1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 /*LINTLIBRARY*/
27
28 #include <grp.h>
29 #include <pwd.h>
30 #include <string.h>
31 #include <limits.h>
32 #include <stdlib.h>
33 #include <errno.h>
34 #include <sys/param.h>
35 #include <sys/types.h>
36 #include <sys/stat.h>
37 #include <sys/acl.h>
38 #include <aclutils.h>
39 #include <idmap.h>
40 #include <synch.h>
41
42 #define ID_STR_MAX 20 /* digits in LONG_MAX */
43
44 #define APPENDED_ID_MAX ID_STR_MAX + 1 /* id + colon */
45 /*
46 * yyinteractive controls whether yyparse should print out
47 * error messages to stderr, and whether or not id's should be
48 * allowed from acl_fromtext().
49 */
50 int yyinteractive;
51 acl_t *yyacl;
52 char *yybuf;
53 mutex_t yymutex;
54
55 extern acl_t *acl_alloc(enum acl_type);
56
57 /*
58 * dynamic string that will increase in size on an
59 * as needed basis.
60 */
61 typedef struct dynaclstr {
62 size_t d_bufsize; /* current size of aclexport */
63 char *d_aclexport;
64 int d_pos;
65 } dynaclstr_t;
66
67 static int str_append(dynaclstr_t *, char *);
68 static int aclent_perm_txt(dynaclstr_t *, o_mode_t);
69
70 static void
71 aclent_perms(int perm, char *txt_perms)
72 {
73 if (perm & S_IROTH)
74 txt_perms[0] = 'r';
75 else
76 txt_perms[0] = '-';
77 if (perm & S_IWOTH)
78 txt_perms[1] = 'w';
79 else
80 txt_perms[1] = '-';
81 if (perm & S_IXOTH)
82 txt_perms[2] = 'x';
83 else
84 txt_perms[2] = '-';
85 txt_perms[3] = '\0';
86 }
87
88 static char *
89 pruname(uid_t uid, char *uidp, size_t buflen, int noresolve)
90 {
91 struct passwd *passwdp = NULL;
92
93 if (noresolve == 0)
94 passwdp = getpwuid(uid);
95 if (passwdp == (struct passwd *)NULL) {
96 /* could not get passwd information: display uid instead */
97 (void) snprintf(uidp, buflen, "%u", uid);
98 } else {
99 (void) strlcpy(uidp, passwdp->pw_name, buflen);
100 }
101 return (uidp);
102 }
103
104 static char *
105 prgname(gid_t gid, char *gidp, size_t buflen, int noresolve)
106 {
107 struct group *groupp = NULL;
108
109 if (noresolve == 0)
110 groupp = getgrgid(gid);
111 if (groupp == (struct group *)NULL) {
112 /* could not get group information: display gid instead */
113 (void) snprintf(gidp, buflen, "%u", gid);
114 } else {
115 (void) strlcpy(gidp, groupp->gr_name, buflen);
116 }
117 return (gidp);
118 }
119
120 static int
121 getsidname(uid_t who, boolean_t user, char **sidp, boolean_t noresolve)
122 {
123 idmap_get_handle_t *get_hdl = NULL;
124 idmap_stat status;
125 idmap_rid_t rid;
126 int error = IDMAP_ERR_NORESULT;
127 int len;
128 char *domain = NULL;
129
130 *sidp = NULL;
131
132 /*
133 * First try and get windows name
134 */
135
136 if (!noresolve) {
137 if (user)
138 error = idmap_getwinnamebyuid(who,
139 IDMAP_REQ_FLG_USE_CACHE, sidp, NULL);
140 else
141 error = idmap_getwinnamebygid(who,
142 IDMAP_REQ_FLG_USE_CACHE, sidp, NULL);
143 }
144 if (error != IDMAP_SUCCESS) {
145 if (idmap_get_create(&get_hdl) == IDMAP_SUCCESS) {
146 if (user)
147 error = idmap_get_sidbyuid(get_hdl, who,
148 IDMAP_REQ_FLG_USE_CACHE, &domain, &rid,
149 &status);
150 else
151 error = idmap_get_sidbygid(get_hdl, who,
152 IDMAP_REQ_FLG_USE_CACHE, &domain, &rid,
153 &status);
154 if (error == IDMAP_SUCCESS &&
155 idmap_get_mappings(get_hdl) == 0) {
156 if (status == IDMAP_SUCCESS) {
157 len = snprintf(NULL, 0,
158 "%s-%d", domain, rid);
159 if (*sidp = malloc(len + 1)) {
160 (void) snprintf(*sidp, len + 1,
161 "%s-%d", domain, rid);
162 }
163 }
164 }
165 }
166 if (get_hdl)
167 idmap_get_destroy(get_hdl);
168 }
169
170 free(domain);
171
172 return (*sidp ? 0 : 1);
173 }
174
175 static void
176 aclent_printacl(acl_t *aclp)
177 {
178 aclent_t *tp;
179 int aclcnt;
180 int mask;
181 int slot = 0;
182 char perm[4];
183 char uidp[ID_STR_MAX];
184 char gidp[ID_STR_MAX];
185
186 /* display ACL: assume it is sorted. */
187 aclcnt = aclp->acl_cnt;
188 for (tp = aclp->acl_aclp; tp && aclcnt--; tp++) {
189 if (tp->a_type == CLASS_OBJ)
190 mask = tp->a_perm;
191 }
192 aclcnt = aclp->acl_cnt;
193 for (tp = aclp->acl_aclp; aclcnt--; tp++) {
194 (void) printf(" %d:", slot++);
195 switch (tp->a_type) {
196 case USER:
197 aclent_perms(tp->a_perm, perm);
198 (void) printf("user:%s:%s\t\t",
199 pruname(tp->a_id, uidp, sizeof (uidp), 0), perm);
200 aclent_perms((tp->a_perm & mask), perm);
