src/shared/acl-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <stdbool.h>
   5 #include <sys/stat.h>
   6 #include <sys/types.h>
   7
   8 #include "acl-util.h"
   9 #include "alloc-util.h"
  10 #include "string-util.h"
  11 #include "strv.h"
  12 #include "user-util.h"
  13 #include "util.h"
  14
  15 int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
  16         acl_entry_t i;
  17         int r;
  18
  19         assert(acl);
  20         assert(entry);
  21
  22         for (r = acl_get_entry(acl, ACL_FIRST_ENTRY, &i);
  23              r > 0;
  24              r = acl_get_entry(acl, ACL_NEXT_ENTRY, &i)) {
  25
  26                 acl_tag_t tag;
  27                 uid_t *u;
  28                 bool b;
  29
  30                 if (acl_get_tag_type(i, &tag) < 0)
  31                         return -errno;
  32
  33                 if (tag != ACL_USER)
  34                         continue;
  35
  36                 u = acl_get_qualifier(i);
  37                 if (!u)
  38                         return -errno;
  39
  40                 b = *u == uid;
  41                 acl_free(u);
  42
  43                 if (b) {
  44                         *entry = i;
  45                         return 1;
  46                 }
  47         }
  48         if (r < 0)
  49                 return -errno;
  50
  51         return 0;
  52 }
  53
  54 int calc_acl_mask_if_needed(acl_t *acl_p) {
  55         acl_entry_t i;
  56         int r;
  57         bool need = false;
  58
  59         assert(acl_p);
  60
  61         for (r = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i);
  62              r > 0;
  63              r = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) {
  64                 acl_tag_t tag;
  65
  66                 if (acl_get_tag_type(i, &tag) < 0)
  67                         return -errno;
  68
  69                 if (tag == ACL_MASK)
  70                         return 0;
  71
  72                 if (IN_SET(tag, ACL_USER, ACL_GROUP))
  73                         need = true;
  74         }
  75         if (r < 0)
  76                 return -errno;
  77
  78         if (need && acl_calc_mask(acl_p) < 0)
  79                 return -errno;
  80
  81         return need;
  82 }
  83
  84 int add_base_acls_if_needed(acl_t *acl_p, const char *path) {
  85         acl_entry_t i;
  86         int r;
  87         bool have_user_obj = false, have_group_obj = false, have_other = false;
  88         struct stat st;
  89         _cleanup_(acl_freep) acl_t basic = NULL;
  90
  91         assert(acl_p);
  92
  93         for (r = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i);
  94              r > 0;
  95              r = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) {
  96                 acl_tag_t tag;
  97
  98                 if (acl_get_tag_type(i, &tag) < 0)
  99                         return -errno;
 100
 101                 if (tag == ACL_USER_OBJ)
 102                         have_user_obj = true;
 103                 else if (tag == ACL_GROUP_OBJ)
 104                         have_group_obj = true;
 105                 else if (tag == ACL_OTHER)
 106                         have_other = true;
 107                 if (have_user_obj && have_group_obj && have_other)
 108                         return 0;
 109         }
 110         if (r < 0)
 111                 return -errno;
 112
 113         r = stat(path, &st);
 114         if (r < 0)
 115                 return -errno;
 116
 117         basic = acl_from_mode(st.st_mode);
 118         if (!basic)
 119                 return -errno;
 120
 121         for (r = acl_get_entry(basic, ACL_FIRST_ENTRY, &i);
 122              r > 0;
 123              r = acl_get_entry(basic, ACL_NEXT_ENTRY, &i)) {
 124                 acl_tag_t tag;
 125                 acl_entry_t dst;
 126
 127                 if (acl_get_tag_type(i, &tag) < 0)
 128                         return -errno;
 129
 130                 if ((tag == ACL_USER_OBJ && have_user_obj) ||
 131                     (tag == ACL_GROUP_OBJ && have_group_obj) ||
 132                     (tag == ACL_OTHER && have_other))
 133                         continue;
 134
 135                 r = acl_create_entry(acl_p, &dst);
 136                 if (r < 0)
 137                         return -errno;
 138
