1/*-
2 * Copyright (c) 2001 Chris D. Faulhaber
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include <sys/types.h>
31#include <sys/param.h>
32#include <sys/stat.h>
33#include <sys/acl.h>
34#include <sys/queue.h>
35
36#include <err.h>
37#include <errno.h>
38#include <stdio.h>
39#include <stdlib.h>
40#include <string.h>
41#include <unistd.h>
42
43#include "setfacl.h"
44
45/* file operations */
46#define	OP_MERGE_ACL		0x00	/* merge acl's (-mM) */
47#define	OP_REMOVE_DEF		0x01	/* remove default acl's (-k) */
48#define	OP_REMOVE_EXT		0x02	/* remove extended acl's (-b) */
49#define	OP_REMOVE_ACL		0x03	/* remove acl's (-xX) */
50#define	OP_REMOVE_BY_NUMBER	0x04	/* remove acl's (-xX) by acl entry number */
51#define	OP_ADD_ACL		0x05	/* add acls entries at a given position */
52
53/* TAILQ entry for acl operations */
54struct sf_entry {
55	uint	op;
56	acl_t	acl;
57	uint	entry_number;
58	TAILQ_ENTRY(sf_entry) next;
59};
60static TAILQ_HEAD(, sf_entry) entrylist;
61
62/* TAILQ entry for files */
63struct sf_file {
64	const char *filename;
65	TAILQ_ENTRY(sf_file) next;
66};
67static TAILQ_HEAD(, sf_file) filelist;
68
69uint have_mask;
70uint need_mask;
71uint have_stdin;
72uint n_flag;
73
74static void	add_filename(const char *filename);
75static void	usage(void);
76
77static void
78add_filename(const char *filename)
79{
80	struct sf_file *file;
81
82	if (strlen(filename) > PATH_MAX - 1) {
83		warn("illegal filename");
84		return;
85	}
86	file = zmalloc(sizeof(struct sf_file));
87	file->filename = filename;
88	TAILQ_INSERT_TAIL(&filelist, file, next);
89}
90
91static void
92usage(void)
93{
94
95	fprintf(stderr, "usage: setfacl [-bdhkn] [-a position entries] "
96	    "[-m entries] [-M file] [-x entries] [-X file] [file ...]\n");
97	exit(1);
98}
99
100int
101main(int argc, char *argv[])
102{
103	acl_t acl;
104	acl_type_t acl_type;
105	acl_entry_t unused_entry;
106	char filename[PATH_MAX];
107	int local_error, carried_error, ch, i, entry_number, ret;
108	int h_flag;
109	struct sf_file *file;
110	struct sf_entry *entry;
111	const char *fn_dup;
112	char *end;
113	struct stat sb;
114
115	acl_type = ACL_TYPE_ACCESS;
116	carried_error = local_error = 0;
117	h_flag = have_mask = have_stdin = n_flag = need_mask = 0;
118
119	TAILQ_INIT(&entrylist);
120	TAILQ_INIT(&filelist);
121
122	while ((ch = getopt(argc, argv, "M:X:a:bdhkm:nx:")) != -1)
123		switch(ch) {
124		case 'M':
125			entry = zmalloc(sizeof(struct sf_entry));
126			entry->acl = get_acl_from_file(optarg);
127			if (entry->acl == NULL)
128				err(1, "%s: get_acl_from_file() failed", optarg);
129			entry->op = OP_MERGE_ACL;
130			TAILQ_INSERT_TAIL(&entrylist, entry, next);
131			break;
132		case 'X':
133			entry = zmalloc(sizeof(struct sf_entry));
134			entry->acl = get_acl_from_file(optarg);
135			entry->op = OP_REMOVE_ACL;
136			TAILQ_INSERT_TAIL(&entrylist, entry, next);
137			break;
138		case 'a':
139			entry = zmalloc(sizeof(struct sf_entry));
140
141			entry_number = strtol(optarg, &end, 10);
142			if (end - optarg != (int)strlen(optarg))
143				errx(1, "%s: invalid entry number", optarg);
144			if (entry_number < 0)
145				errx(1, "%s: entry number cannot be less than zero", optarg);
146			entry->entry_number = entry_number;
147
148			if (argv[optind] == NULL)
149				errx(1, "missing ACL");
