   }
 245
 246   acl_entry_t existing_entry;
 247   /* Loop through the given ACL looking for matching entries. */
 248   int result = acl_get_entry(*aclp, ACL_FIRST_ENTRY, &existing_entry);
 249
 250   while (result == ACL_SUCCESS) {
 251     acl_tag_t existing_tag = ACL_UNDEFINED_TAG;
 252     int tag_result = acl_get_tag_type(existing_entry, &existing_tag);
 253
 254     if (tag_result == ACL_ERROR) {
 255        perror("set_acl_tag_permset (acl_get_tag_type)");
 256        return ACL_ERROR;
 257     }
 258
 259     if (existing_tag == entry_tag) {
 260       if (entry_tag == ACL_USER_OBJ ||
 261           entry_tag == ACL_GROUP_OBJ ||
 262           entry_tag == ACL_OTHER) {
 263         /* Only update for these three since all other tags will have
 264            been wiped. These three are guaranteed to exist, so if we
 265            match one of them, we're allowed to return ACL_SUCCESS
 266            below and bypass the rest of the function. */
 267         acl_permset_t existing_permset;
 268         int gep_result = acl_get_permset(existing_entry, &existing_permset);
 269         if (gep_result == ACL_ERROR) {
 270           perror("acl_set_entry (acl_get_permset)");
 271           return ACL_ERROR;
 272         }
 273
 274         int s_result = acl_set_permset(existing_entry, entry_permset);
 275         if (s_result == ACL_ERROR) {
 276           perror("acl_set_entry (acl_set_permset)");
 277           return ACL_ERROR;
 278         }
 279
 280         return ACL_SUCCESS;
 281       }
 282
 283     }
 284
 285     result = acl_get_entry(*aclp, ACL_NEXT_ENTRY, &existing_entry);
 286   }
 287
 288   /* This catches both the initial acl_get_entry and the ones at the
 289      end of the loop. */
 290   if (result == ACL_ERROR) {
 291     perror("acl_set_entry (acl_get_entry)");
 292     return ACL_ERROR;
 293   }
 294
 295   /* If we've made it this far, we need to add a new entry to the
 296      ACL. */
 297   acl_entry_t new_entry;
 298
 299   /* The acl_create_entry() function can allocate new memory and/or
 300    * change the location of the ACL structure entirely. When that
 301    * happens, the value pointed to by aclp is updated, which means
 302    * that a new acl_t gets "passed out" to our caller, eventually to
 303    * be fed to acl_free(). In other words, we should still be freeing
 304    * the right thing, even if the value pointed to by aclp changes.
 305    */
 306   int c_result = acl_create_entry(aclp, &new_entry);
 307   if (c_result == ACL_ERROR) {
 308     perror("acl_set_entry (acl_create_entry)");
 309     return ACL_ERROR;
 310   }
 311
 312   int st_result = acl_set_tag_type(new_entry, entry_tag);
 313   if (st_result == ACL_ERROR) {
 314     perror("acl_set_entry (acl_set_tag_type)");
 315     return ACL_ERROR;
 316   }
 317
 318   int s_result = acl_set_permset(new_entry, entry_permset);
 319   if (s_result == ACL_ERROR) {
 320     perror("acl_set_entry (acl_set_permset)");
 321     return ACL_ERROR;
 322   }
 323
 324   if (entry_tag == ACL_USER || entry_tag == ACL_GROUP) {
 325     /* We need to set the qualifier too. */
 326     void* entry_qual = acl_get_qualifier(entry);
 327     if (entry_qual == (void*)NULL) {
 328       perror("acl_set_entry (acl_get_qualifier)");
 329       return ACL_ERROR;
 330     }
 331
 332     int sq_result = acl_set_qualifier(new_entry, entry_qual);
 333     if (sq_result == ACL_ERROR) {
 334       perror("acl_set_entry (acl_set_qualifier)");
 335       return ACL_ERROR;
 336     }
 337   }
 338
 339   return ACL_SUCCESS;
 340 }
 341
 342
 343
 344 /**
 345  * @brief Determine the number of entries in the given ACL.
 346  *
 347  * @param acl
 348  *   The ACL to inspect.
 349  *
 350  * @return Either the non-negative number of entries in @c acl, or
 351  *   @c ACL_ERROR on error.