201 (void) printf("#effective:%s\n", perm);
202 break;
203 case USER_OBJ:
204 /* no need to display uid */
205 aclent_perms(tp->a_perm, perm);
206 (void) printf("user::%s\n", perm);
207 break;
208 case GROUP:
209 aclent_perms(tp->a_perm, perm);
210 (void) printf("group:%s:%s\t\t",
211 prgname(tp->a_id, gidp, sizeof (gidp), 0), perm);
212 aclent_perms(tp->a_perm & mask, perm);
213 (void) printf("#effective:%s\n", perm);
214 break;
215 case GROUP_OBJ:
216 aclent_perms(tp->a_perm, perm);
217 (void) printf("group::%s\t\t", perm);
218 aclent_perms(tp->a_perm & mask, perm);
219 (void) printf("#effective:%s\n", perm);
220 break;
221 case CLASS_OBJ:
222 aclent_perms(tp->a_perm, perm);
223 (void) printf("mask:%s\n", perm);
224 break;
225 case OTHER_OBJ:
226 aclent_perms(tp->a_perm, perm);
227 (void) printf("other:%s\n", perm);
228 break;
229 case DEF_USER:
230 aclent_perms(tp->a_perm, perm);
231 (void) printf("default:user:%s:%s\n",
232 pruname(tp->a_id, uidp, sizeof (uidp), 0), perm);
233 break;
234 case DEF_USER_OBJ:
235 aclent_perms(tp->a_perm, perm);
236 (void) printf("default:user::%s\n", perm);
237 break;
238 case DEF_GROUP:
239 aclent_perms(tp->a_perm, perm);
240 (void) printf("default:group:%s:%s\n",
241 prgname(tp->a_id, gidp, sizeof (gidp), 0), perm);
242 break;
243 case DEF_GROUP_OBJ:
244 aclent_perms(tp->a_perm, perm);
245 (void) printf("default:group::%s\n", perm);
246 break;
247 case DEF_CLASS_OBJ:
248 aclent_perms(tp->a_perm, perm);
249 (void) printf("default:mask:%s\n", perm);
250 break;
251 case DEF_OTHER_OBJ:
252 aclent_perms(tp->a_perm, perm);
253 (void) printf("default:other:%s\n", perm);
254 break;
255 default:
256 (void) fprintf(stderr,
257 dgettext(TEXT_DOMAIN, "unrecognized entry\n"));
258 break;
259 }
260 }
261 }
262
263 static void
264 split_line(char *str, int cols)
265 {
266 char *ptr;
267 int len;
268 int i;
269 int last_split;
270 char *pad = "";
271 int pad_len;
272
273 len = strlen(str);
274 ptr = str;
275 pad_len = 0;
276
277 ptr = str;
278 last_split = 0;
279 for (i = 0; i != len; i++) {
280 if ((i + pad_len + 4) >= cols) {
281 (void) printf("%s%.*s\n", pad, last_split, ptr);
282 ptr = &ptr[last_split];
283 len = strlen(ptr);
284 i = 0;
285 pad_len = 4;
286 pad = " ";
287 } else {
288 if (ptr[i] == '/' || ptr[i] == ':') {
289 last_split = i;
290 }
291 }
292 }
293 if (i == len) {
294 (void) printf("%s%s\n", pad, ptr);
295 }
296 }
297
298 /*
299 * compute entry type string, such as user:joe, group:staff,...
300 */
301 static int
302 aclent_type_txt(dynaclstr_t *dstr, aclent_t *aclp, int flags)
303 {
304 char idp[ID_STR_MAX];
305 int error;
306
307 switch (aclp->a_type) {
308 case DEF_USER_OBJ:
309 case USER_OBJ:
310 if (aclp->a_type == USER_OBJ)
311 error = str_append(dstr, "user::");
312 else
313 error = str_append(dstr, "defaultuser::");
314 break;
315
316 case DEF_USER:
317 case USER:
318 if (aclp->a_type == USER)
319 error = str_append(dstr, "user:");
320 else
321 error = str_append(dstr, "defaultuser:");
322 if (error)
323 break;
324 error = str_append(dstr, pruname(aclp->a_id, idp,
325 sizeof (idp), flags & ACL_NORESOLVE));
326 if (error == 0)
327 error = str_append(dstr, ":");
328 break;
329
330 case DEF_GROUP_OBJ:
331 case GROUP_OBJ:
332 if (aclp->a_type == GROUP_OBJ)
333 error = str_append(dstr, "group::");
334 else
335 error = str_append(dstr, "defaultgroup::");
336 break;
337
338 case DEF_GROUP:
339 case GROUP:
340 if (aclp->a_type == GROUP)
341 error = str_append(dstr, "group:");
342 else
343 error = str_append(dstr, "defaultgroup:");
344 if (error)
345 break;
346 error = str_append(dstr, prgname(aclp->a_id, idp,
347 sizeof (idp), flags & ACL_NORESOLVE));
348 if (error == 0)
349 error = str_append(dstr, ":");
350 break;
351
352 case DEF_CLASS_OBJ:
353 case CLASS_OBJ:
354 if (aclp->a_type == CLASS_OBJ)
355 error = str_append(dstr, "mask:");
356 else
357 error = str_append(dstr, "defaultmask:");
358 break;
359
360 case DEF_OTHER_OBJ:
361 case OTHER_OBJ:
362 if (aclp->a_type == OTHER_OBJ)
363 error = str_append(dstr, "other:");
364 else
365 error = str_append(dstr, "defaultother:");
366 break;
367
368 default:
369 error = 1;
370 break;
371 }
372
373 return (error);
374 }
375
376 /*
377 * compute entry type string such as, owner@:, user:joe, group:staff,...
