1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* */ 29 30 /* 31 * University Copyright- Copyright (c) 1982, 1986, 1988 32 * The Regents of the University of California 33 * All Rights Reserved 34 * 35 * University Acknowledgment- Portions of this document are derived from 36 * software developed by the University of California, Berkeley, and its 37 * contributors. 38 */ 39 40 #pragma ident "%Z%%M% %I% %E% SMI" 41 42 /* 43 * chmod option mode files 44 * where 45 * mode is [ugoa][+-=][rwxXlstugo] or an octal number 46 * mode is [<+|->A[# <number] ]<aclspec> 47 * option is -R and -f 48 */ 49 50 /* 51 * Note that many convolutions are necessary 52 * due to the re-use of bits between locking 53 * and setgid 54 */ 55 56 #include <unistd.h> 57 #include <stdlib.h> 58 #include <stdio.h> 59 #include <sys/types.h> 60 #include <sys/stat.h> 61 #include <dirent.h> 62 #include <locale.h> 63 #include <string.h> /* strerror() */ 64 #include <stdarg.h> 65 #include <limits.h> 66 #include <ctype.h> 67 #include <errno.h> 68 #include <sys/acl.h> 69 #include <aclutils.h> 70 71 static int rflag; 72 static int fflag; 73 74 extern int optind; 75 extern int errno; 76 77 static int mac; /* Alternate to argc (for parseargs) */ 78 static char **mav; /* Alternate to argv (for parseargs) */ 79 80 static char *ms; /* Points to the mode argument */ 81 82 #define ACL_ADD 1 83 #define ACL_DELETE 2 84 #define ACL_SLOT_DELETE 3 85 #define ACL_REPLACE 4 86 #define ACL_STRIP 5 87 88 typedef struct acl_args { 89 acl_t *acl_aclp; 90 int acl_slot; 91 int acl_action; 92 } acl_args_t; 93 94 extern mode_t 95 newmode_common(char *ms, mode_t new_mode, mode_t umsk, char *file, char *path, 96 o_mode_t *group_clear_bits, o_mode_t *group_set_bits); 97 98 static int 99 dochmod(char *name, char *path, mode_t umsk, acl_args_t *aclp), 100 chmodr(char *dir, char *path, mode_t mode, mode_t umsk, acl_args_t *aclp); 101 static int doacl(char *file, struct stat *st, acl_args_t *aclp); 102 103 static void handle_acl(char *name, o_mode_t group_clear_bits, 104 o_mode_t group_set_bits); 105 106 static void usage(void); 107 108 void errmsg(int severity, int code, char *format, ...); 109 110 static void parseargs(int ac, char *av[]); 111 112 int 113 parse_acl_args(char *arg, acl_args_t **acl_args); 114 115 int 116 main(int argc, char *argv[]) 117 { 118 int i, c; 119 int status = 0; 120 mode_t umsk; 121 acl_args_t *acl_args = NULL; 122 123 (void) setlocale(LC_ALL, ""); 124 #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 125 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 126 #endif 127 (void) textdomain(TEXT_DOMAIN); 128 129 parseargs(argc, argv); 130 131 while ((c = getopt(mac, mav, "Rf")) != EOF) { 132 switch (c) { 133 case 'R': 134 rflag++; 135 break; 136 case 'f': 137 fflag++; 138 break; 139 case '?': 140 usage(); 141 exit(2); 142 } 143 } 144 145 /* 146 * Check for sufficient arguments 147 * or a usage error. 148 */ 149 150 mac -= optind; 151 mav += optind; 152 153 if (mac >= 2 && (mav[0][0] == 'A')) { 154 if (parse_acl_args(*mav, &acl_args)) { 155 usage(); 156 exit(2); 157 } 158 } else { 159 if (mac < 2) { 160 usage(); 161 exit(2); 162 } 163 } 164 165 ms = mav[0]; 166 167 umsk = umask(0); 168 (void) umask(umsk); 169 170 for (i = 1; i < mac; i++) { 171 status += dochmod(mav[i], mav[i], umsk, acl_args); 172 } 173 174 return (fflag ? 