 352  */
 353 int acl_entry_count(acl_t acl) {
 354
 355   acl_entry_t entry;
 356   int entry_count = 0;
 357   int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 358
 359   while (result == ACL_SUCCESS) {
 360     entry_count++;
 361     result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 362   }
 363
 364   if (result == ACL_ERROR) {
 365     perror("acl_entry_count (acl_get_entry)");
 366     return ACL_ERROR;
 367   }
 368
 369   return entry_count;
 370 }
 371
 372
 373
 374 /**
 375  * @brief Determine whether or not the given ACL is minimal.
 376  *
 377  * An ACL is minimal if it has fewer than four entries.
 378  *
 379  * @param acl
 380  *   The ACL whose minimality is in question.
 381  *
 382  * @return
 383  *   - @c ACL_SUCCESS - @c acl is minimal
 384  *   - @c ACL_FAILURE - @c acl is not minimal
 385  *   - @c ACL_ERROR - Unexpected library error
 386  */
 387 int acl_is_minimal(acl_t acl) {
 388
 389   int ec = acl_entry_count(acl);
 390
 391   if (ec == ACL_ERROR) {
 392     perror("acl_is_minimal (acl_entry_count)");
 393     return ACL_ERROR;
 394   }
 395
 396   if (ec < 4) {
 397     return ACL_SUCCESS;
 398   }
 399   else {
 400     return ACL_FAILURE;
 401   }
 402 }
 403
 404
 405
 406 /**
 407  * @brief Determine whether the given ACL's mask denies execute.
 408  *
 409  * @param acl
 410  *   The ACL whose mask we want to check.
 411  *
 412  * @return
 413  *   - @c ACL_SUCCESS - The @c acl has a mask which denies execute.
 414  *   - @c ACL_FAILURE - The @c acl has a mask which does not deny execute.
 415  *   - @c ACL_ERROR - Unexpected library error.
 416  */
 417 int acl_execute_masked(acl_t acl) {
 418
 419   acl_entry_t entry;
 420   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 421
 422   while (ge_result == ACL_SUCCESS) {
 423     acl_tag_t tag = ACL_UNDEFINED_TAG;
 424     int tag_result = acl_get_tag_type(entry, &tag);
 425
 426     if (tag_result == ACL_ERROR) {
 427        perror("acl_execute_masked (acl_get_tag_type)");
 428        return ACL_ERROR;
 429     }
 430
 431     if (tag == ACL_MASK) {
 432       /* This is the mask entry, get its permissions, and see if
 433          execute is specified. */
 434       acl_permset_t permset;
 435
 436       int ps_result = acl_get_permset(entry, &permset);
 437       if (ps_result == ACL_ERROR) {
 438         perror("acl_execute_masked (acl_get_permset)");
 439         return ACL_ERROR;
 440       }
 441
 442       int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 443       if (gp_result == ACL_ERROR) {
 444         perror("acl_execute_masked (acl_get_perm)");
 445         return ACL_ERROR;
 446       }
 447
 448       if (gp_result == ACL_FAILURE) {
 449         /* No execute bit set in the mask; execute not allowed. */
 450         return ACL_SUCCESS;
 451       }
 452     }
 453
 454     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 455   }
 456
 457   return ACL_FAILURE;
 458 }
 459
 460
 461
 462 /**
 463  * @brief Determine whether @c fd is executable (by anyone) or a
 464  *   directory.
 465  *
 466  * This is used as part of the heuristic to determine whether or not
 467  * we should mask the execute bit when inheriting an ACL. If @c fd
 468  * describes a directory, the answer is a clear-cut yes. This behavior
 469  * is modeled after the capital 'X' perms of setfacl.
 470  *
 471  * If @c fd describes a file, we check the @a effective permissions,
 472  * contrary to what setfacl does.
 473  *
 474  * @param fd
 475  *   The file descriptor to check.
 476  *
 477  * @return
 478  *   - @c ACL_SUCCESS - @c fd describes a directory, or someone has effective
 479        execute permissions.
 480  *   - @c ACL_FAILURE - @c fd describes a regular file and nobody can execute
 481        it.
 482  *   - @c ACL_ERROR - Unexpected library error.
