summaryrefslogtreecommitdiffstats
path: root/lib/libc/posix1e
diff options
context:
space:
mode:
Diffstat (limited to 'lib/libc/posix1e')
-rw-r--r--lib/libc/posix1e/acl_calc_mask.c74
-rw-r--r--lib/libc/posix1e/acl_delete.c65
-rw-r--r--lib/libc/posix1e/acl_free.c43
-rw-r--r--lib/libc/posix1e/acl_from_text.c246
-rw-r--r--lib/libc/posix1e/acl_get.c76
-rw-r--r--lib/libc/posix1e/acl_init.c53
-rw-r--r--lib/libc/posix1e/acl_set.c75
-rw-r--r--lib/libc/posix1e/acl_support.c448
-rw-r--r--lib/libc/posix1e/acl_support.h46
-rw-r--r--lib/libc/posix1e/acl_to_text.c244
-rw-r--r--lib/libc/posix1e/acl_valid.c98
11 files changed, 1468 insertions, 0 deletions
diff --git a/lib/libc/posix1e/acl_calc_mask.c b/lib/libc/posix1e/acl_calc_mask.c
new file mode 100644
index 0000000..30ea02e
--- /dev/null
+++ b/lib/libc/posix1e/acl_calc_mask.c
@@ -0,0 +1,74 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_calc_mask(): POSIX.1e routine to recalculate the mask value
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+#include <string.h>
+
+#include "acl_support.h"
+
+/*
+ * POSIX.1e ACL semantics:
+ *
+ * acl_calc_mask(): calculate an ACL_MASK entry for the ACL, then either
+ * insert into the ACL if there is none already, or replace the existing
+ * one.
+ */
+int
+acl_calc_mask(acl_t *acl_p)
+{
+ acl_perm_t perm_union = ACL_PERM_NONE;
+ acl_t acl = *acl_p;
+ int mask_entry = -1;
+ int i;
+
+ if (!acl_posix1e(acl))
+ return (0);
+
+ /* search for ACL_MASK */
+ for (i = 0; i < acl->acl_cnt; i++)
+ if (acl->acl_entry[i].ae_tag == ACL_MASK)
+ mask_entry = i;
+ else
+ perm_union |= acl->acl_entry[i].ae_perm;
+
+ if (mask_entry != -1) {
+ /* already have a mask, replace */
+ acl->acl_entry[mask_entry].ae_perm = perm_union;
+ } else {
+ /* must add a new mask */
+ if (acl_add_entry(acl, ACL_MASK, 0, perm_union) == -1)
+ return (-1);
+ }
+
+ return (0);
+}
diff --git a/lib/libc/posix1e/acl_delete.c b/lib/libc/posix1e/acl_delete.c
new file mode 100644
index 0000000..5b9951f
--- /dev/null
+++ b/lib/libc/posix1e/acl_delete.c
@@ -0,0 +1,65 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_delete_def_file -- remove a default acl from a file
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+
+int
+acl_delete_def_fd(int filedes)
+{
+
+ return (acl_syscall_delete_fd(filedes, ACL_TYPE_DEFAULT));
+}
+
+
+int
+acl_delete_default_file(const char *path_p)
+{
+
+ return (acl_syscall_delete_file(path_p, ACL_TYPE_DEFAULT));
+}
+
+
+int
+acl_delete_file(const char *path_p, acl_type_t type)
+{
+
+ return (acl_syscall_delete_file(path_p, type));
+}
+
+
+int
+acl_delete_fd(int filedes, acl_type_t type)
+{
+
+ return (acl_syscall_delete_fd(filedes, type));
+}
diff --git a/lib/libc/posix1e/acl_free.c b/lib/libc/posix1e/acl_free.c
new file mode 100644
index 0000000..74b7238
--- /dev/null
+++ b/lib/libc/posix1e/acl_free.c
@@ -0,0 +1,43 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_free -- free ACL objects from user memory
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+#include <stdlib.h>
+
+int
+acl_free(void *obj_p)
+{
+
+ free(obj_p);
+ return (0);
+}
diff --git a/lib/libc/posix1e/acl_from_text.c b/lib/libc/posix1e/acl_from_text.c
new file mode 100644
index 0000000..a71bbca