 139                 r = acl_copy_entry(dst, i);
 140                 if (r < 0)
 141                         return -errno;
 142         }
 143         if (r < 0)
 144                 return -errno;
 145         return 0;
 146 }
 147
 148 int acl_search_groups(const char *path, char ***ret_groups) {
 149         _cleanup_strv_free_ char **g = NULL;
 150         _cleanup_(acl_freep) acl_t acl = NULL;
 151         bool ret = false;
 152         acl_entry_t entry;
 153         int r;
 154
 155         assert(path);
 156
 157         acl = acl_get_file(path, ACL_TYPE_DEFAULT);
 158         if (!acl)
 159                 return -errno;
 160
 161         r = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
 162         for (;;) {
 163                 _cleanup_(acl_free_gid_tpp) gid_t *gid = NULL;
 164                 acl_tag_t tag;
 165
 166                 if (r < 0)
 167                         return -errno;
 168                 if (r == 0)
 169                         break;
 170
 171                 if (acl_get_tag_type(entry, &tag) < 0)
 172                         return -errno;
 173
 174                 if (tag != ACL_GROUP)
 175                         goto next;
 176
 177                 gid = acl_get_qualifier(entry);
 178                 if (!gid)
 179                         return -errno;
 180
 181                 if (in_gid(*gid) > 0) {
 182                         if (!ret_groups)
 183                                 return true;
 184
 185                         ret = true;
 186                 }
 187
 188                 if (ret_groups) {
 189                         char *name;
 190
 191                         name = gid_to_name(*gid);
 192                         if (!name)
 193                                 return -ENOMEM;
 194
 195                         r = strv_consume(&g, name);
 196                         if (r < 0)
 197                                 return r;
 198                 }
 199
 200         next:
 201                 r = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
 202         }
 203
 204         if (ret_groups)
 205                 *ret_groups = TAKE_PTR(g);
 206
 207         return ret;
 208 }
 209
 210 int parse_acl(const char *text, acl_t *acl_access, acl_t *acl_default, bool want_mask) {
 211         _cleanup_free_ char **a = NULL, **d = NULL; /* strings are not freed */
 212         _cleanup_strv_free_ char **split;
 213         char **entry;
 214         int r = -EINVAL;
 215         _cleanup_(acl_freep) acl_t a_acl = NULL, d_acl = NULL;
 216
 217         split = strv_split(text, ",");
 218         if (!split)
 219                 return -ENOMEM;
 220
 221         STRV_FOREACH(entry, split) {
 222                 char *p;
 223
 224                 p = STARTSWITH_SET(*entry, "default:", "d:");
 225                 if (p)
 226                         r = strv_push(&d, p);
 227                 else
 228                         r = strv_push(&a, *entry);
 229                 if (r < 0)
 230                         return r;
 231         }
 232
 233         if (!strv_isempty(a)) {
 234                 _cleanup_free_ char *join;
 235
 236                 join = strv_join(a, ",");
 237                 if (!join)
 238                         return -ENOMEM;
 239
 240                 a_acl = acl_from_text(join);
 241                 if (!a_acl)
 242                         return -errno;
 243
 244                 if (want_mask) {
 245                         r = calc_acl_mask_if_needed(&a_acl);
 246                         if (r < 0)
 247                                 return r;
 248                 }
 249         }
 250
 251         if (!strv_isempty(d)) {
 252                 _cleanup_free_ char *join;
 253
 254                 join = strv_join(d, ",");
 255                 if (!join)
 256                         return -ENOMEM;
 257
 258                 d_acl = acl_from_text(join);
 259                 if (!d_acl)
 260                         return -errno;
 261
 262                 if (want_mask) {
 263                         r = calc_acl_mask_if_needed(&d_acl);
 264                         if (r < 0)
 265                                 return r;
 266                 }
 267         }
 268
 269         *acl_access = TAKE_PTR(a_acl);
 270         *acl_default = TAKE_PTR(d_acl);
 271
 272         return 0;
 273 }
 274
