1 /*-
2 * Copyright (c) 2001 Chris D. Faulhaber
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include <sys/types.h>
31 #include <sys/acl.h>
32 #include <sys/stat.h>
33
34 #include <err.h>
35 #include <stdio.h>
36
37 #include "setfacl.h"
38
39 static int merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new,
40 int acl_brand);
41
42 static int
merge_user_group(acl_entry_t * entry,acl_entry_t * entry_new,int acl_brand)43 merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new, int acl_brand)
44 {
45 acl_permset_t permset;
46 acl_entry_type_t entry_type;
47 acl_flagset_t flagset;
48 int have_entry;
49 uid_t *id, *id_new;
50
51 have_entry = 0;
52
53 id = acl_get_qualifier(*entry);
54 if (id == NULL)
55 err(1, "acl_get_qualifier() failed");
56 id_new = acl_get_qualifier(*entry_new);
57 if (id_new == NULL)
58 err(1, "acl_get_qualifier() failed");
59 if (*id == *id_new) {
60 /* any other matches */
61 if (acl_get_permset(*entry, &permset) == -1)
62 err(1, "acl_get_permset() failed");
63 if (acl_set_permset(*entry_new, permset) == -1)
64 err(1, "acl_set_permset() failed");
65
66 if (acl_brand == ACL_BRAND_NFS4) {
67 if (acl_get_entry_type_np(*entry, &entry_type))
68 err(1, "acl_get_entry_type_np() failed");
69 if (acl_set_entry_type_np(*entry_new, entry_type))
70 err(1, "acl_set_entry_type_np() failed");
71 if (acl_get_flagset_np(*entry, &flagset))
72 err(1, "acl_get_flagset_np() failed");
73 if (acl_set_flagset_np(*entry_new, flagset))
74 err(1, "acl_set_flagset_np() failed");
75 }
76
77 have_entry = 1;
78 }
79 acl_free(id);
80 acl_free(id_new);
81
82 return (have_entry);
83 }
84
85 /*
86 * merge an ACL into existing file's ACL
87 */
88 int
merge_acl(acl_t acl,acl_t * prev_acl,const char * filename)89 merge_acl(acl_t acl, acl_t *prev_acl, const char *filename)
90 {
91 acl_entry_t entry, entry_new;
92 acl_permset_t permset;
93 acl_t acl_new;
94 acl_tag_t tag, tag_new;
95 acl_entry_type_t entry_type, entry_type_new;
96 acl_flagset_t flagset;
97 int entry_id, entry_id_new, have_entry, had_entry, entry_number = 0;
98 int acl_brand, prev_acl_brand;
99
100 acl_get_brand_np(acl, &acl_brand);
101 acl_get_brand_np(*prev_acl, &prev_acl_brand);
102
103 if (branding_mismatch(acl_brand, prev_acl_brand)) {
104 warnx("%s: branding mismatch; existing ACL is %s, "
105 "entry to be merged is %s", filename,
106 brand_name(prev_acl_brand), brand_name(acl_brand));
107 return (-1);
108 }
109
110 acl_new = acl_dup(*prev_acl);
111 if (acl_new == NULL)
112 err(1, "%s: acl_dup() failed", filename);
113
114 entry_id = ACL_FIRST_ENTRY;
115
116 while (acl_get_entry(acl, entry_id, &entry) == 1) {
117 entry_id = ACL_NEXT_ENTRY;
118 have_entry = 0;
119 had_entry = 0;
120
121 /* keep track of existing ACL_MASK entries */
122 if (acl_get_tag_type(entry, &tag) == -1)
123 err(1, "%s: acl_get_tag_type() failed - "
124 "invalid ACL entry", filename);
125 if (tag == ACL_MASK)
126 have_mask = 1;
127
128 /* check against the existing ACL entries */
129 entry_id_new = ACL_FIRST_ENTRY;
130 while (acl_get_entry(acl_new, entry_id_new, &entry_new) == 1) {
131 entry_id_new = ACL_NEXT_ENTRY;
132
133 if (acl_get_tag_type(entry, &tag) == -1)
134 err(1, "%s: acl_get_tag_type() failed",
135 filename);
136 if (acl_get_tag_type(entry_new, &tag_new) == -1)
137 err(1, "%s: acl_get_tag_type() failed",
138 filename);
139 if (tag != tag_new)
140 continue;
141
142 /*
143 * For NFSv4, in addition to "tag" and "id" we also
144 * compare "entry_type".