--- /dev/null
+++ b/lib/libc/posix1e/acl_from_text.c
@@ -0,0 +1,246 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_from_text: convert a text-form ACL from a string to an acl_t
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "acl_support.h"
+
+enum PARSE_MODE {
+ PM_BASE, /* initial, begin line, or after , */
+ PM_QUALIFIER, /* in qualifier field */
+ PM_PERM, /* in permission field */
+ PM_COMMENT, /* in comment */
+};
+
+static char *
+string_skip_whitespace(char *string)
+{
+
+ while (*string && ((*string == ' ') || (*string == '\t'))) {
+ string++;
+ }
+ return (string);
+}
+
+static void
+string_trim_trailing_whitespace(char *string)
+{
+ char *end;
+
+ if (*string == '\0')
+ return;
+
+ end = string + strlen(string) - 1;
+
+ while (end != string) {
+ if ((*end == ' ') || (*end == '\t')) {
+ *end = '\0';
+ end--;
+ } else {
+ return;
+ }
+ }
+
+ return;
+}
+
+acl_tag_t
+acl_string_to_tag(char *tag, char *qualifier)
+{
+
+ if (*qualifier == '\0') {
+ if ((!strcmp(tag, "user")) || (!strcmp(tag, "u"))) {
+ return (ACL_USER_OBJ);
+ } else
+ if ((!strcmp(tag, "group")) || (!strcmp(tag, "g"))) {
+ return (ACL_GROUP_OBJ);
+ } else
+ if ((!strcmp(tag, "mask")) || (!strcmp(tag, "m"))) {
+ return (ACL_MASK);
+ } else
+ if ((!strcmp(tag, "other")) || (!strcmp(tag, "o"))) {
+ return (ACL_OTHER);
+ } else
+ return(-1);
+ } else {
+ if ((!strcmp(tag, "user")) || (!strcmp(tag, "u"))) {
+ return(ACL_USER);
+ } else
+ if ((!strcmp(tag, "group")) || (!strcmp(tag, "g"))) {
+ return(ACL_GROUP);
+ } else
+ return(-1);
+ }
+}
+
+/*
+ * acl_from_text -- convert a string into an ACL
+ * postpone most validity checking until the end and cal acl_valid to do
+ * that.
+ */
+acl_t
+acl_from_text(const char *buf_p)
+{
+ acl_tag_t t;
+ acl_perm_t p;
+ acl_t acl;
+ uid_t id;
+ char *mybuf_p, *line, *cur, *notcomment, *comment, *entry;
+ char *tag, *qualifier, *permission;
+ int error;
+
+ /* local copy we can mess up */
+ mybuf_p = strdup(buf_p);
+ if (!mybuf_p) {
+ errno = ENOMEM;
+ return(0);
+ }
+
+ acl = acl_init(3);
+ if (!acl) {
+ free(mybuf_p);
+ errno = ENOMEM;
+ return(0);
+ }
+
+ /* outer loop: delimit at \n boundaries */
+ cur = mybuf_p;
+ while ((line = strsep(&cur, "\n"))) {
+ /* now split the line on the first # to strip out comments */
+ comment = line;
+ notcomment = strsep(&comment, "#");
+
+ /* inner loop: delimit at , boundaries */
+ while ((entry = strsep(&notcomment, ","))) {
+ /* now split into three :-delimited fields */
+ tag = strsep(&entry, ":");
+ if (!tag) {
+ /* printf("no tag\n"); */
+ errno = EINVAL;
+ goto error_label;
+ }
+ tag = string_skip_whitespace(tag);
+ if ((*tag == '\0') && (!entry)) {
+ /*
+ * is an entirely comment line, skip to next
+ * comma
+ */
+ continue;
+ }
+ string_trim_trailing_whitespace(tag);
+
+ qualifier = strsep(&entry, ":");
+ if (!qualifier) {
+ /* printf("no qualifier\n"); */
+ errno = EINVAL;
+ goto error_label;
+ }
+ qualifier = string_skip_whitespace(qualifier);
+ string_trim_trailing_whitespace(qualifier);
+
+ permission = strsep(&entry, ":");
+ if ((!permission) || (entry)) {
+ /* printf("no permission, or more stuff\n"); */
+ errno = EINVAL;
+ goto error_label;
+ }
+ permission = string_skip_whitespace(permission);