 275 static int acl_entry_equal(acl_entry_t a, acl_entry_t b) {
 276         acl_tag_t tag_a, tag_b;
 277
 278         if (acl_get_tag_type(a, &tag_a) < 0)
 279                 return -errno;
 280
 281         if (acl_get_tag_type(b, &tag_b) < 0)
 282                 return -errno;
 283
 284         if (tag_a != tag_b)
 285                 return false;
 286
 287         switch (tag_a) {
 288         case ACL_USER_OBJ:
 289         case ACL_GROUP_OBJ:
 290         case ACL_MASK:
 291         case ACL_OTHER:
 292                 /* can have only one of those */
 293                 return true;
 294         case ACL_USER: {
 295                 _cleanup_(acl_free_uid_tpp) uid_t *uid_a = NULL, *uid_b = NULL;
 296
 297                 uid_a = acl_get_qualifier(a);
 298                 if (!uid_a)
 299                         return -errno;
 300
 301                 uid_b = acl_get_qualifier(b);
 302                 if (!uid_b)
 303                         return -errno;
 304
 305                 return *uid_a == *uid_b;
 306         }
 307         case ACL_GROUP: {
 308                 _cleanup_(acl_free_gid_tpp) gid_t *gid_a = NULL, *gid_b = NULL;
 309
 310                 gid_a = acl_get_qualifier(a);
 311                 if (!gid_a)
 312                         return -errno;
 313
 314                 gid_b = acl_get_qualifier(b);
 315                 if (!gid_b)
 316                         return -errno;
 317
 318                 return *gid_a == *gid_b;
 319         }
 320         default:
 321                 assert_not_reached("Unknown acl tag type");
 322         }
 323 }
 324
 325 static int find_acl_entry(acl_t acl, acl_entry_t entry, acl_entry_t *out) {
 326         acl_entry_t i;
 327         int r;
 328
 329         for (r = acl_get_entry(acl, ACL_FIRST_ENTRY, &i);
 330              r > 0;
 331              r = acl_get_entry(acl, ACL_NEXT_ENTRY, &i)) {
 332
 333                 r = acl_entry_equal(i, entry);
 334                 if (r < 0)
 335                         return r;
 336                 if (r > 0) {
 337                         *out = i;
 338                         return 1;
 339                 }
 340         }
 341         if (r < 0)
 342                 return -errno;
 343         return 0;
 344 }
 345
 346 int acls_for_file(const char *path, acl_type_t type, acl_t new, acl_t *acl) {
 347         _cleanup_(acl_freep) acl_t old;
 348         acl_entry_t i;
 349         int r;
 350
 351         old = acl_get_file(path, type);
 352         if (!old)
 353                 return -errno;
 354
 355         for (r = acl_get_entry(new, ACL_FIRST_ENTRY, &i);
 356              r > 0;
 357              r = acl_get_entry(new, ACL_NEXT_ENTRY, &i)) {
 358
 359                 acl_entry_t j;
 360
 361                 r = find_acl_entry(old, i, &j);
 362                 if (r < 0)
 363                         return r;
 364                 if (r == 0)
 365                         if (acl_create_entry(&old, &j) < 0)
 366                                 return -errno;
 367
 368                 if (acl_copy_entry(j, i) < 0)
 369                         return -errno;
 370         }
 371         if (r < 0)
 372                 return -errno;
 373
 374         *acl = TAKE_PTR(old);
 375
 376         return 0;
 377 }
 378
 379 int add_acls_for_user(int fd, uid_t uid) {
 380         _cleanup_(acl_freep) acl_t acl = NULL;
 381         acl_entry_t entry;
 382         acl_permset_t permset;
 383         int r;
 384
 385         acl = acl_get_fd(fd);
 386         if (!acl)
 387                 return -errno;
 388
 389         r = acl_find_uid(acl, uid, &entry);
 390         if (r <= 0) {
 391                 if (acl_create_entry(&acl, &entry) < 0 ||
 392                     acl_set_tag_type(entry, ACL_USER) < 0 ||
 393                     acl_set_qualifier(entry, &uid) < 0)
 394                         return -errno;
 395         }
 396
 397         /* We do not recalculate the mask unconditionally here,
 398          * so that the fchmod() mask above stays intact. */
 399         if (acl_get_permset(entry, &permset) < 0 ||
 400             acl_add_perm(permset, ACL_READ) < 0)
 401                 return -errno;
 402
 403         r = calc_acl_mask_if_needed(&acl);
 404         if (r < 0)
 405                 return r;
 406
 407         return acl_set_fd(fd, acl);
 408 }