xref: /src/bin/setfacl/merge.c (revision 575e89cb1786a00387e9c1391055263068c4e0ae)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Chris D. Faulhaber
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/acl.h>
31 #include <sys/stat.h>
32 
33 #include <err.h>
34 
35 #include "setfacl.h"
36 
37 static int merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new,
38     int acl_brand);
39 
40 static int
merge_user_group(acl_entry_t * entry,acl_entry_t * entry_new,int acl_brand)41 merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new, int acl_brand)
42 {
43 	acl_permset_t permset;
44 	acl_entry_type_t entry_type;
45 	acl_flagset_t flagset;
46 	int have_entry;
47 	uid_t *id, *id_new;
48 
49 	have_entry = 0;
50 
51 	id = acl_get_qualifier(*entry);
52 	if (id == NULL)
53 		err(1, "acl_get_qualifier() failed");
54 	id_new = acl_get_qualifier(*entry_new);
55 	if (id_new == NULL)
56 		err(1, "acl_get_qualifier() failed");
57 	if (*id == *id_new) {
58 		/* any other matches */
59 		if (acl_get_permset(*entry, &permset) == -1)
60 			err(1, "acl_get_permset() failed");
61 		if (acl_set_permset(*entry_new, permset) == -1)
62 			err(1, "acl_set_permset() failed");
63 
64 		if (acl_brand == ACL_BRAND_NFS4) {
65 			if (acl_get_entry_type_np(*entry, &entry_type))
66 				err(1, "acl_get_entry_type_np() failed");
67 			if (acl_set_entry_type_np(*entry_new, entry_type))
68 				err(1, "acl_set_entry_type_np() failed");
69 			if (acl_get_flagset_np(*entry, &flagset))
70 				err(1, "acl_get_flagset_np() failed");
71 			if (acl_set_flagset_np(*entry_new, flagset))
72 				err(1, "acl_set_flagset_np() failed");
73 		}
74 
75 		have_entry = 1;
76 	}
77 	acl_free(id);
78 	acl_free(id_new);
79 
80 	return (have_entry);
81 }
82 
83 /*
84  * merge an ACL into existing file's ACL
85  */
86 int
merge_acl(acl_t acl,acl_t * prev_acl,const char * filename)87 merge_acl(acl_t acl, acl_t *prev_acl, const char *filename)
88 {
89 	acl_entry_t entry, entry_new;
90 	acl_permset_t permset;
91 	acl_t acl_new;
92 	acl_tag_t tag, tag_new;
93 	acl_entry_type_t entry_type, entry_type_new;
94 	acl_flagset_t flagset;
95 	int entry_id, entry_id_new, have_entry, had_entry, entry_number = 0;
96 	int acl_brand, prev_acl_brand;
97 
98 	acl_get_brand_np(acl, &acl_brand);
99 	acl_get_brand_np(*prev_acl, &prev_acl_brand);
100 
101 	if (branding_mismatch(acl_brand, prev_acl_brand)) {
102 		warnx("%s: branding mismatch; existing ACL is %s, "
103 		    "entry to be merged is %s", filename,
104 		    brand_name(prev_acl_brand), brand_name(acl_brand));
105 		return (-1);
106 	}
107 
108 	acl_new = acl_dup(*prev_acl);
109 	if (acl_new == NULL)
110 		err(1, "%s: acl_dup() failed", filename);
111 
112 	entry_id = ACL_FIRST_ENTRY;
113 
114 	while (acl_get_entry(acl, entry_id, &entry) == 1) {
115 		entry_id = ACL_NEXT_ENTRY;
116 		have_entry = 0;
117 		had_entry = 0;
118 
119 		/* keep track of existing ACL_MASK entries */
120 		if (acl_get_tag_type(entry, &tag) == -1)
121 			err(1, "%s: acl_get_tag_type() failed - "
122 			    "invalid ACL entry", filename);
123 		if (tag == ACL_MASK)
124 			have_mask = true;
125 
126 		/* check against the existing ACL entries */
127 		entry_id_new = ACL_FIRST_ENTRY;
128 		while (acl_get_entry(acl_new, entry_id_new, &entry_new) == 1) {
129 			entry_id_new = ACL_NEXT_ENTRY;
130 
131 			if (acl_get_tag_type(entry, &tag) == -1)
132 				err(1, "%s: acl_get_tag_type() failed",
133 				    filename);
134 			if (acl_get_tag_type(entry_new, &tag_new) == -1)
135 				err(1, "%s: acl_get_tag_type() failed",
136 				    filename);
137 			if (tag != tag_new)
138 				continue;
139 
140 			/*
141 			 * For NFSv4, in addition to "tag" and "id" we also
142 			 * compare "entry_type".
