1/*-
2 * Copyright (c) 2003-2008 Tim Kientzle
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25#include "test.h"
26__FBSDID("$FreeBSD$");
27
28#if defined(__FreeBSD__) && __FreeBSD__ > 4
29#include <sys/acl.h>
30
31struct myacl_t {
32	int type;  /* Type of ACL: "access" or "default" */
33	int permset; /* Permissions for this class of users. */
34	int tag; /* Owner, User, Owning group, group, other, etc. */
35	int qual; /* GID or UID of user/group, depending on tag. */
36	const char *name; /* Name of user/group, depending on tag. */
37};
38
39static struct myacl_t acls2[] = {
40	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS, ARCHIVE_ENTRY_ACL_EXECUTE | ARCHIVE_ENTRY_ACL_READ,
41	  ARCHIVE_ENTRY_ACL_USER_OBJ, -1, "" },
42	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS, ARCHIVE_ENTRY_ACL_READ,
43	  ARCHIVE_ENTRY_ACL_USER, 77, "user77" },
44	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS, 0,
45	  ARCHIVE_ENTRY_ACL_USER, 78, "user78" },
46	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS, ARCHIVE_ENTRY_ACL_READ,
47	  ARCHIVE_ENTRY_ACL_GROUP_OBJ, -1, "" },
48	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS, 0007,
49	  ARCHIVE_ENTRY_ACL_GROUP, 78, "group78" },
50	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS,
51	  ARCHIVE_ENTRY_ACL_WRITE | ARCHIVE_ENTRY_ACL_EXECUTE,
52	  ARCHIVE_ENTRY_ACL_OTHER, -1, "" },
53	{ ARCHIVE_ENTRY_ACL_TYPE_ACCESS,
54	  ARCHIVE_ENTRY_ACL_WRITE | ARCHIVE_ENTRY_ACL_READ | ARCHIVE_ENTRY_ACL_EXECUTE,
55	  ARCHIVE_ENTRY_ACL_MASK, -1, "" },
56	{ 0, 0, 0, 0, NULL }
57};
58
59static void
60set_acls(struct archive_entry *ae, struct myacl_t *acls)
61{
62	int i;
63
64	archive_entry_acl_clear(ae);
65	for (i = 0; acls[i].name != NULL; i++) {
66		archive_entry_acl_add_entry(ae,
67		    acls[i].type, acls[i].permset, acls[i].tag, acls[i].qual,
68		    acls[i].name);
69	}
70}
71
72static int
73acl_match(acl_entry_t aclent, struct myacl_t *myacl)
74{
75	gid_t g, *gp;
76	uid_t u, *up;
77	acl_tag_t tag_type;
78	acl_permset_t opaque_ps;
79	int permset = 0;
80
81	acl_get_tag_type(aclent, &tag_type);
82
83	/* translate the silly opaque permset to a bitmap */
84	acl_get_permset(aclent, &opaque_ps);
85	if (acl_get_perm_np(opaque_ps, ACL_EXECUTE))
86		permset |= ARCHIVE_ENTRY_ACL_EXECUTE;
87	if (acl_get_perm_np(opaque_ps, ACL_WRITE))
88		permset |= ARCHIVE_ENTRY_ACL_WRITE;
89	if (acl_get_perm_np(opaque_ps, ACL_READ))
90		permset |= ARCHIVE_ENTRY_ACL_READ;
91
92	if (permset != myacl->permset)
93		return (0);
94
95	switch (tag_type) {
96	case ACL_USER_OBJ:
97		if (myacl->tag != ARCHIVE_ENTRY_ACL_USER_OBJ) return (0);
98		break;
99	case ACL_USER:
100		if (myacl->tag != ARCHIVE_ENTRY_ACL_USER)
101			return (0);
102		up = acl_get_qualifier(aclent);
103		u = *up;
104		acl_free(up);
105		if ((uid_t)myacl->qual != u)
106			return (0);
107		break;
108	case ACL_GROUP_OBJ:
109		if (myacl->tag != ARCHIVE_ENTRY_ACL_GROUP_OBJ) return (0);
110		break;
111	case ACL_GROUP:
112		if (myacl->tag != ARCHIVE_ENTRY_ACL_GROUP)
113			return (0);
114		gp = acl_get_qualifier(aclent);
115		g = *gp;
116		acl_free(gp);
117		if ((gid_t)myacl->qual != g)
118			return (0);
119		break;
120	case ACL_MASK:
121		if (myacl->tag != ARCHIVE_ENTRY_ACL_MASK) return (0);
122		break;
123	case ACL_OTHER:
124		if (myacl->tag != ARCHIVE_ENTRY_ACL_OTHER) return (0);
125		break;
126	}
127	return (1);
128}
129
130static void
131compare_acls(acl_t acl, struct myacl_t *myacls)
132{
133	int *marker;
134	int entry_id = ACL_FIRST_ENTRY;
135	int matched;
136	int i, n;
137	acl_entry_t acl_entry;
138
139	/* Count ACL entries in myacls array and allocate an indirect array. */
140	for (n = 0; myacls[n].name != NULL; ++n)
141		continue;
142	marker = malloc(sizeof(marker[0]) * n);
143	for (i = 0; i < n; i++)
144		marker[i] = i;
145
146	/*
147	 * Iterate over acls in system acl object, try to match each
148	 * one with an item in the myacls array.