+ string_trim_trailing_whitespace(permission);
+
+ /* printf("[%s/%s/%s]\n", tag, qualifier,
+ permission); */
+
+ t = acl_string_to_tag(tag, qualifier);
+ if (t == -1) {
+ errno = EINVAL;
+ goto error_label;
+ }
+
+ error = acl_string_to_perm(permission, &p);
+ if (error == -1) {
+ errno = EINVAL;
+ goto error_label;
+ }
+
+ switch(t) {
+ case ACL_USER_OBJ:
+ case ACL_GROUP_OBJ:
+ case ACL_MASK:
+ case ACL_OTHER:
+ if (*qualifier != '\0') {
+ errno = EINVAL;
+ goto error_label;
+ }
+ id = 0;
+ break;
+
+ case ACL_USER:
+ case ACL_GROUP:
+ error = acl_name_to_id(t, qualifier, &id);
+ if (error == -1)
+ goto error_label;
+ break;
+
+ default:
+ errno = EINVAL;
+ goto error_label;
+ }
+
+ error = acl_add_entry(acl, t, id, p);
+ if (error == -1)
+ goto error_label;
+ }
+ }
+
+#if 0
+ /* XXX should we only return ACLs valid according to acl_valid? */
+ /* verify validity of the ACL we read in */
+ if (acl_valid(acl) == -1) {
+ errno = EINVAL;
+ goto error_label;
+ }
+#endif
+
+ return(acl);
+
+error_label:
+ acl_free(acl);
+ free(mybuf_p);
+ return(0);
+}
+
+
+
diff --git a/lib/libc/posix1e/acl_get.c b/lib/libc/posix1e/acl_get.c
new file mode 100644
index 0000000..3871229
--- /dev/null
+++ b/lib/libc/posix1e/acl_get.c
@@ -0,0 +1,76 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_get_file - syscall wrapper for retrieving ACL by filename
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+#include <stdlib.h>
+
+acl_t
+acl_get_file(const char *path_p, acl_type_t type)
+{
+ struct acl *aclp;
+ int error;
+
+ aclp = acl_init(MAX_ACL_ENTRIES);
+ if (!aclp) {
+ return (0);
+ }
+
+ error = acl_syscall_get_file(path_p, type, aclp);
+ if (error) {
+ acl_free(aclp);
+ return (0);
+ }
+
+ return (aclp);
+}
+
+
+acl_t
+acl_get_fd(int fd, acl_type_t type)
+{
+ struct acl *aclp;
+ int error;
+
+ aclp = acl_init(MAX_ACL_ENTRIES);
+ if (!aclp) {
+ return (0);
+ }
+
+ error = acl_syscall_get_fd(fd, type, aclp);
+ if (error) {
+ acl_free(aclp);
+ return (0);
+ }
+
+ return (aclp);
+}
diff --git a/lib/libc/posix1e/acl_init.c b/lib/libc/posix1e/acl_init.c
new file mode 100644
index 0000000..11308ed
--- /dev/null
+++ b/lib/libc/posix1e/acl_init.c
@@ -0,0 +1,53 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_init -- return a fresh acl structure
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+acl_t
+acl_init(int count)
+{
+ struct acl *acl;
+
+ if (count > MAX_ACL_ENTRIES) {
+ errno = ENOMEM;
+ return (0);
+ }
+
+ acl = (struct acl *) malloc(sizeof(struct acl));
+ bzero(acl, sizeof(struct acl));
+
+ return (acl);
+}
+
diff --git a/lib/libc/posix1e/acl_set.c b/lib/libc/posix1e/acl_set.c
new file mode 100644
index 0000000..6a04328
--- /dev/null
+++ b/lib/libc/posix1e/acl_set.c
@@ -0,0 +1,75 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_set_file -- set a file/directory ACL by name
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <errno.h>
+
+#include "acl_support.h"
+
+/*
+ * For POSIX.1e-semantic ACLs, do a presort so the kernel doesn't have to
+ * (the POSIX.1e semantic code will reject unsorted ACL submission). If it's
+ * not a semantic that the library knows about, just submit it flat and
+ * assume the caller knows what they're up to.