150			entry->acl = acl_from_text(argv[optind]);
151			if (entry->acl == NULL)
152				err(1, "%s", argv[optind]);
153			optind++;
154			entry->op = OP_ADD_ACL;
155			TAILQ_INSERT_TAIL(&entrylist, entry, next);
156			break;
157		case 'b':
158			entry = zmalloc(sizeof(struct sf_entry));
159			entry->op = OP_REMOVE_EXT;
160			TAILQ_INSERT_TAIL(&entrylist, entry, next);
161			break;
162		case 'd':
163			acl_type = ACL_TYPE_DEFAULT;
164			break;
165		case 'h':
166			h_flag = 1;
167			break;
168		case 'k':
169			entry = zmalloc(sizeof(struct sf_entry));
170			entry->op = OP_REMOVE_DEF;
171			TAILQ_INSERT_TAIL(&entrylist, entry, next);
172			break;
173		case 'm':
174			entry = zmalloc(sizeof(struct sf_entry));
175			entry->acl = acl_from_text(optarg);
176			if (entry->acl == NULL)
177				err(1, "%s", optarg);
178			entry->op = OP_MERGE_ACL;
179			TAILQ_INSERT_TAIL(&entrylist, entry, next);
180			break;
181		case 'n':
182			n_flag++;
183			break;
184		case 'x':
185			entry = zmalloc(sizeof(struct sf_entry));
186			entry_number = strtol(optarg, &end, 10);
187			if (end - optarg == (int)strlen(optarg)) {
188				if (entry_number < 0)
189					errx(1, "%s: entry number cannot be less than zero", optarg);
190				entry->entry_number = entry_number;
191				entry->op = OP_REMOVE_BY_NUMBER;
192			} else {
193				entry->acl = acl_from_text(optarg);
194				if (entry->acl == NULL)
195					err(1, "%s", optarg);
196				entry->op = OP_REMOVE_ACL;
197			}
198			TAILQ_INSERT_TAIL(&entrylist, entry, next);
199			break;
200		default:
201			usage();
202			break;
203		}
204	argc -= optind;
205	argv += optind;
206
207	if (n_flag == 0 && TAILQ_EMPTY(&entrylist))
208		usage();
209
210	/* take list of files from stdin */
211	if (argc == 0 || strcmp(argv[0], "-") == 0) {
212		if (have_stdin)
213			err(1, "cannot have more than one stdin");
214		have_stdin = 1;
215		bzero(&filename, sizeof(filename));
216		while (fgets(filename, (int)sizeof(filename), stdin)) {
217			/* remove the \n */
218			filename[strlen(filename) - 1] = '\0';
219			fn_dup = strdup(filename);
220			if (fn_dup == NULL)
221				err(1, "strdup() failed");
222			add_filename(fn_dup);
223		}
224	} else
225		for (i = 0; i < argc; i++)
226			add_filename(argv[i]);
227
228	/* cycle through each file */
229	TAILQ_FOREACH(file, &filelist, next) {
230		local_error = 0;
231
232		if (stat(file->filename, &sb) == -1) {
233			warn("%s: stat() failed", file->filename);
234			carried_error++;
235			continue;
236		}
237
238		if (acl_type == ACL_TYPE_DEFAULT && S_ISDIR(sb.st_mode) == 0) {
239			warnx("%s: default ACL may only be set on a directory",
240			    file->filename);
241			carried_error++;
242			continue;
243		}
244
245		if (h_flag)
246			ret = lpathconf(file->filename, _PC_ACL_NFS4);
247		else
248			ret = pathconf(file->filename, _PC_ACL_NFS4);
249		if (ret > 0) {
250			if (acl_type == ACL_TYPE_DEFAULT) {
251				warnx("%s: there are no default entries "
252			           "in NFSv4 ACLs", file->filename);
253				carried_error++;
254				continue;
255			}
256			acl_type = ACL_TYPE_NFS4;
257		} else if (ret == 0) {
258			if (acl_type == ACL_TYPE_NFS4)
259				acl_type = ACL_TYPE_ACCESS;
260		} else if (ret < 0 && errno != EINVAL) {
261			warn("%s: pathconf(..., _PC_ACL_NFS4) failed",
262			    file->filename);
263		}
264