0 : status); 175 } 176 177 static int 178 dochmod(char *name, char *path, mode_t umsk, acl_args_t *aclp) 179 { 180 static struct stat st; 181 int linkflg = 0; 182 o_mode_t group_clear_bits, group_set_bits; 183 184 if (lstat(name, &st) < 0) { 185 errmsg(2, 0, gettext("can't access %s\n"), path); 186 return (1); 187 } 188 189 if ((st.st_mode & S_IFMT) == S_IFLNK) { 190 linkflg = 1; 191 if (stat(name, &st) < 0) { 192 errmsg(2, 0, gettext("can't access %s\n"), path); 193 return (1); 194 } 195 } 196 197 /* Do not recurse if directory is object of symbolic link */ 198 if (rflag && ((st.st_mode & S_IFMT) == S_IFDIR) && !linkflg) 199 return (chmodr(name, path, st.st_mode, umsk, aclp)); 200 201 if (aclp) { 202 return (doacl(name, &st, aclp)); 203 } else if (chmod(name, newmode_common(ms, st.st_mode, umsk, name, path, 204 &group_clear_bits, &group_set_bits)) == -1) { 205 errmsg(2, 0, gettext("can't change %s\n"), path); 206 return (1); 207 } 208 209 /* 210 * If the group permissions of the file are being modified, 211 * make sure that the file's ACL (if it has one) is 212 * modified also, since chmod is supposed to apply group 213 * permissions changes to both the acl mask and the 214 * general group permissions. 215 */ 216 if (group_clear_bits || group_set_bits) 217 handle_acl(name, group_clear_bits, group_set_bits); 218 219 return (0); 220 } 221 222 223 static int 224 chmodr(char *dir, char *path, mode_t mode, mode_t umsk, acl_args_t *aclp) 225 { 226 227 DIR *dirp; 228 struct dirent *dp; 229 char savedir[PATH_MAX]; /* dir name to restore */ 230 char currdir[PATH_MAX+1]; /* current dir name + '/' */ 231 char parentdir[PATH_MAX+1]; /* parent dir name + '/' */ 232 int ecode; 233 struct stat st; 234 o_mode_t group_clear_bits, group_set_bits; 235 236 if (getcwd(savedir, PATH_MAX) == 0) 237 errmsg(2, 255, gettext("chmod: could not getcwd %s\n"), 238 savedir); 239 240 /* 241 * Change what we are given before doing it's contents 242 */ 243 if (aclp) { 244 if (lstat(dir, &st) < 0) { 245 errmsg(2, 0, gettext("can't access %s\n"), path); 246 return (1); 247 } 248 if (doacl(dir, &st, aclp) != 0) 249 return (1); 250 } else if (chmod(dir, newmode_common(ms, mode, umsk, dir, path, 251 &group_clear_bits, &group_set_bits)) < 0) { 252 errmsg(2, 0, gettext("can't change %s\n"), path); 253 return (1); 254 } 255 256 /* 257 * If the group permissions of the file are being modified, 258 * make sure that the file's ACL (if it has one) is 259 * modified also, since chmod is supposed to apply group 260 * permissions changes to both the acl mask and the 261 * general group permissions. 262 */ 263 264 if (aclp == NULL) { /* only necessary when not setting ACL */ 265 if (group_clear_bits || group_set_bits) 266 handle_acl(dir, group_clear_bits, group_set_bits); 267 } 268 269 if (chdir(dir) < 0) { 270 errmsg(2, 0, "%s/%s: %s\n", savedir, dir, strerror(errno)); 271 return (1); 272 } 273 if ((dirp = opendir(".")) == NULL) { 274 errmsg(2, 0, "%s\n", strerror(errno)); 275 return (1); 276 } 277 ecode = 0; 278 279 /* 280 * Save parent directory path before recursive chmod. 