xref: /freebsd/lib/libc/posix1e/acl_set.c (revision 4d846d26)
1515d7c92SRobert Watson /*-
24d846d26SWarner Losh  * SPDX-License-Identifier: BSD-2-Clause
3d915a14eSPedro F. Giffuni  *
46394f703SRobert Watson  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
5515d7c92SRobert Watson  * All rights reserved.
6515d7c92SRobert Watson  *
76394f703SRobert Watson  * This software was developed by Robert Watson for the TrustedBSD Project.
86394f703SRobert Watson  *
9515d7c92SRobert Watson  * Redistribution and use in source and binary forms, with or without
10515d7c92SRobert Watson  * modification, are permitted provided that the following conditions
11515d7c92SRobert Watson  * are met:
12515d7c92SRobert Watson  * 1. Redistributions of source code must retain the above copyright
13515d7c92SRobert Watson  *    notice, this list of conditions and the following disclaimer.
14515d7c92SRobert Watson  * 2. Redistributions in binary form must reproduce the above copyright
15515d7c92SRobert Watson  *    notice, this list of conditions and the following disclaimer in the
16515d7c92SRobert Watson  *    documentation and/or other materials provided with the distribution.
17515d7c92SRobert Watson  *
18515d7c92SRobert Watson  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19515d7c92SRobert Watson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20515d7c92SRobert Watson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21515d7c92SRobert Watson  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22515d7c92SRobert Watson  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23515d7c92SRobert Watson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24515d7c92SRobert Watson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25515d7c92SRobert Watson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26515d7c92SRobert Watson  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27515d7c92SRobert Watson  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28515d7c92SRobert Watson  * SUCH DAMAGE.
29515d7c92SRobert Watson  */
30515d7c92SRobert Watson /*
31515d7c92SRobert Watson  * acl_set_file -- set a file/directory ACL by name
32515d7c92SRobert Watson  */
33515d7c92SRobert Watson 
34333fc21eSDavid E. O'Brien #include <sys/cdefs.h>
35333fc21eSDavid E. O'Brien __FBSDID("$FreeBSD$");
36333fc21eSDavid E. O'Brien 
37515d7c92SRobert Watson #include <sys/types.h>
387bd44e92SThomas Moestl #include "namespace.h"
39515d7c92SRobert Watson #include <sys/acl.h>
407bd44e92SThomas Moestl #include "un-namespace.h"
414bf60dfaSChris D. Faulhaber 
42515d7c92SRobert Watson #include <errno.h>
434bf60dfaSChris D. Faulhaber #include <stdlib.h>
444bf60dfaSChris D. Faulhaber #include <string.h>
45aa015c8eSEdward Tomasz Napierala #include <unistd.h>
46515d7c92SRobert Watson 
47515d7c92SRobert Watson #include "acl_support.h"
48515d7c92SRobert Watson 
49515d7c92SRobert Watson /*
50515d7c92SRobert Watson  * For POSIX.1e-semantic ACLs, do a presort so the kernel doesn't have to
51515d7c92SRobert Watson  * (the POSIX.1e semantic code will reject unsorted ACL submission).  If it's
52515d7c92SRobert Watson  * not a semantic that the library knows about, just submit it flat and
53515d7c92SRobert Watson  * assume the caller knows what they're up to.