 483  */
 484 int any_can_execute_or_dir(int fd) {
 485
 486   if (is_directory(fd)) {
 487     /* That was easy... */
 488     return ACL_SUCCESS;
 489   }
 490
 491   acl_t acl = acl_get_fd(fd);
 492
 493   if (acl == (acl_t)NULL) {
 494     perror("any_can_execute_or_dir (acl_get_file)");
 495     return ACL_ERROR;
 496   }
 497
 498   /* Our return value. */
 499   int result = ACL_FAILURE;
 500
 501   if (acl_is_minimal(acl)) {
 502     mode_t mode = get_mode(fd);
 503     if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) {
 504       result = ACL_SUCCESS;
 505       goto cleanup;
 506     }
 507     else {
 508       result = ACL_FAILURE;
 509       goto cleanup;
 510     }
 511   }
 512
 513   acl_entry_t entry;
 514   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 515
 516   while (ge_result == ACL_SUCCESS) {
 517     /* The first thing we do is check to see if this is a mask
 518        entry. If it is, we skip it entirely. */
 519     acl_tag_t tag = ACL_UNDEFINED_TAG;
 520     int tag_result = acl_get_tag_type(entry, &tag);
 521
 522     if (tag_result == ACL_ERROR) {
 523       perror("any_can_execute_or_dir (acl_get_tag_type)");
 524       result = ACL_ERROR;
 525       goto cleanup;
 526     }
 527
 528     if (tag == ACL_MASK) {
 529       ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 530       continue;
 531     }
 532
 533     /* Ok, so it's not a mask entry. Check the execute perms. */
 534     acl_permset_t permset;
 535
 536     int ps_result = acl_get_permset(entry, &permset);
 537     if (ps_result == ACL_ERROR) {
 538       perror("any_can_execute_or_dir (acl_get_permset)");
 539       result = ACL_ERROR;
 540       goto cleanup;
 541     }
 542
 543     int gp_result = acl_get_perm(permset, ACL_EXECUTE);
 544     if (gp_result == ACL_ERROR) {
 545       perror("any_can_execute_or_dir (acl_get_perm)");
 546       result = ACL_ERROR;
 547       goto cleanup;
 548     }
 549
 550     if (gp_result == ACL_SUCCESS) {
 551       /* Only return ACL_SUCCESS if this execute bit is not masked. */
 552       if (acl_execute_masked(acl) != ACL_SUCCESS) {
 553         result = ACL_SUCCESS;
 554         goto cleanup;
 555       }
 556     }
 557
 558     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 559   }
 560
 561   if (ge_result == ACL_ERROR) {
 562     perror("any_can_execute_or_dir (acl_get_entry)");
 563     result = ACL_ERROR;
 564     goto cleanup;
 565   }
 566
 567  cleanup:
 568   acl_free(acl);
 569   return result;
 570 }
 571
 572
 573
 574 /**
 575  * @brief Set @c acl as the default ACL on @c path if it's a directory.
 576  *
 577  * This overwrites any existing default ACL on @c path. If no default
 578  * ACL exists, then one is created. If @c path is not a directory, we
 579  * return ACL_FAILURE but no error is raised.
 580  *
 581  * @param path
 582  *   The target directory whose ACL we wish to replace or create.
 583  *
 584   * @param acl
 585  *   The ACL to set as default on @c path.
 586  *
 587  * @return
 588  *   - @c ACL_SUCCESS - The default ACL was assigned successfully.
 589  *   - @c ACL_FAILURE - If @c path is not a directory.
 590  *   - @c ACL_ERROR - Unexpected library error.
 591  */
 592 int assign_default_acl(const char* path, acl_t acl) {
 593
 594   if (path == NULL) {
 595     errno = ENOENT;
 596     return ACL_ERROR;
 597   }
 598
 599   if (!is_path_directory(path)) {
 600     return ACL_FAILURE;
 601   }
 602
 603     /* Our return value; success unless something bad happens. */
 604   int result = ACL_SUCCESS;
 605   acl_t path_acl = acl_dup(acl);
 606
 607   if (path_acl == (acl_t)NULL) {
 608     perror("assign_default_acl (acl_dup)");
 609     return ACL_ERROR; /* Nothing to clean up in this case. */
 610   }
 611
 612   int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl);
 613   if (sf_result == ACL_ERROR) {
 614     perror("assign_default_acl (acl_set_file)");
 615     result = ACL_ERROR;
 616   }
 617
 618   acl_free(path_acl);
 619   return result;
 620 }
 621
 622
 623
 624 /**
 625  * @brief Remove @c ACL_USER, @c ACL_GROUP, and @c ACL_MASK entries
 626  *   from the given file descriptor.
