1aa015c8eSEdward Tomasz Napierala /*- 2aa015c8eSEdward Tomasz Napierala * Copyright (c) 2001 Chris D. Faulhaber 3aa015c8eSEdward Tomasz Napierala * All rights reserved. 4aa015c8eSEdward Tomasz Napierala * 5aa015c8eSEdward Tomasz Napierala * Redistribution and use in source and binary forms, with or without 6aa015c8eSEdward Tomasz Napierala * modification, are permitted provided that the following conditions 7aa015c8eSEdward Tomasz Napierala * are met: 8aa015c8eSEdward Tomasz Napierala * 1. Redistributions of source code must retain the above copyright 9aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer. 10aa015c8eSEdward Tomasz Napierala * 2. Redistributions in binary form must reproduce the above copyright 11aa015c8eSEdward Tomasz Napierala * notice, this list of conditions and the following disclaimer in the 12aa015c8eSEdward Tomasz Napierala * documentation and/or other materials provided with the distribution. 13aa015c8eSEdward Tomasz Napierala * 14aa015c8eSEdward Tomasz Napierala * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15aa015c8eSEdward Tomasz Napierala * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16aa015c8eSEdward Tomasz Napierala * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17a303eae7SJoel Dahl * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18a303eae7SJoel Dahl * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19a303eae7SJoel Dahl * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20a303eae7SJoel Dahl * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21a303eae7SJoel Dahl * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22a303eae7SJoel Dahl * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23a303eae7SJoel Dahl * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24a303eae7SJoel Dahl * SUCH DAMAGE. 25aa015c8eSEdward Tomasz Napierala */ 26aa015c8eSEdward Tomasz Napierala 27aa015c8eSEdward Tomasz Napierala #include <sys/cdefs.h> 28aa015c8eSEdward Tomasz Napierala __FBSDID("$FreeBSD$"); 29aa015c8eSEdward Tomasz Napierala 30aa015c8eSEdward Tomasz Napierala #include <errno.h> 31aa015c8eSEdward Tomasz Napierala #include <stdio.h> 32aa015c8eSEdward Tomasz Napierala #include <assert.h> 33aa015c8eSEdward Tomasz Napierala #include <sys/acl.h> 34aa015c8eSEdward Tomasz Napierala 35aa015c8eSEdward Tomasz Napierala #include "acl_support.h" 36aa015c8eSEdward Tomasz Napierala 37aa015c8eSEdward Tomasz Napierala /* 38aa015c8eSEdward Tomasz Napierala * These two routines from sys/kern/subr_acl_nfs4.c are used by both kernel 39aa015c8eSEdward Tomasz Napierala * and libc. 40aa015c8eSEdward Tomasz Napierala */ 41aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode, 42aa015c8eSEdward Tomasz Napierala int file_owner_id); 43aa015c8eSEdward Tomasz Napierala void acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp); 44aa015c8eSEdward Tomasz Napierala 45aa015c8eSEdward Tomasz Napierala static acl_t 46aa015c8eSEdward Tomasz Napierala _nfs4_acl_strip_np(const acl_t aclp, int recalculate_mask) 47aa015c8eSEdward Tomasz Napierala { 48aa015c8eSEdward Tomasz Napierala acl_t newacl; 497945d60dSEdward Tomasz Napierala mode_t mode = 0; 50aa015c8eSEdward Tomasz Napierala 51aa015c8eSEdward Tomasz Napierala newacl = acl_init(ACL_MAX_ENTRIES); 52aa015c8eSEdward Tomasz Napierala if (newacl == NULL) { 53aa015c8eSEdward Tomasz Napierala errno = ENOMEM; 54aa015c8eSEdward Tomasz Napierala return (NULL); 55aa015c8eSEdward Tomasz Napierala } 56aa015c8eSEdward Tomasz Napierala 57aa015c8eSEdward Tomasz Napierala _acl_brand_as(newacl, ACL_BRAND_NFS4); 58aa015c8eSEdward Tomasz Napierala 59aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_mode_from_acl(&mode, &(aclp->ats_acl)); 60aa015c8eSEdward Tomasz Napierala acl_nfs4_sync_acl_from_mode(&(newacl->ats_acl), mode, -1); 61aa015c8eSEdward Tomasz Napierala 62aa015c8eSEdward Tomasz Napierala return (newacl); 63aa015c8eSEdward Tomasz Napierala } 64aa015c8eSEdward Tomasz Napierala 65aa015c8eSEdward