1aa015c8eSEdward Tomasz Napierala /*-
2*4d846d26SWarner Losh * SPDX-License-Identifier: BSD-2-Clause
3d915a14eSPedro F. Giffuni *
4aa015c8eSEdward Tomasz Napierala * Copyright (c) 2001 Chris D. Faulhaber
5aa015c8eSEdward Tomasz Napierala * All rights reserved.
6aa015c8eSEdward Tomasz Napierala *
7aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without
8aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions
9aa015c8eSEdward Tomasz Napierala * are met:
10aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright
11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer.
12aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright
13aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the
14aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution.
15aa015c8eSEdward Tomasz Napierala *
16aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19a303eae7SJoel Dahl * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20a303eae7SJoel Dahl * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21a303eae7SJoel Dahl * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22a303eae7SJoel Dahl * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23a303eae7SJoel Dahl * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24a303eae7SJoel Dahl * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25a303eae7SJoel Dahl * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26a303eae7SJoel Dahl * SUCH DAMAGE.
27aa015c8eSEdward Tomasz Napierala */
28aa015c8eSEdward Tomasz Napierala
29aa015c8eSEdward Tomasz Napierala #include <errno.h>
30aa015c8eSEdward Tomasz Napierala #include <stdio.h>
31aa015c8eSEdward Tomasz Napierala #include <assert.h>
32aa015c8eSEdward Tomasz Napierala #include <sys/acl.h>
334089cc8aSEdward Tomasz Napierala #include <sys/stat.h>
34aa015c8eSEdward Tomasz Napierala
35aa015c8eSEdward Tomasz Napierala #include "acl_support.h"
36aa015c8eSEdward Tomasz Napierala
37aa015c8eSEdward Tomasz Napierala /*
38cdec3856SEdward Tomasz Napierala * These routines from sys/kern/subr_acl_nfs4.c are used by both kernel
39aa015c8eSEdward Tomasz Napierala * and libc.
40aa015c8eSEdward Tomasz Napierala */
41aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp);
42cdec3856SEdward Tomasz Napierala void acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int file_owner_id,
43cdec3856SEdward Tomasz Napierala int canonical_six);
44aa015c8eSEdward Tomasz Napierala
45aa015c8eSEdward Tomasz Napierala static acl_t
_nfs4_acl_strip_np(const acl_t aclp,int canonical_six)464089cc8aSEdward Tomasz Napierala _nfs4_acl_strip_np(const acl_t aclp, int canonical_six)
47aa015c8eSEdward Tomasz Napierala {
48aa015c8eSEdward Tomasz Napierala acl_t newacl;
497945d60dSEdward Tomasz Napierala mode_t mode = 0;
50aa015c8eSEdward Tomasz Napierala
51aa015c8eSEdward Tomasz Napierala newacl = acl_init(ACL_MAX_ENTRIES);
52aa015c8eSEdward Tomasz Napierala if (newacl == NULL) {
53aa015c8eSEdward Tomasz Napierala errno = ENOMEM;
54aa015c8eSEdward Tomasz Napierala return (NULL);
55aa015c8eSEdward Tomasz Napierala }
56aa015c8eSEdward Tomasz Napierala
57aa015c8eSEdward Tomasz Napierala _acl_brand_as(newacl, ACL_BRAND_NFS4);
58aa015c8eSEdward Tomasz Napierala
59aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_mode_from_acl(&mode, &(aclp->ats_acl));
60cdec3856SEdward Tomasz Napierala acl_nfs4_trivial_from_mode_libc(&(newacl->ats_acl), mode, canonical_six);
61aa015c8eSEdward Tomasz Napierala
62aa015c8eSEdward Tomasz Napierala return (newacl);
63aa015c8eSEdward Tomasz Napierala }
64aa015c8eSEdward Tomasz Napierala
65aa015c8eSEdward Tomasz Napierala static acl_t
_posix1e_acl_strip_np(const acl_t aclp,int recalculate_mask)66aa015c8eSEdward Tomasz Napierala _posix1e_acl_strip_np(const acl_t aclp, int recalculate_mask)
67aa015c8eSEdward Tomasz Napierala {
68aa015c8eSEdward Tomasz Napierala acl_t acl_new, acl_old;
69aa015c8eSEdward Tomasz Napierala acl_entry_t entry, entry_new;
70aa015c8eSEdward Tomasz Napierala acl_tag_t tag;
71aa015c8eSEdward Tomasz Napierala int entry_id, have_mask_entry;
72aa015c8eSEdward Tomasz Napierala
73aa015c8eSEdward Tomasz Napierala assert(_acl_brand(aclp) == ACL_BRAND_POSIX);