54515d7c92SRobert Watson  */
55515d7c92SRobert Watson int
56515d7c92SRobert Watson acl_set_file(const char *path_p, acl_type_t type, acl_t acl)
57515d7c92SRobert Watson {
58515d7c92SRobert Watson 
59e146d0bcSChris D. Faulhaber 	if (acl == NULL || path_p == NULL) {
60e146d0bcSChris D. Faulhaber 		errno = EINVAL;
61e146d0bcSChris D. Faulhaber 		return (-1);
62e146d0bcSChris D. Faulhaber 	}
63ae1add4eSEdward Tomasz Napierala 	type = _acl_type_unold(type);
64aa015c8eSEdward Tomasz Napierala 	if (_acl_type_not_valid_for_acl(acl, type)) {
65aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
66aa015c8eSEdward Tomasz Napierala 		return (-1);
67aa015c8eSEdward Tomasz Napierala 	}
68d72fb30aSEdward Tomasz Napierala 	if (_posix1e_acl(acl, type))
69d72fb30aSEdward Tomasz Napierala 		_posix1e_acl_sort(acl);
70515d7c92SRobert Watson 
710f626307SChris D. Faulhaber 	acl->ats_cur_entry = 0;
720f626307SChris D. Faulhaber 
730f626307SChris D. Faulhaber 	return (__acl_set_file(path_p, type, &acl->ats_acl));
74515d7c92SRobert Watson }
75515d7c92SRobert Watson 
76515d7c92SRobert Watson int
776394f703SRobert Watson acl_set_link_np(const char *path_p, acl_type_t type, acl_t acl)
786394f703SRobert Watson {
796394f703SRobert Watson 
806394f703SRobert Watson 	if (acl == NULL || path_p == NULL) {
816394f703SRobert Watson 		errno = EINVAL;
826394f703SRobert Watson 		return (-1);
836394f703SRobert Watson 	}
84ae1add4eSEdward Tomasz Napierala 	type = _acl_type_unold(type);
85aa015c8eSEdward Tomasz Napierala 	if (_acl_type_not_valid_for_acl(acl, type)) {
86aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
87aa015c8eSEdward Tomasz Napierala 		return (-1);
88aa015c8eSEdward Tomasz Napierala 	}
89d72fb30aSEdward Tomasz Napierala 	if (_posix1e_acl(acl, type))
90d72fb30aSEdward Tomasz Napierala 		_posix1e_acl_sort(acl);
916394f703SRobert Watson 
926394f703SRobert Watson 	acl->ats_cur_entry = 0;
936394f703SRobert Watson 
946394f703SRobert Watson 	return (__acl_set_link(path_p, type, &acl->ats_acl));
956394f703SRobert Watson }
966394f703SRobert Watson 
976394f703SRobert Watson int
988f45e8c0SRobert Watson acl_set_fd(int fd, acl_t acl)
99515d7c92SRobert Watson {
100515d7c92SRobert Watson 
101c3380d40SEdward Tomasz Napierala 	if (fpathconf(fd, _PC_ACL_NFS4) == 1)
102aa015c8eSEdward Tomasz Napierala 		return (acl_set_fd_np(fd, acl, ACL_TYPE_NFS4));
1038f45e8c0SRobert Watson 
104aa015c8eSEdward Tomasz Napierala 	return (acl_set_fd_np(fd, acl, ACL_TYPE_ACCESS));
1058f45e8c0SRobert Watson }
1068f45e8c0SRobert Watson 
1078f45e8c0SRobert Watson int
1088f45e8c0SRobert Watson acl_set_fd_np(int fd, acl_t acl, acl_type_t type)
1098f45e8c0SRobert Watson {
1108f45e8c0SRobert Watson 
111aa015c8eSEdward Tomasz Napierala 	if (acl == NULL) {
112aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
113aa015c8eSEdward Tomasz Napierala 		return (-1);
114aa015c8eSEdward Tomasz Napierala 	}
115ae1add4eSEdward Tomasz Napierala 	type = _acl_type_unold(type);
116aa015c8eSEdward Tomasz Napierala 	if (_acl_type_not_valid_for_acl(acl, type)) {
117aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
118aa015c8eSEdward Tomasz Napierala 		return (-1);
119aa015c8eSEdward Tomasz Napierala 	}
120d72fb30aSEdward Tomasz Napierala 	if (_posix1e_acl(acl, type))
121d72fb30aSEdward Tomasz Napierala 		_posix1e_acl_sort(acl);
122515d7c92SRobert Watson 
1230f626307SChris D. Faulhaber 	acl->ats_cur_entry = 0;