+ */
+int
+acl_set_file(const char *path_p, acl_type_t type, acl_t acl)
+{
+ int error;
+
+ if (acl_posix1e(acl)) {
+ error = acl_sort(acl);
+ if (error) {
+ errno = error;
+ return (-1);
+ }
+ }
+
+ return (acl_syscall_set_file(path_p, type, acl));
+}
+
+
+int
+acl_set_fd(int fd, acl_t acl, acl_type_t type)
+{
+ int error;
+
+ if (acl_posix1e(acl)) {
+ error = acl_sort(acl);
+ if (error) {
+ errno = error;
+ return (-1);
+ }
+ }
+
+ return (acl_syscall_set_fd(fd, type, acl));
+}
diff --git a/lib/libc/posix1e/acl_support.c b/lib/libc/posix1e/acl_support.c
new file mode 100644
index 0000000..22b1710
--- /dev/null
+++ b/lib/libc/posix1e/acl_support.c
@@ -0,0 +1,448 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * Support functionality for the POSIX.1e ACL interface
+ * These calls are intended only to be called within the library.
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <errno.h>
+#include <grp.h>
+#include <pwd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "acl_support.h"
+
+#define ACL_STRING_PERM_WRITE 'w'
+#define ACL_STRING_PERM_READ 'r'
+#define ACL_STRING_PERM_EXEC 'x'
+#define ACL_STRING_PERM_NONE '-'
+
+/*
+ * acl_entry_compare -- compare two acl_entry structures to determine the
+ * order they should appear in. Used by acl_sort to sort ACL entries into
+ * the kernel-desired order -- i.e., the order useful for evaluation and
+ * O(n) validity checking. Beter to have an O(nlogn) sort in userland and
+ * an O(n) in kernel than to have both in kernel.
+ */
+typedef int (*compare)(const void *, const void *);
+static int
+acl_entry_compare(struct acl_entry *a, struct acl_entry *b)
+{
+ /*
+ * First, sort between tags -- conveniently defined in the correct
+ * order for verification.
+ */
+ if (a->ae_tag < b->ae_tag)
+ return (-1);
+ if (a->ae_tag > b->ae_tag)
+ return (1);
+
+ /*
+ * Next compare uids/gids on appropriate types.
+ */
+
+ if (a->ae_tag == ACL_USER || a->ae_tag == ACL_GROUP) {
+ if (a->ae_id < b->ae_id)
+ return (-1);
+ if (a->ae_id > b->ae_id)
+ return (1);
+
+ /* shouldn't be equal, fall through to the invalid case */
+ }
+
+ /*
+ * Don't know how to sort multiple entries of the rest--either it's
+ * a bad entry, or there shouldn't be more than one. Ignore and the
+ * validity checker can get it later.
+ */
+ return (0);
+}
+
+
+/*
+ * acl_sort -- sort ACL entries.
+ * Give the opportunity to fail, althouh we don't currently have a way
+ * to fail.
+ */
+int
+acl_sort(acl_t acl)
+{
+
+ qsort(&acl->acl_entry[0], acl->acl_cnt, sizeof(struct acl_entry),
+ (compare) acl_entry_compare);
+
+ return (0);
+}
+
+
+/*
+ * acl_posix1e -- use a heuristic to determine if this is a POSIX.1e
+ * semantics ACL. This will be used by other routines to determine if
+ * they should call acl_sort() on the ACL before submitting to the kernel,
+ * as the POSIX.1e ACL semantics code requires sorted ACL submission.
+ * Also, acl_valid will use this to determine if it understands the
+ * semantics enough to check that the ACL is correct.
+ */
+int
+acl_posix1e(acl_t acl)
+{
+ int i;
+
+ /* assume it's POSIX.1e, and return 0 if otherwise */
+
+ for (i = 0; i < acl->acl_cnt; i++) {
+ /* is the tag type POSIX.1e? */
+ switch(acl->acl_entry[i].ae_tag) {
+ case ACL_USER_OBJ:
+ case ACL_USER:
+ case ACL_GROUP_OBJ:
+ case ACL_GROUP:
+ case ACL_MASK:
+ case ACL_OTHER:
+ break;
+
+ default:
+ return (0);
+ }
+
+ /* are the permissions POSIX.1e, or FreeBSD extensions? */
+ if (((acl->acl_entry[i].ae_perm | ACL_POSIX1E_BITS) !=
+ ACL_POSIX1E_BITS) &&
+ ((acl->acl_entry[i].ae_perm | ACL_PERM_BITS) !=
+ ACL_PERM_BITS))
+ return (0);
+ }
+
+ return(1);
+}
+
+
+/*
+ * acl_check -- given an ACL, check its validity. This is mirrored from
+ * code in sys/kern/kern_acl.c, and if changes are made in one, they should
+ * be made in the other also. This copy of acl_check is made available
+ * in userland for the benefit of processes wanting to check ACLs for
+ * validity before submitting them to the kernel, or for performing
+ * in userland file system checking. Needless to say, the kernel makes
+ * the real checks on calls to get/setacl.
