Date: Mon, 28 Feb 2011 21:40:10 -0700 From: Shawn Webb <lattera@gmail.com> To: FreeBSD-current <freebsd-current@freebsd.org> Subject: Re: setfacl Recursive Functionality Message-ID: <AANLkTik7D_uzL33M-ABZmM27NpfXrPsuCXvjo2fhE7Ky@mail.gmail.com> In-Reply-To: <AANLkTi=%2BWtmRz07m=Cg7hbXJGw7eWRHC1ASGeufTSLBB@mail.gmail.com> References: <AANLkTi=%2BWtmRz07m=Cg7hbXJGw7eWRHC1ASGeufTSLBB@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
One last patch before I do a send-pr to send the patch upstream. This patch
depends on my ZFS ACL Sets patch for the -k flag. I wanted to zero-out the
ACL entries recursively for a directory, which I can do in Solaris with
"chmod -R A= /path/to/directory", but ZFS doesn't allow zero-number ACL
sets. To work around that, I'm giving owner@ full permissions (the full_set
ACL set).
I'll also include my ZFS ACL Sets patch. That has already been submitted
upstream and I'm awaiting approval.
Thanks,
Shawn
On Tue, Feb 8, 2011 at 10:58 AM, Shawn Webb <lattera@gmail.com> wrote:
> I've just finished a patch to add recursive functionality to setfacl.
> Before I officially submit it, I'd like a few suggestions on how to improve
> the patch.
>
> The part I'm worried about involves the #define directive at top. I'm not
> sure what ramifications using that define might have. I needed it for my
> remove_invalid_inherit() function to work.
>
> Thanks,
>
> Shawn
>
> attached: setfacl.patch (universal diff)
>
[-- Attachment #2 --]
diff --git a/bin/setfacl/setfacl.c b/bin/setfacl/setfacl.c
index a0f937c..2532188 100644
--- a/bin/setfacl/setfacl.c
+++ b/bin/setfacl/setfacl.c
@@ -32,6 +32,8 @@ __FBSDID("$FreeBSD$");
#include <sys/stat.h>
#include <sys/acl.h>
#include <sys/queue.h>
+#include <fts.h>
+#include <dirent.h>
#include <err.h>
#include <errno.h>
@@ -44,6 +46,8 @@ __FBSDID("$FreeBSD$");
static void add_filename(const char *filename);
static void usage(void);
+static void recurse_directory(char *const *paths, int r_flag, int l_flag, int big_h_flag);
+static acl_t remove_invalid_inherit(const char *path, acl_t acl, int l_flag);
static void
add_filename(const char *filename)
@@ -62,34 +66,112 @@ add_filename(const char *filename)
static void
usage(void)
{
-
- fprintf(stderr, "usage: setfacl [-bdhkn] [-a position entries] "
+ fprintf(stderr, "usage: setfacl [-bdhkLnR] [-a position entries] "
"[-m entries] [-M file] [-x entries] [-X file] [file ...]\n");
exit(1);
}
+static void
+recurse_directory(char *const *paths, int r_flag, int l_flag, int big_h_flag)
+{
+ FTS *ftsp;
+ FTSENT *p, *chp;
+ int fts_options = FTS_NOCHDIR;
+ unsigned int i;
+
+ fts_options |= (l_flag == 1) ? FTS_LOGICAL : FTS_PHYSICAL;
+ if (big_h_flag)
+ fts_options |= FTS_COMFOLLOW;
+
+ if (r_flag)
+ {
+ ftsp = fts_open(paths, fts_options, NULL);
+ if (ftsp == NULL)
+ return;
+
+ chp = fts_children(ftsp, 0);
+ if (chp == NULL)
+ return;
+
+ while ((p = fts_read(ftsp)) != NULL) {
+ if (l_flag == 0 && p->fts_info & FTS_D)
+ continue;
+ else if (l_flag == 1 && p->fts_info & FTS_DP)
+ continue;
+
+ add_filename(strdup(p->fts_path));
+ }
+
+ fts_close(ftsp);
+ } else
+ for (i = 0; paths[i] != NULL; i++)
+ add_filename(paths[i]);
+}
+
+static acl_t