378 */
379 static int
380 ace_type_txt(dynaclstr_t *dynstr, ace_t *acep, int flags)
381 {
382 char idp[ID_STR_MAX];
383 int error;
384 char *sidp = NULL;
385
386 switch (acep->a_flags & ACE_TYPE_FLAGS) {
387 case ACE_OWNER:
388 error = str_append(dynstr, OWNERAT_TXT);
389 break;
390
391 case ACE_GROUP|ACE_IDENTIFIER_GROUP:
392 error = str_append(dynstr, GROUPAT_TXT);
393 break;
394
395 case ACE_IDENTIFIER_GROUP:
396 if ((flags & ACL_SID_FMT) && acep->a_who > MAXUID) {
397 if (error = str_append(dynstr,
398 GROUPSID_TXT))
399 break;
400 if (error = getsidname(acep->a_who, B_FALSE,
401 &sidp, flags & ACL_NORESOLVE))
402 break;
403 error = str_append(dynstr, sidp);
404 } else {
405 if (error = str_append(dynstr, GROUP_TXT))
406 break;
407 error = str_append(dynstr, prgname(acep->a_who, idp,
408 sizeof (idp), flags & ACL_NORESOLVE));
409 }
410 if (error == 0)
411 error = str_append(dynstr, ":");
412 break;
413
414 case ACE_EVERYONE:
415 error = str_append(dynstr, EVERYONEAT_TXT);
416 break;
417
418 case 0:
419 if ((flags & ACL_SID_FMT) && acep->a_who > MAXUID) {
420 if (error = str_append(dynstr, USERSID_TXT))
421 break;
422 if (error = getsidname(acep->a_who, B_TRUE,
423 &sidp, flags & ACL_NORESOLVE))
424 break;
425 error = str_append(dynstr, sidp);
426 } else {
427 if (error = str_append(dynstr, USER_TXT))
428 break;
429 error = str_append(dynstr, pruname(acep->a_who, idp,
430 sizeof (idp), flags & ACL_NORESOLVE));
431 }
432 if (error == 0)
433 error = str_append(dynstr, ":");
434 break;
435 default:
436 error = 0;
437 break;
438 }
439
440 if (sidp)
441 free(sidp);
442 return (error);
443 }
444
445 /*
446 * compute string of permissions, such as read_data/write_data or
447 * rwxp,...
448 * The format depends on the flags field which indicates whether the compact
449 * or verbose format should be used.
450 */
451 static int
452 ace_perm_txt(dynaclstr_t *dstr, uint32_t mask,
453 uint32_t iflags, int isdir, int flags)
454 {
455 int error = 0;
456
457 if (flags & ACL_COMPACT_FMT) {
458 char buf[16];
459
460 if (mask & ACE_READ_DATA)
461 buf[0] = 'r';
462 else
463 buf[0] = '-';
464 if (mask & ACE_WRITE_DATA)
465 buf[1] = 'w';
466 else
467 buf[1] = '-';
468 if (mask & ACE_EXECUTE)
469 buf[2] = 'x';
470 else
471 buf[2] = '-';
472 if (mask & ACE_APPEND_DATA)
473 buf[3] = 'p';
474 else
475 buf[3] = '-';
476 if (mask & ACE_DELETE)
477 buf[4] = 'd';
478 else
479 buf[4] = '-';
480 if (mask & ACE_DELETE_CHILD)
481 buf[5] = 'D';
482 else
483 buf[5] = '-';
484 if (mask & ACE_READ_ATTRIBUTES)
485 buf[6] = 'a';
486 else
487 buf[6] = '-';
488 if (mask & ACE_WRITE_ATTRIBUTES)
489 buf[7] = 'A';
490 else
491 buf[7] = '-';
492 if (mask & ACE_READ_NAMED_ATTRS)
493 buf[8] = 'R';
494 else
495 buf[8] = '-';
496 if (mask & ACE_WRITE_NAMED_ATTRS)
497 buf[9] = 'W';
498 else
499 buf[9] = '-';
500 if (mask & ACE_READ_ACL)
501 buf[10] = 'c';
502 else
503 buf[10] = '-';
504 if (mask & ACE_WRITE_ACL)
505 buf[11] = 'C';
506 else
507 buf[11] = '-';
508 if (mask & ACE_WRITE_OWNER)
509 buf[12] = 'o';
510 else
511 buf[12] = '-';
512 if (mask & ACE_SYNCHRONIZE)
513 buf[13] = 's';
514 else
515 buf[13] = '-';
516 buf[14] = ':';
517 buf[15] = '\0';
518 error = str_append(dstr, buf);
519 } else {
520 /*
521 * If ACE is a directory, but inheritance indicates its
522 * for a file then print permissions for file rather than
523 * dir.