281 * We'll need this for error printing purposes. Add 282 * a trailing '/' to the path except in the case where 283 * the path is just '/' 284 */ 285 286 (void) strcpy(parentdir, path); 287 if (strcmp(path, "/") != 0) 288 (void) strcat(parentdir, "/"); 289 290 for (dp = readdir(dirp); dp != NULL; dp = readdir(dirp)) { 291 if (strcmp(dp->d_name, ".") == 0 || /* skip . and .. */ 292 strcmp(dp->d_name, "..") == 0) { 293 continue; 294 } 295 (void) strcpy(currdir, parentdir); 296 (void) strcat(currdir, dp->d_name); 297 ecode += dochmod(dp->d_name, currdir, umsk, aclp); 298 } 299 (void) closedir(dirp); 300 if (chdir(savedir) < 0) { 301 errmsg(2, 255, gettext("can't change back to %s\n"), savedir); 302 } 303 return (ecode ? 1 : 0); 304 } 305 306 /* PRINTFLIKE3 */ 307 void 308 errmsg(int severity, int code, char *format, ...) 309 { 310 va_list ap; 311 static char *msg[] = { 312 "", 313 "ERROR", 314 "WARNING", 315 "" 316 }; 317 318 va_start(ap, format); 319 320 /* 321 * Always print error message if this is a fatal error (code == 0); 322 * otherwise, print message if fflag == 0 (no -f option specified) 323 */ 324 if (!fflag || (code != 0)) { 325 (void) fprintf(stderr, 326 "chmod: %s: ", gettext(msg[severity])); 327 (void) vfprintf(stderr, format, ap); 328 } 329 330 va_end(ap); 331 332 if (code != 0) 333 exit(fflag ? 0 : code); 334 } 335 336 static void 337 usage(void) 338 { 339 (void) fprintf(stderr, gettext( 340 "usage:\tchmod [-fR] <absolute-mode> file ...\n")); 341 342 (void) fprintf(stderr, gettext( 343 "\tchmod [-fR] <ACL-operation> file ...\n")); 344 345 (void) fprintf(stderr, gettext( 346 "\tchmod [-fR] <symbolic-mode-list> file ...\n")); 347 348 349 (void) fprintf(stderr, gettext( 350 "where \t<symbolic-mode-list> is a comma-separated list of\n")); 351 352 (void) fprintf(stderr, gettext( 353 "\t[ugoa]{+|-|=}[rwxXlstugo]\n")); 354 355 (void) fprintf(stderr, gettext( 356 "where \t<ACL-operation> is one of the following\n")); 357 (void) fprintf(stderr, gettext("\tA-<acl_specification>\n")); 358 (void) fprintf(stderr, gettext("\tA[number]-\n")); 359 (void) fprintf(stderr, gettext( 360 "\tA[number]{+|=}<acl_specification>\n")); 361 (void) fprintf(stderr, gettext( 362 "where \t<acl-specification> is a comma-separated list of ACEs\n")); 363 } 364 365 /* 366 * parseargs - generate getopt-friendly argument list for backwards 367 * compatibility with earlier Solaris usage (eg, chmod -w 368 * foo). 369 * 370 * assumes the existence of a static set of alternates to argc and argv, 371 * (namely, mac, and mav[]). 372 * 373 */ 374 375 static void 376 parseargs(int ac, char *av[]) 377 { 378 int i; /* current argument */ 379 int fflag; /* arg list contains "--" */ 380 size_t mav_num; /* number of entries in mav[] */ 381 382 /* 383 * We add an extra argument slot, in case we need to jam a "--" 384 * argument into the list. 385 */ 386 387 mav_num = (size_t)ac+2; 388 389 if ((mav = calloc(mav_num, sizeof (char *))) == NULL) { 390 perror("chmod"); 391 exit(2); 392 } 393 394 /* scan for the use of "--" in the argument list */ 395 396 for (fflag = i = 0; i < ac; i ++) { 397 if (strcmp(av[i], "--") == 0) 398 fflag = 1; 399 } 400 401 /* process the arguments */ 402 403 for (i = mac = 0; 404 (av[i] != (char *)NULL) && (av[i][0] != (char)NULL); 405 i++) { 406 if (!fflag && av[i][0] == '-') { 407 /* 408 * If there is not already a "--" argument specified, 409 * and the argument starts with '-' but does not 410 * contain any of the official option letters, then it 411 * is probably a mode argument beginning with '-'. 