|
10126
|
1 /* set-mode-acl.c - set access control list equivalent to a mode |
|
|
2 |
|
|
3 Copyright (C) 2002-2003, 2005-2008 Free Software Foundation, Inc. |
|
|
4 |
|
|
5 This program is free software: you can redistribute it and/or modify |
|
|
6 it under the terms of the GNU General Public License as published by |
|
|
7 the Free Software Foundation; either version 3 of the License, or |
|
|
8 (at your option) any later version. |
|
|
9 |
|
|
10 This program is distributed in the hope that it will be useful, |
|
|
11 but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
13 GNU General Public License for more details. |
|
|
14 |
|
|
15 You should have received a copy of the GNU General Public License |
|
|
16 along with this program. If not, see <http://www.gnu.org/licenses/>. |
|
|
17 |
|
|
18 Written by Paul Eggert and Andreas Gruenbacher. */ |
|
|
19 |
|
|
20 #include <config.h> |
|
|
21 |
|
|
22 #include "acl.h" |
|
|
23 |
|
|
24 #include "acl-internal.h" |
|
|
25 |
|
|
26 /* If DESC is a valid file descriptor use fchmod to change the |
|
|
27 file's mode to MODE on systems that have fchown. On systems |
|
|
28 that don't have fchown and if DESC is invalid, use chown on |
|
|
29 NAME instead. */ |
|
|
30 |
|
|
31 int |
|
|
32 chmod_or_fchmod (const char *name, int desc, mode_t mode) |
|
|
33 { |
|
|
34 if (HAVE_FCHMOD && desc != -1) |
|
|
35 return fchmod (desc, mode); |
|
|
36 else |
|
|
37 return chmod (name, mode); |
|
|
38 } |
|
|
39 |
|
|
40 /* Set the access control lists of a file. If DESC is a valid file |
|
|
41 descriptor, use file descriptor operations where available, else use |
|
|
42 filename based operations on NAME. If access control lists are not |
|
|
43 available, fchmod the target file to MODE. Also sets the |
|
|
44 non-permission bits of the destination file (S_ISUID, S_ISGID, S_ISVTX) |
|
|
45 to those from MODE if any are set. System call return value |
|
|
46 semantics. */ |
|
|
47 |
|
|
48 int |
|
|
49 qset_acl (char const *name, int desc, mode_t mode) |
|
|
50 { |
|
|
51 #if USE_ACL |
|
|
52 # if MODE_INSIDE_ACL |
|
|
53 # if HAVE_ACL_SET_FILE && HAVE_ACL_FREE |
|
|
54 /* POSIX 1003.1e draft 17 (abandoned) specific version. */ |
|
|
55 /* Linux, FreeBSD, IRIX, Tru64 */ |
|
|
56 |
|
|
57 /* We must also have acl_from_text and acl_delete_def_file. |
|
|
58 (acl_delete_def_file could be emulated with acl_init followed |
|
|
59 by acl_set_file, but acl_set_file with an empty acl is |
|
|
60 unspecified.) */ |
|
|
61 |
|
|
62 # ifndef HAVE_ACL_FROM_TEXT |
|
|
63 # error Must have acl_from_text (see POSIX 1003.1e draft 17). |
|
|
64 # endif |
|
|
65 # ifndef HAVE_ACL_DELETE_DEF_FILE |
|
|
66 # error Must have acl_delete_def_file (see POSIX 1003.1e draft 17). |
|
|
67 # endif |
|
|
68 |
|
|
69 acl_t acl; |
|
|
70 int ret; |
|
|
71 |
|
|