524 */
525 if (isdir) {
526 if (mask & ACE_LIST_DIRECTORY) {
527 if (iflags == ACE_FILE_INHERIT_ACE) {
528 error = str_append(dstr,
529 READ_DATA_TXT);
530 } else {
531 error =
532 str_append(dstr, READ_DIR_TXT);
533 }
534 }
535 if (error == 0 && (mask & ACE_ADD_FILE)) {
536 if (iflags == ACE_FILE_INHERIT_ACE) {
537 error =
538 str_append(dstr, WRITE_DATA_TXT);
539 } else {
540 error =
541 str_append(dstr, ADD_FILE_TXT);
542 }
543 }
544 if (error == 0 && (mask & ACE_ADD_SUBDIRECTORY)) {
545 if (iflags == ACE_FILE_INHERIT_ACE) {
546 error = str_append(dstr,
547 APPEND_DATA_TXT);
548 } else {
549 error = str_append(dstr,
550 ADD_DIR_TXT);
551 }
552 }
553 } else {
554 if (mask & ACE_READ_DATA) {
555 error = str_append(dstr, READ_DATA_TXT);
556 }
557 if (error == 0 && (mask & ACE_WRITE_DATA)) {
558 error = str_append(dstr, WRITE_DATA_TXT);
559 }
560 if (error == 0 && (mask & ACE_APPEND_DATA)) {
561 error = str_append(dstr, APPEND_DATA_TXT);
562 }
563 }
564 if (error == 0 && (mask & ACE_READ_NAMED_ATTRS)) {
565 error = str_append(dstr, READ_XATTR_TXT);
566 }
567 if (error == 0 && (mask & ACE_WRITE_NAMED_ATTRS)) {
568 error = str_append(dstr, WRITE_XATTR_TXT);
569 }
570 if (error == 0 && (mask & ACE_EXECUTE)) {
571 error = str_append(dstr, EXECUTE_TXT);
572 }
573 if (error == 0 && (mask & ACE_DELETE_CHILD)) {
574 error = str_append(dstr, DELETE_CHILD_TXT);
575 }
576 if (error == 0 && (mask & ACE_READ_ATTRIBUTES)) {
577 error = str_append(dstr, READ_ATTRIBUTES_TXT);
578 }
579 if (error == 0 && (mask & ACE_WRITE_ATTRIBUTES)) {
580 error = str_append(dstr, WRITE_ATTRIBUTES_TXT);
581 }
582 if (error == 0 && (mask & ACE_DELETE)) {
583 error = str_append(dstr, DELETE_TXT);
584 }
585 if (error == 0 && (mask & ACE_READ_ACL)) {
586 error = str_append(dstr, READ_ACL_TXT);
587 }
588 if (error == 0 && (mask & ACE_WRITE_ACL)) {
589 error = str_append(dstr, WRITE_ACL_TXT);
590 }
591 if (error == 0 && (mask & ACE_WRITE_OWNER)) {
592 error = str_append(dstr, WRITE_OWNER_TXT);
593 }
594 if (error == 0 && (mask & ACE_SYNCHRONIZE)) {
595 error = str_append(dstr, SYNCHRONIZE_TXT);
596 }
597 if (error == 0 && dstr->d_aclexport[dstr->d_pos-1] == '/') {
598 dstr->d_aclexport[--dstr->d_pos] = '\0';
599 }
600 if (error == 0)
601 error = str_append(dstr, ":");
602 }
603 return (error);
604 }
605
606 /*
607 * compute string of access type, such as allow, deny, ...
608 */
609 static int
610 ace_access_txt(dynaclstr_t *dstr, int type)
611 {
612 int error;
613
614 if (type == ACE_ACCESS_ALLOWED_ACE_TYPE)
615 error = str_append(dstr, ALLOW_TXT);
616 else if (type == ACE_ACCESS_DENIED_ACE_TYPE)
617 error = str_append(dstr, DENY_TXT);
618 else if (type == ACE_SYSTEM_AUDIT_ACE_TYPE)
619 error = str_append(dstr, AUDIT_TXT);
620 else if (type == ACE_SYSTEM_ALARM_ACE_TYPE)
621 error = str_append(dstr, ALARM_TXT);
622 else
623 error = str_append(dstr, UNKNOWN_TXT);
624
625 return (error);
626 }
627
628 static int
629 ace_inherit_txt(dynaclstr_t *dstr, uint32_t iflags, int flags)
630 {
631 int error = 0;
632
633 if (flags & ACL_COMPACT_FMT) {
634 char buf[9];
635
636 if (iflags & ACE_FILE_INHERIT_ACE)
637 buf[0] = 'f';
638 else
639 buf[0] = '-';
640 if (iflags & ACE_DIRECTORY_INHERIT_ACE)
641 buf[1] = 'd';
642 else
643 buf[1] = '-';
644 if (iflags & ACE_INHERIT_ONLY_ACE)
645 buf[2] = 'i';
646 else
647 buf[2] = '-';
648 if (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)
649 buf[3] = 'n';
650 else
651 buf[3] = '-';
652 if (iflags & ACE_SUCCESSFUL_ACCESS_ACE_FLAG)
653 buf[4] = 'S';
654 else
655 buf[4] = '-';
656 if (iflags & ACE_FAILED_ACCESS_ACE_FLAG)
657 buf[5] = 'F';
658 else
659 buf[5] = '-';
660 if (iflags & ACE_INHERITED_ACE)
661 buf[6] = 'I';
662 else
663 buf[6] = '-';
664 buf[7] = ':';
665 buf[8] = '\0';
666 error = str_append(dstr, buf);
667 } else {
668 if (iflags & ACE_FILE_INHERIT_ACE) {
669 error = str_append(dstr, FILE_INHERIT_TXT);
670 }
671 if (error == 0 && (iflags & ACE_DIRECTORY_INHERIT_ACE)) {
672 error = str_append(dstr, DIR_INHERIT_TXT);
673 }
674 if (error == 0 && (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) {
675 error = str_append(dstr, NO_PROPAGATE_TXT);
676 }
677 if (error == 0 && (iflags & ACE_INHERIT_ONLY_ACE)) {
678 error = str_append(dstr, INHERIT_ONLY_TXT);
679 }
680 if (error == 0 && (iflags & ACE_SUCCESSFUL_ACCESS_ACE_FLAG)) {
681 error = str_append(dstr, SUCCESSFUL_ACCESS_TXT);
682 }
683 if (error == 0 && (iflags & ACE_FAILED_ACCESS_ACE_FLAG)) {
684 error = str_append(dstr, FAILED_ACCESS_TXT);
685 }
686 if (error == 0 && (iflags & ACE_INHERITED_ACE)) {
687 error = str_append(dstr, INHERITED_ACE_TXT);
688 }
689 if (error == 0 && dstr->d_aclexport[dstr->d_pos-1] == '/') {
690 dstr->d_aclexport[--dstr->d_pos] = '\0';
691 error = str_append(dstr, ":");
692 }
693 }
694
695 return (error);
696 }
697
698 /*
699 * Convert internal acl representation to external representation.