Tomasz Napierala static acl_t 66aa015c8eSEdward Tomasz Napierala _posix1e_acl_strip_np(const acl_t aclp, int recalculate_mask) 67aa015c8eSEdward Tomasz Napierala { 68aa015c8eSEdward Tomasz Napierala acl_t acl_new, acl_old; 69aa015c8eSEdward Tomasz Napierala acl_entry_t entry, entry_new; 70aa015c8eSEdward Tomasz Napierala acl_permset_t perm; 71aa015c8eSEdward Tomasz Napierala acl_tag_t tag; 72aa015c8eSEdward Tomasz Napierala int entry_id, have_mask_entry; 73aa015c8eSEdward Tomasz Napierala 74aa015c8eSEdward Tomasz Napierala assert(_acl_brand(aclp) == ACL_BRAND_POSIX); 75aa015c8eSEdward Tomasz Napierala 76aa015c8eSEdward Tomasz Napierala acl_old = acl_dup(aclp); 77aa015c8eSEdward Tomasz Napierala if (acl_old == NULL) 78aa015c8eSEdward Tomasz Napierala return (NULL); 79aa015c8eSEdward Tomasz Napierala 80aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_old) == ACL_BRAND_POSIX); 81aa015c8eSEdward Tomasz Napierala 82aa015c8eSEdward Tomasz Napierala have_mask_entry = 0; 83aa015c8eSEdward Tomasz Napierala acl_new = acl_init(ACL_MAX_ENTRIES); 84aa015c8eSEdward Tomasz Napierala if (acl_new == NULL) 85aa015c8eSEdward Tomasz Napierala return (NULL); 86aa015c8eSEdward Tomasz Napierala tag = ACL_UNDEFINED_TAG; 87aa015c8eSEdward Tomasz Napierala 88aa015c8eSEdward Tomasz Napierala /* only save the default user/group/other entries */ 89aa015c8eSEdward Tomasz Napierala entry_id = ACL_FIRST_ENTRY; 90aa015c8eSEdward Tomasz Napierala while (acl_get_entry(acl_old, entry_id, &entry) == 1) { 91aa015c8eSEdward Tomasz Napierala entry_id = ACL_NEXT_ENTRY; 92aa015c8eSEdward Tomasz Napierala 93aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry) == ACL_BRAND_POSIX); 94aa015c8eSEdward Tomasz Napierala 95aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 96aa015c8eSEdward Tomasz Napierala return (NULL); 97aa015c8eSEdward Tomasz Napierala 98aa015c8eSEdward Tomasz Napierala switch(tag) { 99aa015c8eSEdward Tomasz Napierala case ACL_USER_OBJ: 100aa015c8eSEdward Tomasz Napierala case ACL_GROUP_OBJ: 101aa015c8eSEdward Tomasz Napierala case ACL_OTHER: 102aa015c8eSEdward Tomasz Napierala if (acl_get_tag_type(entry, &tag) == -1) 103aa015c8eSEdward Tomasz Napierala return (NULL); 104aa015c8eSEdward Tomasz Napierala if (acl_get_permset(entry, &perm) == -1) 105aa015c8eSEdward Tomasz Napierala return (NULL); 106aa015c8eSEdward Tomasz Napierala if (acl_create_entry(&acl_new, &entry_new) == -1) 107aa015c8eSEdward Tomasz Napierala return (NULL); 108aa015c8eSEdward Tomasz Napierala if (acl_set_tag_type(entry_new, tag) == -1) 109aa015c8eSEdward Tomasz Napierala return (NULL); 110aa015c8eSEdward Tomasz Napierala if (acl_set_permset(entry_new, perm) == -1) 111aa015c8eSEdward Tomasz Napierala return (NULL); 112aa015c8eSEdward Tomasz Napierala if (acl_copy_entry(entry_new, entry) == -1) 113aa015c8eSEdward Tomasz Napierala return (NULL); 114aa015c8eSEdward Tomasz Napierala assert(_entry_brand(entry_new) == ACL_BRAND_POSIX); 115aa015c8eSEdward Tomasz Napierala break; 116aa015c8eSEdward Tomasz Napierala case ACL_MASK: 117aa015c8eSEdward Tomasz Napierala have_mask_entry = 1; 118aa015c8eSEdward Tomasz Napierala break; 119aa015c8eSEdward Tomasz Napierala default: 120aa015c8eSEdward Tomasz Napierala break; 121aa015c8eSEdward Tomasz Napierala } 122aa015c8eSEdward Tomasz Napierala } 123aa015c8eSEdward Tomasz Napierala 124aa015c8eSEdward Tomasz Napierala assert(_acl_brand(acl_new) == ACL_BRAND_POSIX); 125aa015c8eSEdward Tomasz Napierala 126aa015c8eSEdward Tomasz Napierala if (have_mask_entry && recalculate_mask) { 127aa015c8eSEdward Tomasz Napierala if (acl_calc_mask(&acl_new) == -1) 128aa015c8eSEdward Tomasz Napierala return (NULL); 129aa015c8eSEdward Tomasz Napierala } 130aa015c8eSEdward Tomasz Napierala 131aa015c8eSEdward Tomasz Napierala return (acl_new); 132aa015c8eSEdward Tomasz Napierala } 133aa015c8eSEdward Tomasz Napierala 134aa015c8eSEdward Tomasz Napierala acl_t 135aa015c8eSEdward Tomasz Napierala acl_strip_np(const