74aa015c8eSEdward Tomasz Napierala
75aa015c8eSEdward Tomasz Napierala acl_old = acl_dup(aclp);
76aa015c8eSEdward Tomasz Napierala if (acl_old == NULL)
77aa015c8eSEdward Tomasz Napierala return (NULL);
78aa015c8eSEdward Tomasz Napierala
79aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_old) == ACL_BRAND_POSIX);
80aa015c8eSEdward Tomasz Napierala
81aa015c8eSEdward Tomasz Napierala have_mask_entry = 0;
82aa015c8eSEdward Tomasz Napierala acl_new = acl_init(ACL_MAX_ENTRIES);
83cf0f0b80SPedro F. Giffuni if (acl_new == NULL) {
84cf0f0b80SPedro F. Giffuni acl_free(acl_old);
85aa015c8eSEdward Tomasz Napierala return (NULL);
86cf0f0b80SPedro F. Giffuni }
87aa015c8eSEdward Tomasz Napierala tag = ACL_UNDEFINED_TAG;
88aa015c8eSEdward Tomasz Napierala
89aa015c8eSEdward Tomasz Napierala /* only save the default user/group/other entries */
90aa015c8eSEdward Tomasz Napierala entry_id = ACL_FIRST_ENTRY;
91aa015c8eSEdward Tomasz Napierala while (acl_get_entry(acl_old, entry_id, &entry) == 1) {
92aa015c8eSEdward Tomasz Napierala entry_id = ACL_NEXT_ENTRY;
93aa015c8eSEdward Tomasz Napierala
94aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_POSIX);
95aa015c8eSEdward Tomasz Napierala
96aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1)
97cf0f0b80SPedro F. Giffuni goto fail;
98aa015c8eSEdward Tomasz Napierala
99aa015c8eSEdward Tomasz Napierala switch(tag) {
100aa015c8eSEdward Tomasz Napierala case ACL_USER_OBJ:
101aa015c8eSEdward Tomasz Napierala case ACL_GROUP_OBJ:
102aa015c8eSEdward Tomasz Napierala case ACL_OTHER:
103aa015c8eSEdward Tomasz Napierala if (acl_create_entry(&acl_new, &entry_new) == -1)
1048e6acc53SEdward Tomasz Napierala goto fail;
105aa015c8eSEdward Tomasz Napierala if (acl_copy_entry(entry_new, entry) == -1)
1068e6acc53SEdward Tomasz Napierala goto fail;
107aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry_new) == ACL_BRAND_POSIX);
108aa015c8eSEdward Tomasz Napierala break;
109aa015c8eSEdward Tomasz Napierala case ACL_MASK:
110aa015c8eSEdward Tomasz Napierala have_mask_entry = 1;
111aa015c8eSEdward Tomasz Napierala break;
112aa015c8eSEdward Tomasz Napierala default:
113aa015c8eSEdward Tomasz Napierala break;
114aa015c8eSEdward Tomasz Napierala }
115aa015c8eSEdward Tomasz Napierala }
116aa015c8eSEdward Tomasz Napierala
117aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_new) == ACL_BRAND_POSIX);
118aa015c8eSEdward Tomasz Napierala
119aa015c8eSEdward Tomasz Napierala if (have_mask_entry && recalculate_mask) {
120aa015c8eSEdward Tomasz Napierala if (acl_calc_mask(&acl_new) == -1)
1218e6acc53SEdward Tomasz Napierala goto fail;
122aa015c8eSEdward Tomasz Napierala }
123aa015c8eSEdward Tomasz Napierala
124aa015c8eSEdward Tomasz Napierala return (acl_new);
1258e6acc53SEdward Tomasz Napierala
1268e6acc53SEdward Tomasz Napierala fail:
1278e6acc53SEdward Tomasz Napierala acl_free(acl_new);
1288e6acc53SEdward Tomasz Napierala acl_free(acl_old);
1298e6acc53SEdward Tomasz Napierala
1308e6acc53SEdward Tomasz Napierala return (NULL);
131aa015c8eSEdward Tomasz Napierala }
132aa015c8eSEdward Tomasz Napierala
133aa015c8eSEdward Tomasz Napierala acl_t
acl_strip_np(const acl_t aclp,int recalculate_mask)134aa015c8eSEdward Tomasz Napierala acl_strip_np(const acl_t aclp, int recalculate_mask)
135aa015c8eSEdward Tomasz Napierala {
136aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) {
137aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4:
138e43af6d3SEdward Tomasz Napierala return (_nfs4_acl_strip_np(aclp, 0));
139aa015c8eSEdward Tomasz Napierala
140aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX:
141aa015c8eSEdward Tomasz Napierala return (_posix1e_acl_strip_np(aclp, recalculate_mask));
142aa015c8eSEdward Tomasz Napierala
143aa015c8eSEdward Tomasz Napierala default:
144aa015c8eSEdward Tomasz Napierala errno = EINVAL;
145aa015c8eSEdward Tomasz Napierala return (NULL);
146aa015c8eSEdward Tomasz Napierala }
147aa015c8eSEdward Tomasz Napierala }
148aa015c8eSEdward Tomasz Napierala
149aa015c8eSEdward Tomasz Napierala /*
150aa015c8eSEdward Tomasz Napierala * Return 1, if ACL is trivial, 0 otherwise.