700 *
701 * The length of a non-owning user name or non-owning group name ie entries
702 * of type DEF_USER, USER, DEF_GROUP or GROUP, can exceed LOGNAME_MAX. We
703 * thus check the length of these entries, and if greater than LOGNAME_MAX,
704 * we realloc() via increase_length().
705 *
706 * The LOGNAME_MAX, ENTRYTYPELEN and PERMS limits are otherwise always
707 * adhered to.
708 */
709
710 /*
711 * acltotext() converts each ACL entry to look like this:
712 *
713 * entry_type:uid^gid^name:perms[:id]
714 *
715 * The maximum length of entry_type is 14 ("defaultgroup::" and
716 * "defaultother::") hence ENTRYTYPELEN is set to 14.
717 *
718 * The max length of a uid^gid^name entry (in theory) is 8, hence we use,
719 * however the ID could be a number so we therefore use ID_STR_MAX
720 *
721 * The length of a perms entry is 4 to allow for the comma appended to each
722 * to each acl entry. Hence PERMS is set to 4.
723 */
724
725 #define ENTRYTYPELEN 14
726 #define PERMS 4
727 #define ACL_ENTRY_SIZE (ENTRYTYPELEN + ID_STR_MAX + PERMS + APPENDED_ID_MAX)
728
729 char *
730 aclent_acltotext(aclent_t *aclp, int aclcnt, int flags)
731 {
732 dynaclstr_t *dstr;
733 char *aclexport = NULL;
734 int i;
735 int error = 0;
736
737 if (aclp == NULL)
738 return (NULL);
739 if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
740 return (NULL);
741 dstr->d_bufsize = aclcnt * ACL_ENTRY_SIZE;
742 if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
743 free(dstr);
744 return (NULL);
745 }
746 *dstr->d_aclexport = '\0';
747 dstr->d_pos = 0;
748
749 for (i = 0; i < aclcnt; i++, aclp++) {
750 if (error = aclent_type_txt(dstr, aclp, flags))
751 break;
752 if (error = aclent_perm_txt(dstr, aclp->a_perm))
753 break;
754
755 if ((flags & ACL_APPEND_ID) && ((aclp->a_type == USER) ||
756 (aclp->a_type == DEF_USER) || (aclp->a_type == GROUP) ||
757 (aclp->a_type == DEF_GROUP))) {
758 char id[ID_STR_MAX], *idstr;
759
760 if (error = str_append(dstr, ":"))
761 break;
762 id[ID_STR_MAX - 1] = '\0'; /* null terminate buffer */
763 idstr = lltostr(aclp->a_id, &id[ID_STR_MAX - 1]);
764 if (error = str_append(dstr, idstr))
765 break;
766 }
767 if (i < aclcnt - 1)
768 if (error = str_append(dstr, ","))
769 break;
770 }
771 if (error) {
772 if (dstr->d_aclexport)
773 free(dstr->d_aclexport);
774 } else {
775 aclexport = dstr->d_aclexport;
776 }
777 free(dstr);
778 return (aclexport);
779 }
780
781 char *
782 acltotext(aclent_t *aclp, int aclcnt)
783 {
784 return (aclent_acltotext(aclp, aclcnt, 0));
785 }
786
787
788 aclent_t *
789 aclfromtext(char *aclstr, int *aclcnt)
790 {
791 acl_t *aclp;
792 aclent_t *aclentp;
793 int error;
794
795 error = acl_fromtext(aclstr, &aclp);
796 if (error)
797 return (NULL);
798
799 aclentp = aclp->acl_aclp;
800 aclp->acl_aclp = NULL;
801 *aclcnt = aclp->acl_cnt;
802
803 acl_free(aclp);
804 return (aclentp);
805 }
806
807
808 /*
809 * Append string onto dynaclstr_t.
810 *
811 * Return 0 on success, 1 for failure.
812 */
813 static int
814 str_append(dynaclstr_t *dstr, char *newstr)
815 {
816 size_t len = strlen(newstr);
817
818 if ((len + dstr->d_pos) >= dstr->d_bufsize) {
819 dstr->d_aclexport = realloc(dstr->d_aclexport,
820 dstr->d_bufsize + len + 1);
821 if (dstr->d_aclexport == NULL)
822 return (1);
823 dstr->d_bufsize += len;
824 }
825 (void) strcat(&dstr->d_aclexport[dstr->d_pos], newstr);
826 dstr->d_pos += len;
827 return (0);
828 }
829
830 static int
831 aclent_perm_txt(dynaclstr_t *dstr, o_mode_t perm)
832 {
833 char buf[4];
834
835 if (perm & S_IROTH)
836 buf[0] = 'r';
837 else
838 buf[0] = '-';
839 if (perm & S_IWOTH)
840 buf[1] = 'w';
841 else
842 buf[1] = '-';
843 if (perm & S_IXOTH)
844 buf[2] = 'x';
845 else
846 buf[2] = '-';
847 buf[3] = '\0';
848 return (str_append(dstr, buf));
849 }
850
851 /*
852 * ace_acltotext() convert each ace formatted acl to look like this:
853 *
854 * entry_type:uid^gid^name:perms[:flags]:<allow|deny>[:id][,]
855 *
856 * The maximum length of entry_type is 5 ("group")
857 *
858 * The max length of a uid^gid^name entry (in theory) is 8,
859 * however id could be a number so we therefore use ID_STR_MAX
860 *
861 * The length of a perms entry is 144 i.e read_data/write_data...