 627  *
 628  * @param fd
 629  *   The file descriptor whose ACLs we want to wipe.
 630  *
 631  * @return
 632  *   - @c ACL_SUCCESS - The ACLs were wiped successfully, or none
 633  *     existed in the first place.
 634  *   - @c ACL_ERROR - Unexpected library error.
 635  */
 636 int wipe_acls(int fd) {
 637
 638   if (fd <= 0) {
 639     errno = ENOENT;
 640     return ACL_ERROR;
 641   }
 642
 643   acl_t acl = acl_get_fd(fd);
 644   if (acl == (acl_t)NULL) {
 645     perror("wipe_acls (acl_get_fd)");
 646     return ACL_ERROR;
 647   }
 648
 649   /* Our return value. */
 650   int result = ACL_SUCCESS;
 651
 652   acl_entry_t entry;
 653   int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 654
 655   while (ge_result == ACL_SUCCESS) {
 656     int d_result = acl_delete_entry(acl, entry);
 657     if (d_result == ACL_ERROR) {
 658       perror("wipe_acls (acl_delete_entry)");
 659       result = ACL_ERROR;
 660       goto cleanup;
 661     }
 662
 663     ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 664   }
 665
 666   /* Catches the first acl_get_entry as well as the ones at the end of
 667      the loop. */
 668   if (ge_result == ACL_ERROR) {
 669     perror("wipe_acls (acl_get_entry)");
 670     result = ACL_ERROR;
 671     goto cleanup;
 672   }
 673
 674   int sf_result = acl_set_fd(fd, acl);
 675   if (sf_result == ACL_ERROR) {
 676     perror("wipe_acls (acl_set_fd)");
 677     result = ACL_ERROR;
 678     goto cleanup;
 679   }
 680
 681  cleanup:
 682   acl_free(acl);
 683   return result;
 684 }
 685
 686
 687
 688 /**
 689  * @brief Apply parent default ACL to a path.
 690  *
 691  * This overwrites any existing ACLs on @c path.
 692  *
 693  * @param path
 694  *   The path whose ACL we would like to reset to its default.
 695  *
 696  * @param no_exec_mask
 697  *   The value (either true or false) of the --no-exec-mask flag.
 698  *
 699  * @return
 700  *   - @c ACL_SUCCESS - The parent default ACL was inherited successfully.
 701  *   - @c ACL_FAILURE - The target path is not a regular file/directory,
 702  *     or the parent of @c path is not a directory.
 703  *   - @c ACL_ERROR - Unexpected library error.
 704  */
 705 int apply_default_acl(const char* path, bool no_exec_mask) {
 706
 707   if (path == NULL) {
 708     errno = ENOENT;
 709     return ACL_ERROR;
 710   }
 711
 712   /* Define these next three variables here because we may have to
 713    * jump to the cleanup routine which expects them to exist.
 714    */
 715
 716   /* Our return value. */
 717   int result = ACL_SUCCESS;
 718
 719   /* The default ACL on path's parent directory */
 720   acl_t defacl = (acl_t)NULL;
 721
 722   /* The file descriptor corresponding to "path" */
 723   int fd = 0;
 724
 725   /* Split "path" into base/dirname parts to be used with openat().
 726    * We duplicate the strings involved because dirname/basename mangle
 727    * their arguments.
 728    */
 729   char* path_copy = strdup(path);
 730   if (path_copy == NULL) {
 731     perror("apply_default_acl (strdup)");
 732     return ACL_ERROR;
 733   }
 734   char* parent = dirname(path_copy);
 735
 736   fd = open(path, O_NOFOLLOW);
 737   if (fd == -1) {
 738     if (errno == ELOOP) {
 739       result = ACL_FAILURE; /* hit a symlink */
 740       goto cleanup;
 741     }
 742     else {
 743       perror("apply_default_acl (open fd)");
 744       result = ACL_ERROR;
 745       goto cleanup;
 746     }
 747   }
 748
 749
 750   /* Refuse to operate on hard links, which can be abused by an
 751    * attacker to trick us into changing the ACL on a file we didn't
 752    * intend to; namely the "target" of the hard link. There is TOCTOU
 753    * race condition here, but the window is as small as possible
 754    * between when we open the file descriptor (look above) and when we
 755    * fstat it.