+remove_invalid_inherit(const char *path, acl_t acl, int l_flag)
+{
+ acl_t acl_new;
+ int acl_brand;
+ acl_entry_t entry;
+ int entry_id;
+ acl_flagset_t flagset;
+ struct stat sb;
+
+ acl_get_brand_np(acl, &acl_brand);
+ if (acl_brand != ACL_BRAND_NFS4)
+ return acl;
+
+ if (l_flag == 1) {
+ if (stat(path, &sb) == -1)
+ return acl;
+ } else
+ if (lstat(path, &sb) == -1)
+ return acl;
+
+ if (S_ISDIR(sb.st_mode) != 0)
+ return acl;
+
+ acl_new = acl_dup(acl);
+
+ entry_id = ACL_FIRST_ENTRY;
+ while (acl_get_entry(acl_new, entry_id, &entry) == 1) {
+ entry_id = ACL_NEXT_ENTRY;
+ acl_get_flagset_np(entry, &flagset);
+ if (acl_get_flag_np(flagset, ACL_ENTRY_INHERIT_ONLY)) {
+ acl_delete_entry(acl_new, entry);
+ continue;
+ }
+ acl_delete_flag_np(flagset, ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT | ACL_ENTRY_NO_PROPAGATE_INHERIT);
+ }
+
+ return acl_new;
+}
+
int
main(int argc, char *argv[])
{
- acl_t acl;
+ acl_t acl, acl_backup;
acl_type_t acl_type;
char filename[PATH_MAX];
- int local_error, carried_error, ch, i, entry_number, ret;
- int h_flag;
+ int local_error, carried_error, ch, entry_number, ret;
+ int h_flag, r_flag, l_flag, big_h_flag;
struct sf_file *file;
struct sf_entry *entry;
- const char *fn_dup;
+ char *fn_dup;
char *end;
+ char **files=NULL;
+ unsigned int numfiles=0;
struct stat sb;
acl_type = ACL_TYPE_ACCESS;
carried_error = local_error = 0;
- h_flag = have_mask = have_stdin = n_flag = need_mask = 0;
+ h_flag = have_mask = have_stdin = n_flag = need_mask = r_flag = l_flag = big_h_flag = 0;
TAILQ_INIT(&entrylist);
TAILQ_INIT(&filelist);
- while ((ch = getopt(argc, argv, "M:X:a:bdhkm:nx:")) != -1)
+ while ((ch = getopt(argc, argv, "HLRM:X:a:bdhkm:nx:")) != -1)
switch(ch) {
case 'M':
entry = zmalloc(sizeof(struct sf_entry));
@@ -167,6 +249,15 @@ main(int argc, char *argv[])
}
TAILQ_INSERT_TAIL(&entrylist, entry, next);
break;
+ case 'R':
+ r_flag = 1;
+ break;
+ case 'L':
+ l_flag = 1;
+ break;
+ case 'H':
+ big_h_flag = 1;
+ break;
default:
usage();
break;
@@ -189,11 +280,18 @@ main(int argc, char *argv[])
fn_dup = strdup(filename);
if (fn_dup == NULL)
err(1, "strdup() failed");
- add_filename(fn_dup);
+ files = realloc(files, ++numfiles * sizeof(char **));
+ if (files == NULL)
+ err(1, "realloc() failed");
+ files[numfiles-1] = (char *)fn_dup;
}
+
+ files = realloc(files, ++numfiles * sizeof(char **));
+ files[numfiles-1] = NULL;
} else
- for (i = 0; i < argc; i++)
- add_filename(argv[i]);
+ files = argv;
+
+ recurse_directory(files, r_flag, l_flag, big_h_flag);
/* cycle through each file */
TAILQ_FOREACH(file, &filelist, next) {
@@ -201,14 +299,12 @@ main(int argc, char *argv[])
if (stat(file->filename, &sb) == -1) {
warn("%s: stat() failed", file->filename);
- carried_error++;
continue;
}
if (acl_type == ACL_TYPE_DEFAULT && S_ISDIR(sb.st_mode) == 0) {
warnx("%s: default ACL may only be set on a directory",
file->filename);
- carried_error++;
continue;
}
@@ -220,7 +316,6 @@ main(int argc, char *argv[])
if (acl_type == ACL_TYPE_DEFAULT) {
warnx("%s: there are no default entries "
"in NFSv4 ACLs", file->filename);
- carried_error++;
continue;
}
acl_type = ACL_TYPE_NFS4;
@@ -243,7 +338,6 @@ main(int argc, char *argv[])
else