145 */
146 if (acl_brand == ACL_BRAND_NFS4) {
147 if (acl_get_entry_type_np(entry, &entry_type))
148 err(1, "%s: acl_get_entry_type_np() "
149 "failed", filename);
150 if (acl_get_entry_type_np(entry_new, &entry_type_new))
151 err(1, "%s: acl_get_entry_type_np() "
152 "failed", filename);
153 if (entry_type != entry_type_new)
154 continue;
155 }
156
157 switch(tag) {
158 case ACL_USER:
159 case ACL_GROUP:
160 have_entry = merge_user_group(&entry,
161 &entry_new, acl_brand);
162 if (have_entry == 0)
163 break;
164 /* FALLTHROUGH */
165 case ACL_USER_OBJ:
166 case ACL_GROUP_OBJ:
167 case ACL_OTHER:
168 case ACL_MASK:
169 case ACL_EVERYONE:
170 if (acl_get_permset(entry, &permset) == -1)
171 err(1, "%s: acl_get_permset() failed",
172 filename);
173 if (acl_set_permset(entry_new, permset) == -1)
174 err(1, "%s: acl_set_permset() failed",
175 filename);
176
177 if (acl_brand == ACL_BRAND_NFS4) {
178 if (acl_get_entry_type_np(entry, &entry_type))
179 err(1, "%s: acl_get_entry_type_np() failed",
180 filename);
181 if (acl_set_entry_type_np(entry_new, entry_type))
182 err(1, "%s: acl_set_entry_type_np() failed",
183 filename);
184 if (acl_get_flagset_np(entry, &flagset))
185 err(1, "%s: acl_get_flagset_np() failed",
186 filename);
187 if (acl_set_flagset_np(entry_new, flagset))
188 err(1, "%s: acl_set_flagset_np() failed",
189 filename);
190 }
191 had_entry = have_entry = 1;
192 break;
193 default:
194 /* should never be here */
195 errx(1, "%s: invalid tag type: %i", filename, tag);
196 break;
197 }
198 }
199
200 /* if this entry has not been found, it must be new */
201 if (had_entry == 0) {
202
203 /*
204 * NFSv4 ACL entries must be prepended to the ACL.
205 * Appending them at the end makes no sense, since
206 * in most cases they wouldn't even get evaluated.
207 */
208 if (acl_brand == ACL_BRAND_NFS4) {
209 if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
210 warn("%s: acl_create_entry_np() failed", filename);
211 acl_free(acl_new);
212 return (-1);
213 }
214 /*
215 * Without this increment, adding several
216 * entries at once, for example
217 * "setfacl -m user:1:r:allow,user:2:r:allow",
218 * would make them appear in reverse order.
219 */
220 entry_number++;
221 } else {
222 if (acl_create_entry(&acl_new, &entry_new) == -1) {
223 warn("%s: acl_create_entry() failed", filename);
224 acl_free(acl_new);
225 return (-1);
226 }
227 }
228 if (acl_copy_entry(entry_new, entry) == -1)
229 err(1, "%s: acl_copy_entry() failed", filename);
230 }
231 }
232
233 acl_free(*prev_acl);
234 *prev_acl = acl_new;
235
236 return (0);
237 }
238
239 int
add_acl(acl_t acl,uint entry_number,acl_t * prev_acl,const char * filename)240 add_acl(acl_t acl, uint entry_number, acl_t *prev_acl, const char *filename)
241 {
242 acl_entry_t entry, entry_new;
243 acl_t acl_new;
244 int entry_id, acl_brand, prev_acl_brand;
245
246 acl_get_brand_np(acl, &acl_brand);
247 acl_get_brand_np(*prev_acl, &prev_acl_brand);
248
249 if (prev_acl_brand != ACL_BRAND_NFS4) {
250 warnx("%s: the '-a' option is only applicable to NFSv4 ACLs",
251 filename);
252 return (-1);
253 }
254
255 if (branding_mismatch(acl_brand, ACL_BRAND_NFS4)) {
256 warnx("%s: branding mismatch; existing ACL is NFSv4, "
257 "entry to be added is %s", filename,
258 brand_name(acl_brand));
259 return (-1);
260 }
261
262 acl_new = acl_dup(*prev_acl);
263 if (acl_new == NULL)
264 err(1, "%s: acl_dup() failed", filename);
265
266 entry_id = ACL_FIRST_ENTRY;
267
268 while (acl_get_entry(acl, entry_id, &entry) == 1) {
269 entry_id = ACL_NEXT_ENTRY;
270
271 if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
272 warn("%s: acl_create_entry_np() failed", filename);
273 acl_free(acl_new);
274 return (-1);
275 }
276
277 /*
278 * Without this increment, adding several
279 * entries at once, for example
280 * "setfacl -m user:1:r:allow,user:2:r:allow",
281 * would make them appear in reverse order.
282 */
283 entry_number++;
284
285 if (acl_copy_entry(entry_new, entry) == -1)
286 err(1, "%s: acl_copy_entry() failed", filename);
287 }
288
289 acl_free(*prev_acl);
290 *prev_acl = acl_new;
291
292 return (0);
293 }
294