 756   */
 757   if (!is_hardlink_safe(fd)) {
 758     result = ACL_FAILURE;
 759     goto cleanup;
 760   }
 761
 762   if (!is_regular_file(fd) && !is_directory(fd)) {
 763     result = ACL_FAILURE;
 764     goto cleanup;
 765   }
 766
 767   /* Default to not masking the exec bit; i.e. applying the default
 768      ACL literally. If --no-exec-mask was not specified, then we try
 769      to "guess" whether or not to mask the exec bit. */
 770   bool allow_exec = true;
 771
 772   if (!no_exec_mask) {
 773     int ace_result = any_can_execute_or_dir(fd);
 774
 775     if (ace_result == ACL_ERROR) {
 776       perror("apply_default_acl (any_can_execute_or_dir)");
 777       result = ACL_ERROR;
 778       goto cleanup;
 779     }
 780
 781     allow_exec = (bool)ace_result;
 782   }
 783
 784   defacl = acl_get_file(parent, ACL_TYPE_DEFAULT);
 785
 786   if (defacl == (acl_t)NULL) {
 787     perror("apply_default_acl (acl_get_file)");
 788     result = ACL_ERROR;
 789     goto cleanup;
 790   }
 791
 792   int wipe_result = wipe_acls(fd);
 793   if (wipe_result == ACL_ERROR) {
 794     perror("apply_default_acl (wipe_acls)");
 795     result = ACL_ERROR;
 796     goto cleanup;
 797   }
 798
 799   /* Do this after wipe_acls(), otherwise we'll overwrite the wiped
 800      ACL with this one. */
 801   acl_t acl = acl_get_fd(fd);
 802   if (acl == (acl_t)NULL) {
 803     perror("apply_default_acl (acl_get_fd)");
 804     result = ACL_ERROR;
 805     goto cleanup;
 806   }
 807
 808   /* If it's a directory, inherit the parent's default. */
 809   int inherit_result = assign_default_acl(path, defacl);
 810   if (inherit_result == ACL_ERROR) {
 811     perror("apply_default_acl (assign_default_acl)");
 812     result = ACL_ERROR;
 813     goto cleanup;
 814   }
 815
 816   acl_entry_t entry;
 817   int ge_result = acl_get_entry(defacl, ACL_FIRST_ENTRY, &entry);
 818
 819   while (ge_result == ACL_SUCCESS) {
 820     acl_tag_t tag = ACL_UNDEFINED_TAG;
 821     int tag_result = acl_get_tag_type(entry, &tag);
 822
 823     if (tag_result == ACL_ERROR) {
 824        perror("apply_default_acl (acl_get_tag_type)");
 825        result = ACL_ERROR;
 826        goto cleanup;
 827     }
 828
 829
 830     /* We've got an entry/tag from the default ACL. Get its permset. */
 831     acl_permset_t permset;
 832     int ps_result = acl_get_permset(entry, &permset);
 833     if (ps_result == ACL_ERROR) {
 834       perror("apply_default_acl (acl_get_permset)");
 835       result = ACL_ERROR;
 836       goto cleanup;
 837     }
 838
 839     /* If this is a default mask, fix it up. */
 840     if (tag == ACL_MASK ||
 841         tag == ACL_USER_OBJ ||
 842         tag == ACL_GROUP_OBJ ||
 843         tag == ACL_OTHER) {
 844
 845       if (!allow_exec) {
 846         /* The mask doesn't affect acl_user_obj, acl_group_obj (in
 847            minimal ACLs) or acl_other entries, so if execute should be
 848            masked, we have to do it manually. */
 849         int d_result = acl_delete_perm(permset, ACL_EXECUTE);
 850         if (d_result == ACL_ERROR) {
 851           perror("apply_default_acl (acl_delete_perm)");
 852           result = ACL_ERROR;
 853           goto cleanup;
 854         }
 855
 856         int sp_result = acl_set_permset(entry, permset);
 857         if (sp_result == ACL_ERROR) {
 858           perror("apply_default_acl (acl_set_permset)");
 859           result = ACL_ERROR;
 860           goto cleanup;
 861         }
 862       }
 863     }
 864
 865     /* Finally, add the permset to the access ACL. It's actually
 866      * important that we pass in the address of "acl" here, and not
 867      * "acl" itself. Why? The call to acl_create_entry() within
 868      * acl_set_entry() can allocate new memory for the entry.
 869      * Sometimes that can be done in-place, in which case everything
 870      * is cool and the new memory gets released when we call
 871      * acl_free(acl).