862 * to each acl entry.
863 *
864 * iflags: file_inherit/dir_inherit/inherit_only/no_propagate/successful_access
865 * /failed_access
866 *
867 */
868
869 #define ACE_ENTRYTYPLEN 6
870 #define IFLAGS_STR "file_inherit/dir_inherit/inherit_only/no_propagate/" \
871 "successful_access/failed_access/inherited"
872 #define IFLAGS_SIZE (sizeof (IFLAGS_STR) - 1)
873 #define ACCESS_TYPE_SIZE 7 /* if unknown */
874 #define COLON_CNT 3
875 #define PERMS_LEN 216
876 #define ACE_ENTRY_SIZE (ACE_ENTRYTYPLEN + ID_STR_MAX + PERMS_LEN + \
877 ACCESS_TYPE_SIZE + IFLAGS_SIZE + COLON_CNT + APPENDED_ID_MAX)
878
879 static char *
880 ace_acltotext(acl_t *aceaclp, int flags)
881 {
882 ace_t *aclp = aceaclp->acl_aclp;
883 int aclcnt = aceaclp->acl_cnt;
884 int i;
885 int error = 0;
886 int isdir = (aceaclp->acl_flags & ACL_IS_DIR);
887 dynaclstr_t *dstr;
888 char *aclexport = NULL;
889 char *rawsidp = NULL;
890
891 if (aclp == NULL)
892 return (NULL);
893
894 if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
895 return (NULL);
896 dstr->d_bufsize = aclcnt * ACL_ENTRY_SIZE;
897 if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
898 free(dstr);
899 return (NULL);
900 }
901 *dstr->d_aclexport = '\0';
902 dstr->d_pos = 0;
903
904 for (i = 0; i < aclcnt; i++, aclp++) {
905
906 if (error = ace_type_txt(dstr, aclp, flags))
907 break;
908 if (error = ace_perm_txt(dstr, aclp->a_access_mask,
909 aclp->a_flags, isdir, flags))
910 break;
911 if (error = ace_inherit_txt(dstr, aclp->a_flags, flags))
912 break;
913 if (error = ace_access_txt(dstr, aclp->a_type))
914 break;
915
916 if ((flags & ACL_APPEND_ID) &&
917 (((aclp->a_flags & ACE_TYPE_FLAGS) == 0) ||
918 ((aclp->a_flags & ACE_TYPE_FLAGS) ==
919 ACE_IDENTIFIER_GROUP))) {
920 char id[ID_STR_MAX], *idstr;
921
922 if (error = str_append(dstr, ":"))
923 break;
924
925 rawsidp = NULL;
926 id[ID_STR_MAX -1] = '\0'; /* null terminate */
927 if (aclp->a_who > MAXUID && (flags & ACL_SID_FMT)) {
928
929 error = getsidname(aclp->a_who,
930 ((aclp->a_flags & ACE_TYPE_FLAGS) == 0) ?
931 B_TRUE : B_FALSE, &idstr, 1);
932 rawsidp = idstr;
933 if (error)
934 break;
935 } else if (aclp->a_who > MAXUID &&
936 !(flags & ACL_NORESOLVE)) {
937 idstr = lltostr(UID_NOBODY,
938 &id[ID_STR_MAX - 1]);
939 } else {
940 idstr = lltostr(aclp->a_who,
941 &id[ID_STR_MAX - 1]);
942 }
943 if (error = str_append(dstr, idstr))
944 break;
945 if (rawsidp) {
946 free(rawsidp);
947 rawsidp = NULL;
948 }
949 }
950 if (i < aclcnt - 1) {
951 if (error = str_append(dstr, ","))
952 break;
953 }
954 }
955
956 if (rawsidp)
957 free(rawsidp);
958 if (error) {
959 if (dstr->d_aclexport)
960 free(dstr->d_aclexport);
961 } else {
962 aclexport = dstr->d_aclexport;
963 }
964 free(dstr);
965 return (aclexport);
966 }
967
968 char *
969 acl_totext(acl_t *aclp, int flags)
970 {
971 char *txtp;
972
973 if (aclp == NULL)
974 return (NULL);
975
976 switch (aclp->acl_type) {
977 case ACE_T:
978 txtp = ace_acltotext(aclp, flags);
979 break;
980 case ACLENT_T:
981 txtp = aclent_acltotext(aclp->acl_aclp, aclp->acl_cnt, flags);
982 break;
983 }
984
985 return (txtp);
986 }
987
988 int
989 acl_fromtext(const char *acltextp, acl_t **ret_aclp)
990 {
991 int error;
992 char *buf;
993
994 buf = malloc(strlen(acltextp) + 2);
995 if (buf == NULL)
996 return (EACL_MEM_ERROR);
997 strcpy(buf, acltextp);
998 strcat(buf, "\n");
999
1000 (void) mutex_lock(&yymutex);
1001 yybuf = buf;
1002 yyreset();
1003 error = yyparse();
1004 free(buf);
1005
1006 if (yyacl) {
1007 if (error == 0)
1008 *ret_aclp = yyacl;
1009 else {
1010 acl_free(yyacl);
1011 }
1012 yyacl = NULL;
1013 }
1014 (void) mutex_unlock(&yymutex);
1015
1016 return (error);
1017 }
1018
1019 int
1020 acl_parse(const char *acltextp, acl_t **aclp)
1021 {
1022 int error;
1023
1024 yyinteractive = 1;
1025 error = acl_fromtext(acltextp, aclp);
1026 yyinteractive = 0;
1027 return (error);
1028 }
1029
1030 static void
1031 ace_compact_printacl(acl_t *aclp)
1032 {
1033 int cnt;
1034 ace_t *acep;
1035 dynaclstr_t *dstr;
1036 int len;
1037