1240f626307SChris D. Faulhaber 
1250f626307SChris D. Faulhaber 	return (___acl_set_fd(fd, type, &acl->ats_acl));
126515d7c92SRobert Watson }
1274bf60dfaSChris D. Faulhaber 
1284bf60dfaSChris D. Faulhaber /*
1290f626307SChris D. Faulhaber  * acl_set_permset() (23.4.23): sets the permissions of ACL entry entry_d
1304bf60dfaSChris D. Faulhaber  * with the permissions in permset_d
1314bf60dfaSChris D. Faulhaber  */
1324bf60dfaSChris D. Faulhaber int
1334bf60dfaSChris D. Faulhaber acl_set_permset(acl_entry_t entry_d, acl_permset_t permset_d)
1344bf60dfaSChris D. Faulhaber {
1354bf60dfaSChris D. Faulhaber 
1364bf60dfaSChris D. Faulhaber 	if (!entry_d) {
1374bf60dfaSChris D. Faulhaber 		errno = EINVAL;
1389fd46b02SChris D. Faulhaber 		return (-1);
1394bf60dfaSChris D. Faulhaber 	}
1404bf60dfaSChris D. Faulhaber 
141aa015c8eSEdward Tomasz Napierala 	if ((*permset_d & ACL_POSIX1E_BITS) != *permset_d) {
142aa015c8eSEdward Tomasz Napierala 		if ((*permset_d & ACL_NFS4_PERM_BITS) != *permset_d) {
143aa015c8eSEdward Tomasz Napierala 			errno = EINVAL;
144aa015c8eSEdward Tomasz Napierala 			return (-1);
145aa015c8eSEdward Tomasz Napierala 		}
146aa015c8eSEdward Tomasz Napierala 		if (!_entry_brand_may_be(entry_d, ACL_BRAND_NFS4)) {
147aa015c8eSEdward Tomasz Napierala 			errno = EINVAL;
148aa015c8eSEdward Tomasz Napierala 			return (-1);
149aa015c8eSEdward Tomasz Napierala 		}
150aa015c8eSEdward Tomasz Napierala 		_entry_brand_as(entry_d, ACL_BRAND_NFS4);
151aa015c8eSEdward Tomasz Napierala 	}
152aa015c8eSEdward Tomasz Napierala 
1534bf60dfaSChris D. Faulhaber 	entry_d->ae_perm = *permset_d;
1544bf60dfaSChris D. Faulhaber 
1559fd46b02SChris D. Faulhaber 	return (0);
1564bf60dfaSChris D. Faulhaber }
1574bf60dfaSChris D. Faulhaber 
1584bf60dfaSChris D. Faulhaber /*
1594bf60dfaSChris D. Faulhaber  * acl_set_qualifier() sets the qualifier (ae_id) of the tag for
1604bf60dfaSChris D. Faulhaber  * ACL entry entry_d to the value referred to by tag_qualifier_p
1614bf60dfaSChris D. Faulhaber  */
1624bf60dfaSChris D. Faulhaber int
1634bf60dfaSChris D. Faulhaber acl_set_qualifier(acl_entry_t entry_d, const void *tag_qualifier_p)
1644bf60dfaSChris D. Faulhaber {
165aa015c8eSEdward Tomasz Napierala 
1664bf60dfaSChris D. Faulhaber 	if (!entry_d || !tag_qualifier_p) {
1674bf60dfaSChris D. Faulhaber 		errno = EINVAL;
1689fd46b02SChris D. Faulhaber 		return (-1);
1694bf60dfaSChris D. Faulhaber 	}
1704bf60dfaSChris D. Faulhaber 	switch(entry_d->ae_tag) {
1714bf60dfaSChris D. Faulhaber 	case ACL_USER:
1724bf60dfaSChris D. Faulhaber 	case ACL_GROUP:
173d5675fffSChris D. Faulhaber 		entry_d->ae_id = *(uid_t *)tag_qualifier_p;
1744bf60dfaSChris D. Faulhaber 		break;
1754bf60dfaSChris D. Faulhaber 	default:
1764bf60dfaSChris D. Faulhaber 		errno = EINVAL;
1779fd46b02SChris D. Faulhaber 		return (-1);
1784bf60dfaSChris D. Faulhaber 	}
1794bf60dfaSChris D. Faulhaber 
1809fd46b02SChris D. Faulhaber 	return (0);
1814bf60dfaSChris D. Faulhaber }
1824bf60dfaSChris D. Faulhaber 
1834bf60dfaSChris D. Faulhaber /*
1844bf60dfaSChris D. Faulhaber  * acl_set_tag_type() sets the tag type for ACL entry entry_d to the
1854bf60dfaSChris D. Faulhaber  * value of tag_type
1864bf60dfaSChris D. Faulhaber  */
1874bf60dfaSChris D. Faulhaber int
1884bf60dfaSChris D. Faulhaber acl_set_tag_type(acl_entry_t entry_d, acl_tag_t tag_type)
1894bf60dfaSChris D. Faulhaber {
1904bf60dfaSChris D. Faulhaber 