72 if (HAVE_ACL_FROM_MODE) /* Linux */ |
|
|
73 { |
|
|
74 acl = acl_from_mode (mode); |
|
|
75 if (!acl) |
|
|
76 return -1; |
|
|
77 } |
|
|
78 else /* FreeBSD, IRIX, Tru64 */ |
|
|
79 { |
|
|
80 /* If we were to create the ACL using the functions acl_init(), |
|
|
81 acl_create_entry(), acl_set_tag_type(), acl_set_qualifier(), |
|
|
82 acl_get_permset(), acl_clear_perm[s](), acl_add_perm(), we |
|
|
83 would need to create a qualifier. I don't know how to do this. |
|
|
84 So create it using acl_from_text(). */ |
|
|
85 |
|
|
86 # if HAVE_ACL_FREE_TEXT /* Tru64 */ |
|
|
87 char acl_text[] = "u::---,g::---,o::---,"; |
|
|
88 # else /* FreeBSD, IRIX */ |
|
|
89 char acl_text[] = "u::---,g::---,o::---"; |
|
|
90 # endif |
|
|
91 |
|
|
92 if (mode & S_IRUSR) acl_text[ 3] = 'r'; |
|
|
93 if (mode & S_IWUSR) acl_text[ 4] = 'w'; |
|
|
94 if (mode & S_IXUSR) acl_text[ 5] = 'x'; |
|
|
95 if (mode & S_IRGRP) acl_text[10] = 'r'; |
|
|
96 if (mode & S_IWGRP) acl_text[11] = 'w'; |
|
|
97 if (mode & S_IXGRP) acl_text[12] = 'x'; |
|
|
98 if (mode & S_IROTH) acl_text[17] = 'r'; |
|
|
99 if (mode & S_IWOTH) acl_text[18] = 'w'; |
|
|
100 if (mode & S_IXOTH) acl_text[19] = 'x'; |
|
|
101 |
|
|
102 acl = acl_from_text (acl_text); |
|
|
103 if (!acl) |
|
|
104 return -1; |
|
|
105 } |
|
|
106 if (HAVE_ACL_SET_FD && desc != -1) |
|
|
107 ret = acl_set_fd (desc, acl); |
|
|
108 else |
|
|
109 ret = acl_set_file (name, ACL_TYPE_ACCESS, acl); |
|
|
110 if (ret != 0) |
|
|
111 { |
|
|
112 int saved_errno = errno; |
|
|
113 acl_free (acl); |
|
|
114 |
|
|
115 if (ACL_NOT_WELL_SUPPORTED (errno)) |
|
|
116 { |
|
|
117 if (chmod_or_fchmod (name, desc, mode) != 0) |
|
|
118 saved_errno = errno; |
|
|
119 else |
|
|
120 return 0; |
|
|
121 } |
|
|
122 errno = saved_errno; |
|
|
123 return -1; |
|
|
124 } |
|
|
125 else |
|
|
126 acl_free (acl); |
|
|
127 |
|
|
128 if (S_ISDIR (mode) && acl_delete_def_file (name)) |
|
|
129 return -1; |
|
|
130 |
|
|
131 if (mode & (S_ISUID | S_ISGID | S_ISVTX)) |
|
|
132 { |
|
|
133 /* We did not call chmod so far, so the special bits have not yet |
|
|
134 been set. */ |
|
|
135 |
|
|
136 if (chmod_or_fchmod (name, desc, mode)) |
|
|
137 return -1; |
|
|
138 } |
|
|
139 return 0; |
|
|
140 |
|
|
141 # elif defined ACL_NO_TRIVIAL |
|
|
142 /* Solaris 10, with NFSv4 ACLs. */ |
|
|
143 acl_t *aclp; |
|
|
144 char acl_text[] = "user::---,group::---,mask:---,other:---"; |
|
|
145 |
|
|
146 if (mode & S_IRUSR) acl_text[ 6] = 'r'; |
|
|
147 if (mode & S_IWUSR) acl_text[ 7] = 'w'; |
|
|
148 if (mode & S_IXUSR) acl_text[ 8] = 'x'; |
|
|
149 if (mode & S_IRGRP) acl_text[17] = acl_text[26] = 'r'; |
|
|
150 if (mode & S_IWGRP) acl_text[18] = acl_text[27] = 'w'; |
|
|
151 if (mode & S_IXGRP) acl_text[19] = acl_text[28] = 'x'; |
|
|
152 if (mode & S_IROTH) acl_text[36] = 'r'; |
|
|