 872      *
 873      * But occasionally, the whole ACL structure will have to be moved
 874      * in order to allocate the extra space. When that happens,
 875      * acl_create_entry() modifies the pointer it was passed (in this
 876      * case, &acl) to point to the new location. We want to call
 877      * acl_free() on the new location, and since acl_free() gets
 878      * called right here, we need acl_create_entry() to update the
 879      * value of "acl". To do that, it needs the address of "acl".
 880      */
 881     int set_result = acl_set_entry(&acl, entry);
 882     if (set_result == ACL_ERROR) {
 883       perror("apply_default_acl (acl_set_entry)");
 884       result = ACL_ERROR;
 885       goto cleanup;
 886     }
 887
 888     ge_result = acl_get_entry(defacl, ACL_NEXT_ENTRY, &entry);
 889   }
 890
 891   /* Catches the first acl_get_entry as well as the ones at the end of
 892      the loop. */
 893   if (ge_result == ACL_ERROR) {
 894     perror("apply_default_acl (acl_get_entry)");
 895     result = ACL_ERROR;
 896     goto cleanup;
 897   }
 898
 899   int sf_result = acl_set_fd(fd, acl);
 900   if (sf_result == ACL_ERROR) {
 901     perror("apply_default_acl (acl_set_fd)");
 902     result = ACL_ERROR;
 903     goto cleanup;
 904   }
 905
 906  cleanup:
 907   free(path_copy);
 908   if (defacl != (acl_t)NULL) {
 909     acl_free(defacl);
 910   }
 911   if (fd >= 0 && close(fd) == -1) {
 912     perror("apply_default_acl (close)");
 913     result = ACL_ERROR;
 914   }
 915   return result;
 916 }
 917
 918
 919
 920 /**
 921  * @brief Display program usage information.
 922  *
 923  * @param program_name
 924  *   The program name to use in the output.
 925  *
 926  */
 927 void usage(const char* program_name) {
 928   printf("Apply any applicable default ACLs to the given files or "
 929          "directories.\n\n");
 930   printf("Usage: %s [flags] <target1> [<target2> [ <target3>...]]\n\n",
 931          program_name);
 932   printf("Flags:\n");
 933   printf(" -h, --help         Print this help message\n");
 934   printf(" -r, --recursive    Act on any given directories recursively\n");
 935   printf(" -x, --no-exec-mask Apply execute permissions unconditionally\n");
 936
 937   return;
 938 }
 939
 940
 941 /**
 942  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 943  *
 944  * For parameter information, see the @c nftw man page.
 945  *
 946  * @return If the ACL was applied to @c target successfully, we return
 947  *   @c FTW_CONTINUE to signal to @ nftw() that we should proceed onto
 948  *   the next file or directory. Otherwise, we return @c FTW_STOP to
 949  *   signal failure.
 950  *
 951  */
 952 int apply_default_acl_nftw(const char *target,
 953                            const struct stat *s,
 954                            int info,
 955                            struct FTW *ftw) {
 956
 957   bool app_result = apply_default_acl(target, false);
 958   if (app_result) {
 959     return FTW_CONTINUE;
 960   }
 961   else {
 962     return FTW_STOP;
 963   }
 964 }
 965
 966
 967
 968 /**
 969  * @brief Wrapper around @c apply_default_acl() for use with @c nftw().
 970  *
 971  * This is identical to @c apply_default_acl_nftw(), except it passes
 972  * @c true to @c apply_default_acl() as its no_exec_mask argument.
 973  *
 974  */
 975 int apply_default_acl_nftw_x(const char *target,
 976                              const struct stat *s,
 977                              int info,
 978                              struct FTW *ftw) {
 979
 980   bool app_result = apply_default_acl(target, true);
 981   if (app_result) {
 982     return FTW_CONTINUE;
 983   }
 984   else {
 985     return FTW_STOP;
 986   }
 987 }
 988
 989
 990
 991 /**
 992  * @brief Recursive version of @c apply_default_acl().
 993  *
 994  * If @c target is a directory, we use @c nftw() to call @c
 995  * apply_default_acl() recursively on all of its children. Otherwise,
 996  * we just delegate to @c apply_default_acl().
 997  *
 998  * We ignore symlinks for consistency with chmod -r.
 999  *
1000  * @param target
1001  *   The root (path) of the recursive application.