151aa015c8eSEdward Tomasz Napierala *
152aa015c8eSEdward Tomasz Napierala * ACL is trivial, iff its meaning could be fully expressed using just file
153aa015c8eSEdward Tomasz Napierala * mode. In other words, ACL is trivial iff it doesn't have "+" to the right
154aa015c8eSEdward Tomasz Napierala * of the mode bits in "ls -l" output ;-)
155aa015c8eSEdward Tomasz Napierala */
156aa015c8eSEdward Tomasz Napierala int
acl_is_trivial_np(const acl_t aclp,int * trivialp)157aa015c8eSEdward Tomasz Napierala acl_is_trivial_np(const acl_t aclp, int *trivialp)
158aa015c8eSEdward Tomasz Napierala {
159aa015c8eSEdward Tomasz Napierala acl_t tmpacl;
160aa015c8eSEdward Tomasz Napierala int differs;
161aa015c8eSEdward Tomasz Napierala
162aa015c8eSEdward Tomasz Napierala if (aclp == NULL || trivialp == NULL) {
163aa015c8eSEdward Tomasz Napierala errno = EINVAL;
164aa015c8eSEdward Tomasz Napierala return (-1);
165aa015c8eSEdward Tomasz Napierala }
166aa015c8eSEdward Tomasz Napierala
167aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) {
168aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX:
169aa015c8eSEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt == 3)
170aa015c8eSEdward Tomasz Napierala *trivialp = 1;
171aa015c8eSEdward Tomasz Napierala else
172aa015c8eSEdward Tomasz Napierala *trivialp = 0;
173aa015c8eSEdward Tomasz Napierala
174aa015c8eSEdward Tomasz Napierala return (0);
175aa015c8eSEdward Tomasz Napierala
176aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4:
177aa015c8eSEdward Tomasz Napierala /*
1787eaa29b5SEdward Tomasz Napierala * If the ACL has more than canonical six entries,
1797eaa29b5SEdward Tomasz Napierala * it's non trivial by definition.
1807eaa29b5SEdward Tomasz Napierala */
1817eaa29b5SEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt > 6) {
18278141351SEdward Tomasz Napierala *trivialp = 0;
1837eaa29b5SEdward Tomasz Napierala return (0);
1847eaa29b5SEdward Tomasz Napierala }
1857eaa29b5SEdward Tomasz Napierala
1867eaa29b5SEdward Tomasz Napierala /*
1874089cc8aSEdward Tomasz Napierala * Calculate trivial ACL - using acl_strip_np(3) - and compare
188aa015c8eSEdward Tomasz Napierala * with the original.
189aa015c8eSEdward Tomasz Napierala */
1904089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 0);
1914089cc8aSEdward Tomasz Napierala if (tmpacl == NULL)
1924089cc8aSEdward Tomasz Napierala return (-1);
1934089cc8aSEdward Tomasz Napierala
1944089cc8aSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl);
1954089cc8aSEdward Tomasz Napierala acl_free(tmpacl);
1964089cc8aSEdward Tomasz Napierala
1974089cc8aSEdward Tomasz Napierala if (differs == 0) {
1984089cc8aSEdward Tomasz Napierala *trivialp = 1;
1994089cc8aSEdward Tomasz Napierala return (0);
2004089cc8aSEdward Tomasz Napierala }
2014089cc8aSEdward Tomasz Napierala
2024089cc8aSEdward Tomasz Napierala /*
2034089cc8aSEdward Tomasz Napierala * Try again with an old-style, "canonical six" trivial ACL.
2044089cc8aSEdward Tomasz Napierala */
2054089cc8aSEdward Tomasz Napierala tmpacl = _nfs4_acl_strip_np(aclp, 1);
206aa015c8eSEdward Tomasz Napierala if (tmpacl == NULL)
207aa015c8eSEdward Tomasz Napierala return (-1);
208aa015c8eSEdward Tomasz Napierala
209aa015c8eSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl);
210aa015c8eSEdward Tomasz Napierala acl_free(tmpacl);
211aa015c8eSEdward Tomasz Napierala
212aa015c8eSEdward Tomasz Napierala if (differs)
213aa015c8eSEdward Tomasz Napierala *trivialp = 0;
214aa015c8eSEdward Tomasz Napierala else
215aa015c8eSEdward Tomasz Napierala *trivialp = 1;
216aa015c8eSEdward Tomasz Napierala
217aa015c8eSEdward Tomasz Napierala return (0);
218aa015c8eSEdward Tomasz Napierala
219aa015c8eSEdward Tomasz Napierala default:
220aa015c8eSEdward Tomasz Napierala errno = EINVAL;
221aa015c8eSEdward Tomasz Napierala return (-1);
222aa015c8eSEdward Tomasz Napierala }
223aa015c8eSEdward Tomasz Napierala }
224