149	 */
150	while (1 == acl_get_entry(acl, entry_id, &acl_entry)) {
151		/* After the first time... */
152		entry_id = ACL_NEXT_ENTRY;
153
154		/* Search for a matching entry (tag and qualifier) */
155		for (i = 0, matched = 0; i < n && !matched; i++) {
156			if (acl_match(acl_entry, &myacls[marker[i]])) {
157				/* We found a match; remove it. */
158				marker[i] = marker[n - 1];
159				n--;
160				matched = 1;
161			}
162		}
163
164		/* TODO: Print out more details in this case. */
165		failure("ACL entry on file that shouldn't be there");
166		assert(matched == 1);
167	}
168
169	/* Dump entries in the myacls array that weren't in the system acl. */
170	for (i = 0; i < n; ++i) {
171		failure(" ACL entry missing from file: "
172		    "type=%d,permset=%d,tag=%d,qual=%d,name=``%s''\n",
173		    myacls[marker[i]].type, myacls[marker[i]].permset,
174		    myacls[marker[i]].tag, myacls[marker[i]].qual,
175		    myacls[marker[i]].name);
176		assert(0); /* Record this as a failure. */
177	}
178	free(marker);
179}
180
181#endif
182
183
184/*
185 * Verify ACL restore-to-disk.  This test is FreeBSD-specific.
186 */
187
188DEFINE_TEST(test_acl_freebsd)
189{
190#if !defined(__FreeBSD__)
191	skipping("FreeBSD-specific ACL restore test");
192#elif __FreeBSD__ < 5
193	skipping("ACL restore supported only on FreeBSD 5.0 and later");
194#else
195	struct stat st;
196	struct archive *a;
197	struct archive_entry *ae;
198	int n, fd;
199	acl_t acl;
200
201	/*
202	 * First, do a quick manual set/read of ACL data to
203	 * verify that the local filesystem does support ACLs.
204	 * If it doesn't, we'll simply skip the remaining tests.
205	 */
206	acl = acl_from_text("u::rwx,u:1:rw,g::rwx,g:15:rx,o::rwx,m::rwx");
207	assert((void *)acl != NULL);
208	/* Create a test file and try to set an ACL on it. */
209	fd = open("pretest", O_WRONLY | O_CREAT | O_EXCL, 0777);
210	failure("Could not create test file?!");
211	if (!assert(fd >= 0)) {
212		acl_free(acl);
213		return;
214	}
215
216	n = acl_set_fd(fd, acl);
217	acl_free(acl);
218	if (n != 0 && errno == EOPNOTSUPP) {
219		close(fd);
220		skipping("ACL tests require that ACL support be enabled on the filesystem");
221		return;
222	}
223	if (n != 0 && errno == EINVAL) {
224		close(fd);
225		skipping("POSIX.1e ACL tests require that POSIX.1e ACL support be enabled on the filesystem");
226		return;
227	}
228	failure("acl_set_fd(): errno = %d (%s)",
229	    errno, strerror(errno));
230	assertEqualInt(0, n);
231	close(fd);
232
233	/* Create a write-to-disk object. */
234	assert(NULL != (a = archive_write_disk_new()));
235	archive_write_disk_set_options(a,
236	    ARCHIVE_EXTRACT_TIME | ARCHIVE_EXTRACT_PERM | ARCHIVE_EXTRACT_ACL);
237
238	/* Populate an archive entry with some metadata, including ACL info */
239	ae = archive_entry_new();
240	assert(ae != NULL);
241	archive_entry_set_pathname(ae, "test0");
242	archive_entry_set_mtime(ae, 123456, 7890);
243	archive_entry_set_size(ae, 0);
244	set_acls(ae, acls2);
245	assertEqualIntA(a, ARCHIVE_OK, archive_write_header(a, ae));
246	archive_entry_free(ae);
247
248	/* Close the archive. */
249	assertEqualIntA(a, ARCHIVE_OK, archive_write_close(a));
250	assertEqualInt(ARCHIVE_OK, archive_write_finish(a));
251
252	/* Verify the data on disk. */
253	assertEqualInt(0, stat("test0", &st));
254	assertEqualInt(st.st_mtime, 123456);
255	acl = acl_get_file("test0", ACL_TYPE_ACCESS);
256	assert(acl != (acl_t)NULL);
257	compare_acls(acl, acls2);
258	acl_free(acl);
259#endif
260}
261