1919fd46b02SChris D. Faulhaber 	if (entry_d == NULL) {
1924bf60dfaSChris D. Faulhaber 		errno = EINVAL;
1939fd46b02SChris D. Faulhaber 		return (-1);
1944bf60dfaSChris D. Faulhaber 	}
1954bf60dfaSChris D. Faulhaber 
1964bf60dfaSChris D. Faulhaber 	switch(tag_type) {
197aa015c8eSEdward Tomasz Napierala 	case ACL_OTHER:
198aa015c8eSEdward Tomasz Napierala 	case ACL_MASK:
199aa015c8eSEdward Tomasz Napierala 		if (!_entry_brand_may_be(entry_d, ACL_BRAND_POSIX)) {
200aa015c8eSEdward Tomasz Napierala 			errno = EINVAL;
201aa015c8eSEdward Tomasz Napierala 			return (-1);
202aa015c8eSEdward Tomasz Napierala 		}
203aa015c8eSEdward Tomasz Napierala 		_entry_brand_as(entry_d, ACL_BRAND_POSIX);
204aa015c8eSEdward Tomasz Napierala 		break;
205aa015c8eSEdward Tomasz Napierala 	case ACL_EVERYONE:
206aa015c8eSEdward Tomasz Napierala 		if (!_entry_brand_may_be(entry_d, ACL_BRAND_NFS4)) {
207aa015c8eSEdward Tomasz Napierala 			errno = EINVAL;
208aa015c8eSEdward Tomasz Napierala 			return (-1);
209aa015c8eSEdward Tomasz Napierala 		}
210aa015c8eSEdward Tomasz Napierala 		_entry_brand_as(entry_d, ACL_BRAND_NFS4);
211aa015c8eSEdward Tomasz Napierala 		break;
212aa015c8eSEdward Tomasz Napierala 	}
213aa015c8eSEdward Tomasz Napierala 
214aa015c8eSEdward Tomasz Napierala 	switch(tag_type) {
2154bf60dfaSChris D. Faulhaber 	case ACL_USER_OBJ:
2164bf60dfaSChris D. Faulhaber 	case ACL_USER:
2174bf60dfaSChris D. Faulhaber 	case ACL_GROUP_OBJ:
2184bf60dfaSChris D. Faulhaber 	case ACL_GROUP:
2194bf60dfaSChris D. Faulhaber 	case ACL_MASK:
2204bf60dfaSChris D. Faulhaber 	case ACL_OTHER:
221aa015c8eSEdward Tomasz Napierala 	case ACL_EVERYONE:
2224bf60dfaSChris D. Faulhaber 		entry_d->ae_tag = tag_type;
2239fd46b02SChris D. Faulhaber 		return (0);
2244bf60dfaSChris D. Faulhaber 	}
2254bf60dfaSChris D. Faulhaber 
2264bf60dfaSChris D. Faulhaber 	errno = EINVAL;
2279fd46b02SChris D. Faulhaber 	return (-1);
2284bf60dfaSChris D. Faulhaber }
229aa015c8eSEdward Tomasz Napierala 
230aa015c8eSEdward Tomasz Napierala int
231aa015c8eSEdward Tomasz Napierala acl_set_entry_type_np(acl_entry_t entry_d, acl_entry_type_t entry_type)
232aa015c8eSEdward Tomasz Napierala {
233aa015c8eSEdward Tomasz Napierala 
234aa015c8eSEdward Tomasz Napierala 	if (entry_d == NULL) {
235aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
236aa015c8eSEdward Tomasz Napierala 		return (-1);
237aa015c8eSEdward Tomasz Napierala 	}
238aa015c8eSEdward Tomasz Napierala 	if (!_entry_brand_may_be(entry_d, ACL_BRAND_NFS4)) {
239aa015c8eSEdward Tomasz Napierala 		errno = EINVAL;
240aa015c8eSEdward Tomasz Napierala 		return (-1);
241aa015c8eSEdward Tomasz Napierala 	}
242aa015c8eSEdward Tomasz Napierala 	_entry_brand_as(entry_d, ACL_BRAND_NFS4);
243aa015c8eSEdward Tomasz Napierala 
244aa015c8eSEdward Tomasz Napierala 	switch (entry_type) {
245aa015c8eSEdward Tomasz Napierala 	case ACL_ENTRY_TYPE_ALLOW:
246aa015c8eSEdward Tomasz Napierala 	case ACL_ENTRY_TYPE_DENY:
247aa015c8eSEdward Tomasz Napierala 	case ACL_ENTRY_TYPE_AUDIT:
248aa015c8eSEdward Tomasz Napierala 	case ACL_ENTRY_TYPE_ALARM:
249aa015c8eSEdward Tomasz Napierala 		entry_d->ae_entry_type = entry_type;
250aa015c8eSEdward Tomasz Napierala 		return (0);
251aa015c8eSEdward Tomasz Napierala 	}
252aa015c8eSEdward Tomasz Napierala 
253aa015c8eSEdward Tomasz Napierala 	errno = EINVAL;
254aa015c8eSEdward Tomasz Napierala 	return (-1);
255aa015c8eSEdward Tomasz Napierala }
256