warn("%s: acl_get_file() failed",
file->filename);
- carried_error++;
continue;
}
@@ -254,12 +348,24 @@ main(int argc, char *argv[])
switch(entry->op) {
case OP_ADD_ACL:
+ acl_backup = entry->acl;
+ entry->acl = remove_invalid_inherit(file->filename, entry->acl, l_flag);
local_error += add_acl(entry->acl,
entry->entry_number, &acl, file->filename);
+ if (entry->acl != acl_backup) {
+ acl_free(entry->acl);
+ entry->acl = acl_backup;
+ }
break;
case OP_MERGE_ACL:
+ acl_backup = entry->acl;
+ entry->acl = remove_invalid_inherit(file->filename, entry->acl, l_flag);
local_error += merge_acl(entry->acl, &acl,
file->filename);
+ if (entry->acl != acl_backup) {
+ acl_free(entry->acl);
+ entry->acl = acl_backup;
+ }
need_mask = 1;
break;
case OP_REMOVE_EXT:
@@ -267,20 +373,20 @@ main(int argc, char *argv[])
need_mask = 0;
break;
case OP_REMOVE_DEF:
- if (acl_type == ACL_TYPE_NFS4) {
- warnx("%s: there are no default entries in NFSv4 ACLs; "
- "cannot remove", file->filename);
- local_error++;
- break;
- }
- if (acl_delete_def_file(file->filename) == -1) {
- warn("%s: acl_delete_def_file() failed",
- file->filename);
- local_error++;
+ if (acl_type != ACL_TYPE_NFS4) {
+ if (acl_delete_def_file(file->filename) == -1) {
+ warn("%s: acl_delete_def_file() failed",
+ file->filename);
+ local_error++;
+ }
+ if (acl_type == ACL_TYPE_DEFAULT)
+ local_error += remove_default(&acl,
+ file->filename);
+ } else {
+ /* FreeBSD does not support a zero amount of ACL entries like Solaris, give owner@ full permissions */
+ acl_free(acl);
+ acl = acl_from_text("owner@:full_set::allow");
}
- if (acl_type == ACL_TYPE_DEFAULT)
- local_error += remove_default(&acl,
- file->filename);
need_mask = 0;
break;
case OP_REMOVE_ACL:
[-- Attachment #3 --]
--- releng_8_2/src/lib/libc/posix1e/acl_support_nfs4.c 2010-12-21 10:09:25.000000000 -0700
+++ src/lib/libc/posix1e/acl_support_nfs4.c 2011-01-11 10:51:11.000000000 -0700
@@ -144,13 +144,38 @@
while (str != NULL) {
flag = strsep(&str, "/:");
-
found = 0;
- for (i = 0; flags[i].name != NULL; i++) {
- if (strcmp(flags[i].name, flag) == 0) {
+
+ if (flags == a_access_masks && strcmp("full_set", flag) == 0) {
+ for (i = 0; flags[i].name != NULL; i++)
*var |= flags[i].flag;
- found = 1;
- ever_found = 1;
+ found = 1;
+ ever_found = 1;
+ }
+ else if (flags == a_access_masks && strcmp("read_set", flag) == 0) {
+ *var |= (ACL_READ_DATA | ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | ACL_READ_ACL);
+ found = 1;
+ ever_found = 1;
+ }
+ else if (flags == a_access_masks && strcmp("write_set", flag) == 0) {
+ *var |= (ACL_WRITE_DATA | ACL_APPEND_DATA | ACL_WRITE_ATTRIBUTES | ACL_WRITE_NAMED_ATTRS);
+ found = 1;
+ ever_found = 1;
+ }
+ else if (flags == a_access_masks && strcmp("modify_set", flag) == 0) {
+ for (i = 0; flags[i].name != NULL; i++)
+ if (flags[i].flag != ACL_WRITE_ACL || flags[i].flag != ACL_WRITE_OWNER)
+ *var |= flags[i].flag;
+ found = 1;
+ ever_found = 1;
+ }
+ else {
+ for (i = 0; flags[i].name != NULL; i++) {
+ if (strcmp(flags[i].name, flag) == 0) {
+ *var |= flags[i].flag;
+ found = 1;
+ ever_found = 1;
+ }
}
}
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?AANLkTik7D_uzL33M-ABZmM27NpfXrPsuCXvjo2fhE7Ky>