1002  *
1003  * @param no_exec_mask
1004  *   The value (either true or false) of the --no-exec-mask flag.
1005  *
1006  * @return
1007  *   If @c target is not a directory, we return the result of
1008  *   calling @c apply_default_acl() on @c target. Otherwise, we convert
1009  *   the return value of @c nftw(). If @c nftw() succeeds (returns 0),
1010  *   then we return @c true. Otherwise, we return @c false.
1011  *   \n\n
1012  *   If there is an error, it will be reported via @c perror, but
1013  *   we still return @c false.
1014  */
1015 bool apply_default_acl_recursive(const char *target, bool no_exec_mask) {
1016
1017   if (!is_path_directory(target)) {
1018     return apply_default_acl(target, no_exec_mask);
1019   }
1020
1021   int max_levels = 256;
1022   int flags = FTW_PHYS; /* Don't follow links. */
1023
1024   /* There are two separate functions that could be passed to
1025      nftw(). One passes no_exec_mask = true to apply_default_acl(),
1026      and the other passes no_exec_mask = false. Since the function we
1027      pass to nftw() cannot have parameters, we have to create separate
1028      options and make the decision here. */
1029   int (*fn)(const char *, const struct stat *, int, struct FTW *) = NULL;
1030   fn = no_exec_mask ? apply_default_acl_nftw_x : apply_default_acl_nftw;
1031
1032   int nftw_result = nftw(target, fn, max_levels, flags);
1033
1034   if (nftw_result == 0) {
1035     /* Success */
1036     return true;
1037   }
1038
1039   /* nftw will return -1 on error, or if the supplied function
1040    * (apply_default_acl_nftw) returns a non-zero result, nftw will
1041    * return that.
1042    */
1043   if (nftw_result == -1) {
1044     perror("apply_default_acl_recursive (nftw)");
1045   }
1046
1047   return false;
1048 }
1049
1050
1051
1052 /**
1053  * @brief Call apply_default_acl (possibly recursively) on each
1054  * command-line argument.
1055  *
1056  * @return Either @c EXIT_FAILURE or @c EXIT_SUCCESS. If everything
1057  *   goes as expected, we return @c EXIT_SUCCESS. Otherwise, we return
1058  *   @c EXIT_FAILURE.
1059  */
1060 int main(int argc, char* argv[]) {
1061
1062   if (argc < 2) {
1063     usage(argv[0]);
1064     return EXIT_FAILURE;
1065   }
1066
1067   bool recursive = false;
1068   bool no_exec_mask = false;
1069
1070   struct option long_options[] = {
1071     /* These options set a flag. */
1072     {"help",      no_argument, NULL, 'h'},
1073     {"recursive", no_argument, NULL, 'r'},
1074     {"no-exec-mask", no_argument, NULL, 'x'},
1075     {NULL,        0,           NULL, 0}
1076   };
1077
1078   int opt = 0;
1079
1080   while ((opt = getopt_long(argc, argv, "hrx", long_options, NULL)) != -1) {
1081     switch (opt) {
1082     case 'h':
1083       usage(argv[0]);
1084       return EXIT_SUCCESS;
1085     case 'r':
1086       recursive = true;
1087       break;
1088     case 'x':
1089       no_exec_mask = true;
1090       break;
1091     default:
1092       usage(argv[0]);
1093       return EXIT_FAILURE;
1094     }
1095   }
1096
1097   int result = EXIT_SUCCESS;
1098
1099   int arg_index = 1;
1100   for (arg_index = optind; arg_index < argc; arg_index++) {
1101     const char* target = argv[arg_index];
1102     bool reapp_result = false;
1103
1104     /* Make sure we can access the given path before we go out of our
1105      * way to please it. Doing this check outside of
1106      * apply_default_acl() lets us spit out a better error message for
1107      * typos, too.
1108      */
1109     if (!path_accessible(target)) {
1110       fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target);
1111       result = EXIT_FAILURE;
1112       continue;
1113     }
1114
1115     if (recursive) {
1116       reapp_result = apply_default_acl_recursive(target, no_exec_mask);
1117     }
1118     else {
1119       /* It's either a normal file, or we're not operating recursively. */
1120       reapp_result = apply_default_acl(target, no_exec_mask);
1121     }
1122
1123     if (!reapp_result) {
1124       result = EXIT_FAILURE;
1125     }
1126   }
1127
1128   return result;
1129 }