153 if (mode & S_IWOTH) acl_text[37] = 'w'; |
|
|
154 if (mode & S_IXOTH) acl_text[38] = 'x'; |
|
|
155 |
|
|
156 if (acl_fromtext (acl_text, &aclp) != 0) |
|
|
157 { |
|
|
158 errno = ENOMEM; |
|
|
159 return -1; |
|
|
160 } |
|
|
161 else |
|
|
162 { |
|
|
163 int acl_result = (desc < 0 ? acl_set (name, aclp) : facl_set (desc, aclp)); |
|
|
164 int acl_errno = errno; |
|
|
165 acl_free (aclp); |
|
|
166 if (acl_result == 0 || acl_errno != ENOSYS) |
|
|
167 { |
|
|
168 errno = acl_errno; |
|
|
169 return acl_result; |
|
|
170 } |
|
|
171 } |
|
|
172 |
|
|
173 return chmod_or_fchmod (name, desc, mode); |
|
|
174 |
|
|
175 # else /* Unknown flavor of ACLs */ |
|
|
176 return chmod_or_fchmod (name, desc, mode); |
|
|
177 # endif |
|
|
178 # else /* !MODE_INSIDE_ACL */ |
|
|
179 # if HAVE_ACL_SET_FILE && HAVE_ACL_FREE |
|
|
180 /* POSIX 1003.1e draft 17 (abandoned) specific version. */ |
|
|
181 /* MacOS X */ |
|
|
182 |
|
|
183 acl_t acl; |
|
|
184 int ret; |
|
|
185 |
|
|
186 /* Remove the ACL if the file has ACLs. */ |
|
|
187 if (HAVE_ACL_GET_FD && desc != -1) |
|
|
188 acl = acl_get_fd (desc); |
|
|
189 else |
|
|
190 acl = acl_get_file (name, ACL_TYPE_ACCESS); |
|
|
191 if (acl) |
|
|
192 { |
|
|
193 # if HAVE_ACL_COPY_EXT_NATIVE && HAVE_ACL_CREATE_ENTRY_NP /* MacOS X */ |
|
|
194 static const char empty_acl_text[] = "!#acl 1\n"; |
|
|
195 # else /* Unknown flavor of POSIX-like ACLs */ |
|
|
196 # error Unknown flavor of POSIX-like ACLs - add support for your platform. |
|
|
197 # endif |
|
|
198 |
|
|
199 acl = acl_from_text (empty_acl_text); |
|
|
200 if (acl) |
|
|
201 { |
|
|
202 if (HAVE_ACL_SET_FD && desc != -1) |
|
|
203 ret = acl_set_fd (desc, acl); |
|
|
204 else |
|
|
205 ret = acl_set_file (name, ACL_TYPE_ACCESS, acl); |
|
|
206 if (ret != 0) |
|
|
207 { |
|
|
208 int saved_errno = errno; |
|
|
209 |
|
|
210 acl_free (acl); |
|
|
211 |
|
|
212 if (ACL_NOT_WELL_SUPPORTED (saved_errno)) |
|
|
213 { |
|
|
214 if (chmod_or_fchmod (name, desc, mode) != 0) |
|
|
215 saved_errno = errno; |
|
|
216 else |
|
|
217 return 0; |
|
|
218 } |
|
|
219 errno = saved_errno; |
|
|
220 return -1; |
|
|
221 } |
|
|
222 } |
|
|
223 } |
|
|
224 |
|
|
225 return chmod_or_fchmod (name, desc, mode); |
|
|
226 # else /* Unknown flavor of ACLs */ |
|
|
227 return chmod_or_fchmod (name, desc, mode); |
|
|
228 # endif |
|
|
229 # endif |
|
|
230 #else /* !USE_ACL */ |
|
|
231 return chmod_or_fchmod (name, desc, mode); |
|
|
232 #endif |
|
|
233 } |
|
|
234 |
|
|
235 /* As with qset_acl, but also output a diagnostic on failure. */ |
|
|
236 |
|
|
237 int |
|
|
238 set_acl (char const *name, int desc, mode_t mode) |
|
|
239 { |
|
|
240 int r = qset_acl (name, desc, mode); |
|
|
241 if (r != 0) |
|
|
242 error (0, errno, _("setting permissions for %s"), quote (name)); |
|
|
243 return r; |
|
|
244 } |