acl_t aclp, int recalculate_mask) 136aa015c8eSEdward Tomasz Napierala { 137aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 138aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 139aa015c8eSEdward Tomasz Napierala return (_nfs4_acl_strip_np(aclp, recalculate_mask)); 140aa015c8eSEdward Tomasz Napierala 141aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 142aa015c8eSEdward Tomasz Napierala return (_posix1e_acl_strip_np(aclp, recalculate_mask)); 143aa015c8eSEdward Tomasz Napierala 144aa015c8eSEdward Tomasz Napierala default: 145aa015c8eSEdward Tomasz Napierala errno = EINVAL; 146aa015c8eSEdward Tomasz Napierala return (NULL); 147aa015c8eSEdward Tomasz Napierala } 148aa015c8eSEdward Tomasz Napierala } 149aa015c8eSEdward Tomasz Napierala 150aa015c8eSEdward Tomasz Napierala /* 151aa015c8eSEdward Tomasz Napierala * Return 1, if ACL is trivial, 0 otherwise. 152aa015c8eSEdward Tomasz Napierala * 153aa015c8eSEdward Tomasz Napierala * ACL is trivial, iff its meaning could be fully expressed using just file 154aa015c8eSEdward Tomasz Napierala * mode. In other words, ACL is trivial iff it doesn't have "+" to the right 155aa015c8eSEdward Tomasz Napierala * of the mode bits in "ls -l" output ;-) 156aa015c8eSEdward Tomasz Napierala */ 157aa015c8eSEdward Tomasz Napierala int 158aa015c8eSEdward Tomasz Napierala acl_is_trivial_np(const acl_t aclp, int *trivialp) 159aa015c8eSEdward Tomasz Napierala { 160aa015c8eSEdward Tomasz Napierala acl_t tmpacl; 161aa015c8eSEdward Tomasz Napierala int differs; 162aa015c8eSEdward Tomasz Napierala 163aa015c8eSEdward Tomasz Napierala if (aclp == NULL || trivialp == NULL) { 164aa015c8eSEdward Tomasz Napierala errno = EINVAL; 165aa015c8eSEdward Tomasz Napierala return (-1); 166aa015c8eSEdward Tomasz Napierala } 167aa015c8eSEdward Tomasz Napierala 168aa015c8eSEdward Tomasz Napierala switch (_acl_brand(aclp)) { 169aa015c8eSEdward Tomasz Napierala case ACL_BRAND_POSIX: 170aa015c8eSEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt == 3) 171aa015c8eSEdward Tomasz Napierala *trivialp = 1; 172aa015c8eSEdward Tomasz Napierala else 173aa015c8eSEdward Tomasz Napierala *trivialp = 0; 174aa015c8eSEdward Tomasz Napierala 175aa015c8eSEdward Tomasz Napierala return (0); 176aa015c8eSEdward Tomasz Napierala 177aa015c8eSEdward Tomasz Napierala case ACL_BRAND_NFS4: 178aa015c8eSEdward Tomasz Napierala /* 1797eaa29b5SEdward Tomasz Napierala * If the ACL has more than canonical six entries, 1807eaa29b5SEdward Tomasz Napierala * it's non trivial by definition. 1817eaa29b5SEdward Tomasz Napierala */ 1827eaa29b5SEdward Tomasz Napierala if (aclp->ats_acl.acl_cnt > 6) { 183*78141351SEdward Tomasz Napierala *trivialp = 0; 1847eaa29b5SEdward Tomasz Napierala return (0); 1857eaa29b5SEdward Tomasz Napierala } 1867eaa29b5SEdward Tomasz Napierala 1877eaa29b5SEdward Tomasz Napierala /* 188aa015c8eSEdward Tomasz Napierala * Calculate trivial ACL - using acl_strip_np - and compare 189aa015c8eSEdward Tomasz Napierala * with the original. 190aa015c8eSEdward Tomasz Napierala */ 191aa015c8eSEdward Tomasz Napierala tmpacl = acl_strip_np(aclp, 0); 192aa015c8eSEdward Tomasz Napierala if (tmpacl == NULL) 193aa015c8eSEdward Tomasz Napierala return (-1); 194aa015c8eSEdward Tomasz Napierala 195aa015c8eSEdward Tomasz Napierala differs = _acl_differs(aclp, tmpacl); 196aa015c8eSEdward Tomasz Napierala acl_free(tmpacl); 197aa015c8eSEdward Tomasz Napierala 198aa015c8eSEdward Tomasz Napierala if (differs) 199aa015c8eSEdward Tomasz Napierala *trivialp = 0; 200aa015c8eSEdward Tomasz Napierala else 201aa015c8eSEdward Tomasz Napierala *trivialp = 1; 202aa015c8eSEdward Tomasz Napierala 203aa015c8eSEdward Tomasz Napierala return (0); 204aa015c8eSEdward Tomasz Napierala 205aa015c8eSEdward Tomasz Napierala default: 206aa015c8eSEdward Tomasz Napierala errno = EINVAL; 207aa015c8eSEdward Tomasz Napierala return (-1); 208aa015c8eSEdward Tomasz Napierala } 209aa015c8eSEdward Tomasz Napierala } 210