1038 if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
1039 return;
1040 dstr->d_bufsize = ACE_ENTRY_SIZE;
1041 if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
1042 free(dstr);
1043 return;
1044 }
1045 *dstr->d_aclexport = '\0';
1046
1047 dstr->d_pos = 0;
1048 for (cnt = 0, acep = aclp->acl_aclp;
1049 cnt != aclp->acl_cnt; cnt++, acep++) {
1050 dstr->d_aclexport[0] = '\0';
1051 dstr->d_pos = 0;
1052
1053 if (ace_type_txt(dstr, acep, 0))
1054 break;
1055 len = strlen(&dstr->d_aclexport[0]);
1056 if (ace_perm_txt(dstr, acep->a_access_mask, acep->a_flags,
1057 aclp->acl_flags & ACL_IS_DIR, ACL_COMPACT_FMT))
1058 break;
1059 if (ace_inherit_txt(dstr, acep->a_flags, ACL_COMPACT_FMT))
1060 break;
1061 if (ace_access_txt(dstr, acep->a_type) == -1)
1062 break;
1063 (void) printf(" %20.*s%s\n", len, dstr->d_aclexport,
1064 &dstr->d_aclexport[len]);
1065 }
1066
1067 if (dstr->d_aclexport)
1068 free(dstr->d_aclexport);
1069 free(dstr);
1070 }
1071
1072 static void
1073 ace_printacl(acl_t *aclp, int cols, int compact)
1074 {
1075 int slot = 0;
1076 char *token;
1077 char *acltext;
1078
1079 if (compact) {
1080 ace_compact_printacl(aclp);
1081 return;
1082 }
1083
1084 acltext = acl_totext(aclp, 0);
1085
1086 if (acltext == NULL)
1087 return;
1088
1089 token = strtok(acltext, ",");
1090 if (token == NULL) {
1091 free(acltext);
1092 return;
1093 }
1094
1095 do {
1096 (void) printf(" %d:", slot++);
1097 split_line(token, cols - 5);
1098 } while (token = strtok(NULL, ","));
1099 free(acltext);
1100 }
1101
1102 /*
1103 * pretty print an ACL.
1104 * For aclent_t ACL's the format is
1105 * similar to the old format used by getfacl,
1106 * with the addition of adding a "slot" number
1107 * before each entry.
1108 *
1109 * for ace_t ACL's the cols variable will break up
1110 * the long lines into multiple lines and will also
1111 * print a "slot" number.
1112 */
1113 void
1114 acl_printacl(acl_t *aclp, int cols, int compact)
1115 {
1116
1117 switch (aclp->acl_type) {
1118 case ACLENT_T:
1119 aclent_printacl(aclp);
1120 break;
1121 case ACE_T:
1122 ace_printacl(aclp, cols, compact);
1123 break;
1124 }
1125 }
1126
1127 typedef struct value_table {
1128 char p_letter; /* perm letter such as 'r' */
1129 uint32_t p_value; /* value for perm when pletter found */
1130 } value_table_t;
1131
1132 /*
1133 * The permission tables are laid out in positional order
1134 * a '-' character will indicate a permission at a given
1135 * position is not specified. The '-' is not part of the
1136 * table, but will be checked for in the permission computation
1137 * routine.
1138 */
1139 value_table_t ace_perm_table[] = {
1140 { 'r', ACE_READ_DATA},
1141 { 'w', ACE_WRITE_DATA},
1142 { 'x', ACE_EXECUTE},
1143 { 'p', ACE_APPEND_DATA},
1144 { 'd', ACE_DELETE},
1145 { 'D', ACE_DELETE_CHILD},
1146 { 'a', ACE_READ_ATTRIBUTES},
1147 { 'A', ACE_WRITE_ATTRIBUTES},
1148 { 'R', ACE_READ_NAMED_ATTRS},
1149 { 'W', ACE_WRITE_NAMED_ATTRS},
1150 { 'c', ACE_READ_ACL},
1151 { 'C', ACE_WRITE_ACL},
1152 { 'o', ACE_WRITE_OWNER},
1153 { 's', ACE_SYNCHRONIZE}
1154 };
1155
1156 #define ACE_PERM_COUNT (sizeof (ace_perm_table) / sizeof (value_table_t))
1157
1158 value_table_t aclent_perm_table[] = {
1159 { 'r', S_IROTH},
1160 { 'w', S_IWOTH},
1161 { 'x', S_IXOTH}
1162 };
1163
1164 #define ACLENT_PERM_COUNT (sizeof (aclent_perm_table) / sizeof (value_table_t))
1165
1166 value_table_t inherit_table[] = {
1167 {'f', ACE_FILE_INHERIT_ACE},
1168 {'d', ACE_DIRECTORY_INHERIT_ACE},
1169 {'i', ACE_INHERIT_ONLY_ACE},
1170 {'n', ACE_NO_PROPAGATE_INHERIT_ACE},
1171 {'S', ACE_SUCCESSFUL_ACCESS_ACE_FLAG},
1172 {'F', ACE_FAILED_ACCESS_ACE_FLAG},
1173 {'I', ACE_INHERITED_ACE}
1174 };
1175
1176 #define IFLAG_COUNT (sizeof (inherit_table) / sizeof (value_table_t))
1177 #define IFLAG_COUNT_V1 6 /* Older version compatibility */
1178
1179 /*
1180 * compute value from a permission table or inheritance table
1181 * based on string passed in. If positional is set then
1182 * string must match order in permtab, otherwise any order
1183 * is allowed.