265		if (h_flag)
266			acl = acl_get_link_np(file->filename, acl_type);
267		else
268			acl = acl_get_file(file->filename, acl_type);
269		if (acl == NULL) {
270			if (h_flag)
271				warn("%s: acl_get_link_np() failed",
272				    file->filename);
273			else
274				warn("%s: acl_get_file() failed",
275				    file->filename);
276			carried_error++;
277			continue;
278		}
279
280		/* cycle through each option */
281		TAILQ_FOREACH(entry, &entrylist, next) {
282			if (local_error)
283				continue;
284
285			switch(entry->op) {
286			case OP_ADD_ACL:
287				local_error += add_acl(entry->acl,
288				    entry->entry_number, &acl, file->filename);
289				break;
290			case OP_MERGE_ACL:
291				local_error += merge_acl(entry->acl, &acl,
292				    file->filename);
293				need_mask = 1;
294				break;
295			case OP_REMOVE_EXT:
296				/*
297				 * Don't try to call remove_ext() for empty
298				 * default ACL.
299				 */
300				if (acl_type == ACL_TYPE_DEFAULT &&
301				    acl_get_entry(acl, ACL_FIRST_ENTRY,
302				    &unused_entry) == 0) {
303					local_error += remove_default(&acl,
304					    file->filename);
305					break;
306				}
307				remove_ext(&acl, file->filename);
308				need_mask = 0;
309				break;
310			case OP_REMOVE_DEF:
311				if (acl_type == ACL_TYPE_NFS4) {
312					warnx("%s: there are no default entries in NFSv4 ACLs; "
313					    "cannot remove", file->filename);
314					local_error++;
315					break;
316				}
317				if (acl_delete_def_file(file->filename) == -1) {
318					warn("%s: acl_delete_def_file() failed",
319					    file->filename);
320					local_error++;
321				}
322				if (acl_type == ACL_TYPE_DEFAULT)
323					local_error += remove_default(&acl,
324					    file->filename);
325				need_mask = 0;
326				break;
327			case OP_REMOVE_ACL:
328				local_error += remove_acl(entry->acl, &acl,
329				    file->filename);
330				need_mask = 1;
331				break;
332			case OP_REMOVE_BY_NUMBER:
333				local_error += remove_by_number(entry->entry_number,
334				    &acl, file->filename);
335				need_mask = 1;
336				break;
337			}
338		}
339
340		/*
341		 * Don't try to set an empty default ACL; it will always fail.
342		 * Use acl_delete_def_file(3) instead.
343		 */
344		if (acl_type == ACL_TYPE_DEFAULT &&
345		    acl_get_entry(acl, ACL_FIRST_ENTRY, &unused_entry) == 0) {
346			if (acl_delete_def_file(file->filename) == -1) {
347				warn("%s: acl_delete_def_file() failed",
348				    file->filename);
349				carried_error++;
350			}
351			continue;
352		}
353
354		/* don't bother setting the ACL if something is broken */
355		if (local_error) {
356			carried_error++;
357			continue;
358		}
359
360		if (acl_type != ACL_TYPE_NFS4 && need_mask &&
361		    set_acl_mask(&acl, file->filename) == -1) {
362			warnx("%s: failed to set ACL mask", file->filename);
363			carried_error++;
364		} else if (h_flag) {
365			if (acl_set_link_np(file->filename, acl_type,
366			    acl) == -1) {
367				carried_error++;
368				warn("%s: acl_set_link_np() failed",
369				    file->filename);
370			}
371		} else {
372			if (acl_set_file(file->filename, acl_type,
373			    acl) == -1) {
374				carried_error++;
375				warn("%s: acl_set_file() failed",
376				    file->filename);
377			}
378		}
379
380		acl_free(acl);
381	}
382
383	return (carried_error);
384}
385