412 * Force a "--" into the argument stream in front of 413 * it. 414 */ 415 416 if ((strchr(av[i], 'R') == NULL && 417 strchr(av[i], 'f') == NULL)) { 418 mav[mac++] = strdup("--"); 419 } 420 } 421 422 mav[mac++] = strdup(av[i]); 423 } 424 425 mav[mac] = (char *)NULL; 426 } 427 428 int 429 parse_acl_args(char *arg, acl_args_t **acl_args) 430 { 431 acl_t *new_acl = NULL; 432 int slot; 433 int len; 434 int action; 435 acl_args_t *new_acl_args; 436 char *acl_spec = NULL; 437 char *end; 438 439 if (arg[0] != 'A') 440 return (1); 441 442 slot = strtol(&arg[1], &end, 10); 443 444 len = strlen(arg); 445 switch (*end) { 446 case '+': 447 action = ACL_ADD; 448 acl_spec = ++end; 449 break; 450 case '-': 451 if (len == 2 && arg[0] == 'A' && arg[1] == '-') 452 action = ACL_STRIP; 453 else 454 action = ACL_DELETE; 455 if (action != ACL_STRIP) { 456 acl_spec = ++end; 457 if (acl_spec[0] == '\0') { 458 action = ACL_SLOT_DELETE; 459 acl_spec = NULL; 460 } else if (arg[1] != '-') 461 return (1); 462 } 463 break; 464 case '=': 465 /* 466 * Was slot specified? 467 */ 468 if (arg[1] == '=') 469 slot = -1; 470 action = ACL_REPLACE; 471 acl_spec = ++end; 472 break; 473 default: 474 return (1); 475 } 476 477 if ((action == ACL_REPLACE || action == ACL_ADD) && acl_spec[0] == '\0') 478 return (1); 479 480 if (acl_spec) { 481 if (acl_parse(acl_spec, &new_acl)) { 482 exit(1); 483 } 484 } 485 486 new_acl_args = malloc(sizeof (acl_args_t)); 487 if (new_acl_args == NULL) 488 return (1); 489 490 new_acl_args->acl_aclp = new_acl; 491 new_acl_args->acl_slot = slot; 492 new_acl_args->acl_action = action; 493 494 *acl_args = new_acl_args; 495 496 return (0); 497 } 498 499 /* 500 * This function is called whenever the group permissions of a file 501 * is being modified. According to the chmod(1) manpage, any 502 * change made to the group permissions must be applied to both 503 * the acl mask and the acl's GROUP_OBJ. The chmod(2) already 504 * set the mask, so this routine needs to make the same change 505 * to the GROUP_OBJ. 506 */ 507 static void 508 handle_acl(char *name, o_mode_t group_clear_bits, o_mode_t group_set_bits) 509 { 510 int aclcnt, n; 511 aclent_t *aclp, *tp; 512 o_mode_t newperm; 513 514 /* 515 * if this file system support ace_t acl's 516 * then simply return since we don't have an 517 * acl mask to deal with 518 */ 519 if (pathconf(name, _PC_ACL_ENABLED) == _ACL_ACE_ENABLED) 520 return; 521 522 if ((aclcnt = acl(name, GETACLCNT, 0, NULL)) <= MIN_ACL_ENTRIES) 523 return; /* it's just a trivial acl; no need to change it */ 524 525 if ((aclp = (aclent_t *)malloc((sizeof (aclent_t)) * aclcnt)) 526 == NULL) { 527 perror("chmod"); 528 exit(2); 529 } 530 531 if (acl(name, GETACL, aclcnt, aclp) < 0) { 532 free(aclp); 533 (void) fprintf(stderr, "chmod: "); 534 perror(name); 535 return; 536 } 537 538 for (tp = aclp, n = aclcnt; n--; tp++) { 539 if (tp->a_type == GROUP_OBJ) { 540 newperm = tp->a_perm; 541 if (group_clear_bits != 0) 542 newperm &= ~group_clear_bits; 543 if (group_set_bits != 0) 544 newperm |= group_set_bits; 545 if (newperm != tp->a_perm) { 546 tp->a_perm = newperm; 547 if (acl(name, SETACL, aclcnt, aclp) 548 < 0) { 549 (void) fprintf(stderr, "chmod: "); 550 perror(name); 551 } 552 } 553 break; 554 } 555 } 556 free(aclp); 557 } 558 559 static int 560 doacl(char *file, struct stat *st, acl_args_t *acl_args) 561 { 562 acl_t *aclp; 563 acl_t *set_aclp; 564 int error = 0; 565 void *to, *from; 566 int len; 567 int isdir; 568 569 isdir = S_ISDIR(st->st_mode); 570 571 error = acl_get(file, 0, &aclp); 572 573 if (error != 0) { 574 errmsg(1, 1, "%s\n", acl_strerror(error)); 575 return (1); 576 } 577 578 switch (acl_args->acl_action) { 579 case ACL_ADD: 580 if ((error = acl_addentries(aclp, 581 acl_args->acl_aclp, acl_args->acl_slot)) != 0) { 582 errmsg(1, 1, "%s\n", acl_strerror(error)); 583 acl_free(aclp); 584 return (1); 585 } 586 set_aclp = aclp; 587 break; 588 case ACL_SLOT_DELETE: 589 590 if (acl_args->acl_slot + 1 > aclp->acl_cnt) { 591 errmsg(1, 1, 592 gettext("Invalid slot specified for removal\n")); 593 acl_free(aclp); 594 return (1); 595 } 596 597 if (acl_args->acl_slot == 0 && aclp->acl_cnt == 1) { 598 errmsg(1, 1, 599 gettext("Can't remove all ACL " 600 "entries from a file\n")); 601 acl_free(aclp); 602 return (1); 603 } 604 605 /* 606 * remove a single entry 607 * 608 * if last entry just adjust acl_cnt 609 */ 610 611 if ((acl_args->acl_slot + 1) == aclp->acl_cnt) 612 aclp->acl_cnt--; 613 else { 614 to = (char *)aclp->acl_aclp + 615 (acl_args->acl_slot * aclp->acl_entry_size); 616 from = (char *)to + aclp->acl_entry_size; 617 len = (aclp->acl_cnt - acl_args->acl_slot - 1) * 618 aclp->acl_entry_size; 619 (void) memmove(to, from, len); 620 aclp->acl_cnt--; 621 } 622 set_aclp = aclp; 623 break; 624 625 case ACL_DELETE: 626 if ((error = acl_removeentries(aclp, acl_args->acl_aclp, 627 acl_args->acl_slot, ACL_REMOVE_ALL)) != 0) { 628 errmsg(1, 1, "%s\n", acl_strerror(error)); 629 acl_free(aclp); 630 return (1); 631 } 632 633 if (aclp->acl_cnt == 0) { 634 errmsg(1, 1, 635 gettext("Can't remove all ACL " 636 "entries from a file\n")); 637 acl_free(aclp); 638 return (1); 639 } 640 641 set_aclp = aclp; 642 break; 643 case ACL_REPLACE: 644 if (acl_args->acl_slot >= 0) { 645 error = acl_modifyentries(aclp, acl_args->acl_aclp, 646 acl_args->acl_slot); 647 if (error) { 648 errmsg(1, 1, "%s\n", acl_strerror(error)); 649 acl_free(aclp); 650 return (1); 651 } 652 set_aclp = aclp; 653 } else { 654 set_aclp = acl_args->acl_aclp; 655 } 656 break; 657 case ACL_STRIP: 658 error = acl_strip(file, st->st_uid, st->st_gid, st->st_mode); 659 if (error) { 660 errmsg(1, 1, "%s\n", acl_strerror(error)); 661 return (1); 662 } 663 acl_free(aclp); 664 return (0); 665 /*NOTREACHED*/ 666 default: 667 errmsg(1, 0, gettext("Unknown ACL action requested\n")); 668 return (1); 669 break; 670 } 671 672 error = acl_check(set_aclp, isdir); 673 674 if (error) { 675 errmsg(1, 0, "%s\n%s", acl_strerror(error), 676 gettext("See chmod(1) for more information on " 677 "valid ACL syntax\n")); 678 return (1); 679 } 680 if ((error = acl_set(file, set_aclp)) != 0) { 681 errmsg(1, 0, gettext("Failed to set ACL: %s\n"), 682 acl_strerror(error)); 683 acl_free(aclp); 684 return (1); 685 } 686 acl_free(aclp); 687 return (0); 688 } 689