2 * Copyright (c) 2001 Chris D. Faulhaber
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/cdefs.h>
28 #include <sys/types.h>
36 static int merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new,
40 merge_user_group(acl_entry_t *entry, acl_entry_t *entry_new, int acl_brand)
42 acl_permset_t permset;
43 acl_entry_type_t entry_type;
44 acl_flagset_t flagset;
50 id = acl_get_qualifier(*entry);
52 err(1, "acl_get_qualifier() failed");
53 id_new = acl_get_qualifier(*entry_new);
55 err(1, "acl_get_qualifier() failed");
57 /* any other matches */
58 if (acl_get_permset(*entry, &permset) == -1)
59 err(1, "acl_get_permset() failed");
60 if (acl_set_permset(*entry_new, permset) == -1)
61 err(1, "acl_set_permset() failed");
63 if (acl_brand == ACL_BRAND_NFS4) {
64 if (acl_get_entry_type_np(*entry, &entry_type))
65 err(1, "acl_get_entry_type_np() failed");
66 if (acl_set_entry_type_np(*entry_new, entry_type))
67 err(1, "acl_set_entry_type_np() failed");
68 if (acl_get_flagset_np(*entry, &flagset))
69 err(1, "acl_get_flagset_np() failed");
70 if (acl_set_flagset_np(*entry_new, flagset))
71 err(1, "acl_set_flagset_np() failed");
83 * merge an ACL into existing file's ACL
86 merge_acl(acl_t acl, acl_t *prev_acl, const char *filename)
88 acl_entry_t entry, entry_new;
89 acl_permset_t permset;
91 acl_tag_t tag, tag_new;
92 acl_entry_type_t entry_type, entry_type_new;
93 acl_flagset_t flagset;
94 int entry_id, entry_id_new, have_entry, had_entry, entry_number = 0;
95 int acl_brand, prev_acl_brand;
97 acl_get_brand_np(acl, &acl_brand);
98 acl_get_brand_np(*prev_acl, &prev_acl_brand);
100 if (branding_mismatch(acl_brand, prev_acl_brand)) {
101 warnx("%s: branding mismatch; existing ACL is %s, "
102 "entry to be merged is %s", filename,
103 brand_name(prev_acl_brand), brand_name(acl_brand));
107 acl_new = acl_dup(*prev_acl);
109 err(1, "%s: acl_dup() failed", filename);
111 entry_id = ACL_FIRST_ENTRY;
113 while (acl_get_entry(acl, entry_id, &entry) == 1) {
114 entry_id = ACL_NEXT_ENTRY;
118 /* keep track of existing ACL_MASK entries */
119 if (acl_get_tag_type(entry, &tag) == -1)
120 err(1, "%s: acl_get_tag_type() failed - "
121 "invalid ACL entry", filename);
125 /* check against the existing ACL entries */
126 entry_id_new = ACL_FIRST_ENTRY;
127 while (acl_get_entry(acl_new, entry_id_new, &entry_new) == 1) {
128 entry_id_new = ACL_NEXT_ENTRY;
130 if (acl_get_tag_type(entry, &tag) == -1)
131 err(1, "%s: acl_get_tag_type() failed",
133 if (acl_get_tag_type(entry_new, &tag_new) == -1)
134 err(1, "%s: acl_get_tag_type() failed",
140 * For NFSv4, in addition to "tag" and "id" we also
141 * compare "entry_type".
143 if (acl_brand == ACL_BRAND_NFS4) {
144 if (acl_get_entry_type_np(entry, &entry_type))
145 err(1, "%s: acl_get_entry_type_np() "
147 if (acl_get_entry_type_np(entry_new, &entry_type_new))
148 err(1, "%s: acl_get_entry_type_np() "
150 if (entry_type != entry_type_new)
157 have_entry = merge_user_group(&entry,
158 &entry_new, acl_brand);
167 if (acl_get_permset(entry, &permset) == -1)
168 err(1, "%s: acl_get_permset() failed",
170 if (acl_set_permset(entry_new, permset) == -1)
171 err(1, "%s: acl_set_permset() failed",
174 if (acl_brand == ACL_BRAND_NFS4) {
175 if (acl_get_entry_type_np(entry, &entry_type))
176 err(1, "%s: acl_get_entry_type_np() failed",
178 if (acl_set_entry_type_np(entry_new, entry_type))
179 err(1, "%s: acl_set_entry_type_np() failed",
181 if (acl_get_flagset_np(entry, &flagset))
182 err(1, "%s: acl_get_flagset_np() failed",
184 if (acl_set_flagset_np(entry_new, flagset))
185 err(1, "%s: acl_set_flagset_np() failed",
188 had_entry = have_entry = 1;
191 /* should never be here */
192 errx(1, "%s: invalid tag type: %i", filename, tag);
197 /* if this entry has not been found, it must be new */
198 if (had_entry == 0) {
201 * NFSv4 ACL entries must be prepended to the ACL.
202 * Appending them at the end makes no sense, since
203 * in most cases they wouldn't even get evaluated.
205 if (acl_brand == ACL_BRAND_NFS4) {
206 if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
207 warn("%s: acl_create_entry_np() failed", filename);
212 * Without this increment, adding several
213 * entries at once, for example
214 * "setfacl -m user:1:r:allow,user:2:r:allow",
215 * would make them appear in reverse order.
219 if (acl_create_entry(&acl_new, &entry_new) == -1) {
220 warn("%s: acl_create_entry() failed", filename);
225 if (acl_copy_entry(entry_new, entry) == -1)
226 err(1, "%s: acl_copy_entry() failed", filename);
237 add_acl(acl_t acl, uint entry_number, acl_t *prev_acl, const char *filename)
239 acl_entry_t entry, entry_new;
241 int entry_id, acl_brand, prev_acl_brand;
243 acl_get_brand_np(acl, &acl_brand);
244 acl_get_brand_np(*prev_acl, &prev_acl_brand);
246 if (prev_acl_brand != ACL_BRAND_NFS4) {
247 warnx("%s: the '-a' option is only applicable to NFSv4 ACLs",
252 if (branding_mismatch(acl_brand, ACL_BRAND_NFS4)) {
253 warnx("%s: branding mismatch; existing ACL is NFSv4, "
254 "entry to be added is %s", filename,
255 brand_name(acl_brand));
259 acl_new = acl_dup(*prev_acl);
261 err(1, "%s: acl_dup() failed", filename);
263 entry_id = ACL_FIRST_ENTRY;
265 while (acl_get_entry(acl, entry_id, &entry) == 1) {
266 entry_id = ACL_NEXT_ENTRY;
268 if (acl_create_entry_np(&acl_new, &entry_new, entry_number) == -1) {
269 warn("%s: acl_create_entry_np() failed", filename);
275 * Without this increment, adding several
276 * entries at once, for example
277 * "setfacl -m user:1:r:allow,user:2:r:allow",
278 * would make them appear in reverse order.
282 if (acl_copy_entry(entry_new, entry) == -1)
283 err(1, "%s: acl_copy_entry() failed", filename);