1184 */
1185 int
1186 compute_values(value_table_t *permtab, int count,
1187 char *permstr, int positional, uint32_t *mask)
1188 {
1189 uint32_t perm_val = 0;
1190 char *pstr;
1191 int i, found;
1192
1193 if (count < 0)
1194 return (1);
1195
1196 if (positional) {
1197 for (i = 0, pstr = permstr; i != count && pstr &&
1198 *pstr; i++, pstr++) {
1199 if (*pstr == permtab[i].p_letter) {
1200 perm_val |= permtab[i].p_value;
1201 } else if (*pstr != '-') {
1202 return (1);
1203 }
1204 }
1205 } else { /* random order single letters with no '-' */
1206 for (pstr = permstr; pstr && *pstr; pstr++) {
1207 for (found = 0, i = 0; i != count; i++) {
1208 if (*pstr == permtab[i].p_letter) {
1209 perm_val |= permtab[i].p_value;
1210 found = 1;
1211 break;
1212 }
1213 }
1214 if (found == 0)
1215 return (1);
1216 }
1217 }
1218
1219 *mask = perm_val;
1220 return (0);
1221 }
1222
1223
1224 int
1225 ace_inherit_helper(char *str, uint32_t *imask, int table_length)
1226 {
1227 int rc = 0;
1228
1229 if (strlen(str) == table_length) {
1230 /*
1231 * If the string == table_length then first check to see it's
1232 * in positional format. If that fails then see if it's in
1233 * non-positional format.
1234 */
1235 if (compute_values(inherit_table, table_length, str,
1236 1, imask) && compute_values(inherit_table,
1237 table_length, str, 0, imask)) {
1238 rc = 1;
1239 }
1240 } else {
1241 rc = compute_values(inherit_table, table_length, str, 0, imask);
1242 }
1243
1244 return (rc ? EACL_INHERIT_ERROR : 0);
1245 }
1246
1247 /*
1248 * compute value for inheritance flags.
1249 */
1250 int
1251 compute_ace_inherit(char *str, uint32_t *imask)
1252 {
1253 int rc = 0;
1254
1255 rc = ace_inherit_helper(str, imask, IFLAG_COUNT);
1256
1257 if (rc && strlen(str) != IFLAG_COUNT) {
1258
1259 /* is it an old formatted inherit string? */
1260 rc = ace_inherit_helper(str, imask, IFLAG_COUNT_V1);
1261 }
1262
1263 return (rc);
1264 }
1265
1266
1267 /*
1268 * compute value for ACE permissions.
1269 */
1270 int
1271 compute_ace_perms(char *str, uint32_t *mask)
1272 {
1273 int positional = 0;
1274 int error;
1275
1276 if (strlen(str) == ACE_PERM_COUNT)
1277 positional = 1;
1278
1279 error = compute_values(ace_perm_table, ACE_PERM_COUNT,
1280 str, positional, mask);
1281
1282 if (error && positional) {
1283 /*
1284 * If positional was set, then make sure permissions
1285 * aren't actually valid in non positional case where
1286 * all permissions are specified, just in random order.
1287 */
1288 error = compute_values(ace_perm_table,
1289 ACE_PERM_COUNT, str, 0, mask);
1290 }
1291 if (error)
1292 error = EACL_PERM_MASK_ERROR;
1293
1294 return (error);
1295 }
1296
1297
1298
1299 /*
1300 * compute values for aclent permissions.
1301 */
1302 int
1303 compute_aclent_perms(char *str, o_mode_t *mask)
1304 {
1305 int error;
1306 uint32_t pmask;
1307
1308 if (strlen(str) != ACLENT_PERM_COUNT)
1309 return (EACL_PERM_MASK_ERROR);
1310
1311 *mask = 0;
1312 error = compute_values(aclent_perm_table, ACLENT_PERM_COUNT,
1313 str, 1, &pmask);
1314 if (error == 0) {
1315 *mask = (o_mode_t)pmask;
1316 } else
1317 error = EACL_PERM_MASK_ERROR;
1318 return (error);
1319 }
1320
1321 /*
1322 * determine ACE permissions.
1323 */
1324 int
1325 ace_perm_mask(struct acl_perm_type *aclperm, uint32_t *mask)
1326 {
1327 int error;
1328
1329 if (aclperm->perm_style == PERM_TYPE_EMPTY) {
1330 *mask = 0;
1331 return (0);
1332 }
1333
1334 if (aclperm->perm_style == PERM_TYPE_ACE) {
1335 *mask = aclperm->perm_val;
1336 return (0);
1337 }
1338
1339 error = compute_ace_perms(aclperm->perm_str, mask);
1340 if (error) {
1341 acl_error(dgettext(TEXT_DOMAIN,
1342 "Invalid permission(s) '%s' specified\n"),
1343 aclperm->perm_str);
1344 return (EACL_PERM_MASK_ERROR);
1345 }
1346
1347 return (0);
1348 }