143 			 */
144 			if (acl_brand == ACL_BRAND_NFS4) {
145 				if (acl_get_entry_type_np(entry, &entry_type))
146 					err(1, "%s: acl_get_entry_type_np() "
147 					    "failed", filename);
148 				if (acl_get_entry_type_np(entry_new, &entry_type_new))
149 					err(1, "%s: acl_get_entry_type_np() "
150 					    "failed", filename);
151 				if (entry_type != entry_type_new)
152 					continue;
153 			}
154 
155 			switch(tag) {
156 			case ACL_USER:
157 			case ACL_GROUP:
158 				have_entry = merge_user_group(&entry,
159 				    &entry_new, acl_brand);
160 				if (have_entry == 0)
161 					break;
162 				/* FALLTHROUGH */
163 			case ACL_USER_OBJ:
164 			case ACL_GROUP_OBJ:
165 			case ACL_OTHER:
166 			case ACL_MASK:
167 			case ACL_EVERYONE:
168 				if (acl_get_permset(entry, &permset) == -1)
169 					err(1, "%s: acl_get_permset() failed",
170 					    filename);
171 				if (acl_set_permset(entry_new, permset) == -1)
172 					err(1, "%s: acl_set_permset() failed",
173 					    filename);
174 
175 				if (acl_brand == ACL_BRAND_NFS4) {
176 					if (acl_get_entry_type_np(entry, &entry_type))
177 						err(1, "%s: acl_get_entry_type_np() failed",
178 						    filename);
179 					if (acl_set_entry_type_np(entry_new, entry_type))
180 						err(1, "%s: acl_set_entry_type_np() failed",
181 						    filename);
182 					if (acl_get_flagset_np(entry, &flagset))
183 						err(1, "%s: acl_get_flagset_np() failed",
184 						    filename);
185 					if (acl_set_flagset_np(entry_new, flagset))
186 						err(1, "%s: acl_set_flagset_np() failed",
187 						    filename);
188 				}
189 				had_entry = have_entry = 1;
190 				break;
191 			default:
192 				/* should never be here */
193 				errx(1, "%s: invalid tag type: %i", filename, tag);
194 				break;
195 			}
196 		}
197 
198 		/* if this entry has not been found, it must be new */
199 		if (had_entry == 0) {
200 
201 			/*
202 			 * NFSv4 ACL entries must be prepended to the ACL.
203 			 * Appending them at the end makes no sense, since
204 			 * in most cases they wouldn't even get evaluated.
205 			 */
206 			if (acl_brand == ACL_BRAND_NFS4) {
207 				if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
208 					warn("%s: acl_create_entry_np() failed", filename);
209 					acl_free(acl_new);
210 					return (-1);
211 				}
212 				/*
213 				 * Without this increment, adding several
214 				 * entries at once, for example
215 				 * "setfacl -m user:1:r:allow,user:2:r:allow",
216 				 * would make them appear in reverse order.
217 				 */
218 				entry_number++;
219 			} else {
220 				if (acl_create_entry(&acl_new, &entry_new) == -1) {
221 					warn("%s: acl_create_entry() failed", filename);
222 					acl_free(acl_new);
223 					return (-1);
224 				}
225 			}
226 			if (acl_copy_entry(entry_new, entry) == -1)
227 				err(1, "%s: acl_copy_entry() failed", filename);
228 		}
229 	}
230 
231 	acl_free(*prev_acl);
232 	*prev_acl = acl_new;
233 
234 	return (0);
235 }
236 
237 int
add_acl(acl_t acl,uint entry_number,acl_t * prev_acl,const char * filename)238 add_acl(acl_t acl, uint entry_number, acl_t *prev_acl, const char *filename)
239 {
240 	acl_entry_t entry, entry_new;
241 	acl_t acl_new;
242 	int entry_id, acl_brand, prev_acl_brand;
243 
244 	acl_get_brand_np(acl, &acl_brand);
245 	acl_get_brand_np(*prev_acl, &prev_acl_brand);
246 
247 	if (prev_acl_brand != ACL_BRAND_NFS4) {
248 		warnx("%s: the '-a' option is only applicable to NFSv4 ACLs",
249 		    filename);
250 		return (-1);
251 	}
252 
253 	if (branding_mismatch(acl_brand, ACL_BRAND_NFS4)) {
254 		warnx("%s: branding mismatch; existing ACL is NFSv4, "
255 		    "entry to be added is %s", filename,
256 		    brand_name(acl_brand));
257 		return (-1);
258 	}
259 
260 	acl_new = acl_dup(*prev_acl);
261 	if (acl_new == NULL)
262 		err(1, "%s: acl_dup() failed", filename);
263 
264 	entry_id = ACL_FIRST_ENTRY;
265 
266 	while (acl_get_entry(acl, entry_id, &entry) == 1) {
267 		entry_id = ACL_NEXT_ENTRY;
268 
269 		if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
270 			warn("%s: acl_create_entry_np() failed", filename);
271 			acl_free(acl_new);
272 			return (-1);
273 		}
274 
275 		/*
276 		 * Without this increment, adding several
277 		 * entries at once, for example
278 		 * "setfacl -m user:1:r:allow,user:2:r:allow",
279 		 * would make them appear in reverse order.
280 		 */
281 		entry_number++;
282 
283 		if (acl_copy_entry(entry_new, entry) == -1)
284 			err(1, "%s: acl_copy_entry() failed", filename);
285 	}
286 
287 	acl_free(*prev_acl);
288 	*prev_acl = acl_new;
289 
290 	return (0);
291 }
292