From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 22 Aug 2025 09:04:41 +0000 (+0200)
Subject: acl-util: add new inode_type_can_acl() helper
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F39003%2Fhead;p=thirdparty%2Fsystemd.git

acl-util: add new inode_type_can_acl() helper
---

diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c
index a057e8028ce..03bfcca9b64 100644
--- a/src/shared/acl-util.c
+++ b/src/shared/acl-util.c
@@ -648,3 +648,7 @@ int fd_acl_make_writable_fallback(int fd) {
 
         return 1;
 }
+
+int inode_type_can_acl(mode_t mode) {
+        return IN_SET(mode & S_IFMT, S_IFSOCK, S_IFREG, S_IFBLK, S_IFCHR, S_IFDIR, S_IFIFO);
+}
diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h
index 2164017de3c..5e28f7167f9 100644
--- a/src/shared/acl-util.h
+++ b/src/shared/acl-util.h
@@ -53,3 +53,5 @@ static inline int fd_acl_make_writable(int fd) {
 }
 
 #endif
+
+int inode_type_can_acl(mode_t mode);
diff --git a/src/shared/shift-uid.c b/src/shared/shift-uid.c
index 9c7e875dffd..2f34908fff5 100644
--- a/src/shared/shift-uid.c
+++ b/src/shared/shift-uid.c
@@ -161,7 +161,7 @@ static int patch_acls(int fd, const char *name, const struct stat *st, uid_t shi
         assert(st);
 
         /* ACLs are not supported on symlinks, there's no point in trying */
-        if (S_ISLNK(st->st_mode))
+        if (!inode_type_can_acl(st->st_mode))
                 return 0;
 
         r = get_acl(fd, name, ACL_TYPE_ACCESS, &acl);
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 4342ed70abd..42d67deebf6 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -1459,8 +1459,8 @@ static int fd_set_acls(
                                        "Refusing to set ACLs on hardlinked file %s while the fs.protected_hardlinks sysctl is turned off.",
                                        path);
 
-        if (S_ISLNK(st->st_mode)) {
-                log_debug("Skipping ACL fix for symlink %s.", path);
+        if (!inode_type_can_acl(st->st_mode)) {
+                log_debug("Skipping ACL fix for '%s' (inode type does not support ACLs).", path);
                 return 0;
         }