+ *
+ * See the comments in kernel for explanation -- just briefly, it assumes
+ * an already sorted ACL, and checks based on that assumption. The
+ * POSIX.1e interface, acl_valid(), will perform the sort before calling
+ * this. Returns 0 on success, EINVAL on failure.
+ */
+int
+acl_check(struct acl *acl)
+{
+ struct acl_entry *entry; /* current entry */
+ uid_t obj_uid=-1, obj_gid=-1, highest_uid=0, highest_gid=0;
+ int stage = ACL_USER_OBJ;
+ int i = 0;
+ int count_user_obj=0, count_user=0, count_group_obj=0,
+ count_group=0, count_mask=0, count_other=0;
+
+ /* printf("acl_check: checking acl with %d entries\n", acl->acl_cnt); */
+ while (i < acl->acl_cnt) {
+
+ entry = &acl->acl_entry[i];
+
+ if ((entry->ae_perm | ACL_PERM_BITS) != ACL_PERM_BITS)
+ return (EINVAL);
+
+ switch(entry->ae_tag) {
+ case ACL_USER_OBJ:
+ /* printf("acl_check: %d: ACL_USER_OBJ\n", i); */
+ if (stage > ACL_USER_OBJ)
+ return (EINVAL);
+ stage = ACL_USER;
+ count_user_obj++;
+ obj_uid = entry->ae_id;
+ break;
+
+ case ACL_USER:
+ /* printf("acl_check: %d: ACL_USER\n", i); */
+ if (stage > ACL_USER)
+ return (EINVAL);
+ stage = ACL_USER;
+ if (entry->ae_id == obj_uid)
+ return (EINVAL);
+ if (count_user && (entry->ae_id <= highest_uid))
+ return (EINVAL);
+ highest_uid = entry->ae_id;
+ count_user++;
+ break;
+
+ case ACL_GROUP_OBJ:
+ /* printf("acl_check: %d: ACL_GROUP_OBJ\n", i); */
+ if (stage > ACL_GROUP_OBJ)
+ return (EINVAL);
+ stage = ACL_GROUP;
+ count_group_obj++;
+ obj_gid = entry->ae_id;
+ break;
+
+ case ACL_GROUP:
+ /* printf("acl_check: %d: ACL_GROUP\n", i); */
+ if (stage > ACL_GROUP)
+ return (EINVAL);
+ stage = ACL_GROUP;
+ if (entry->ae_id == obj_gid)
+ return (EINVAL);
+ if (count_group && (entry->ae_id <= highest_gid))
+ return (EINVAL);
+ highest_gid = entry->ae_id;
+ count_group++;
+ break;
+
+ case ACL_MASK:
+ /* printf("acl_check: %d: ACL_MASK\n", i); */
+ if (stage > ACL_MASK)
+ return (EINVAL);
+ stage = ACL_MASK;
+ count_mask++;
+ break;
+
+ case ACL_OTHER:
+ /* printf("acl_check: %d: ACL_OTHER\n", i); */
+ if (stage > ACL_OTHER)
+ return (EINVAL);
+ stage = ACL_OTHER;
+ count_other++;
+ break;
+
+ default:
+ /* printf("acl_check: %d: INVALID\n", i); */
+ return (EINVAL);
+ }
+ i++;
+ }
+
+ if (count_user_obj != 1)
+ return (EINVAL);
+
+ if (count_group_obj != 1)
+ return (EINVAL);
+
+ if (count_mask != 0 && count_mask != 1)
+ return (EINVAL);
+
+ if (count_other != 1)
+ return (EINVAL);
+
+ return (0);
+}
+
+
+/*
+ * Given a uid/gid, return a username/groupname for the text form of an ACL
+ * XXX NOT THREAD SAFE, RELIES ON GETPWUID, GETGRGID
+ * XXX USES *PW* AND *GR* WHICH ARE STATEFUL AND THEREFORE THIS ROUTINE
+ * MAY HAVE SIDE-EFFECTS
+ */
+int
+acl_id_to_name(acl_tag_t tag, uid_t id, ssize_t buf_len, char *buf)
+{
+ struct group *g;
+ struct passwd *p;
+ int i;
+
+ switch(tag) {
+ case ACL_USER:
+ p = getpwuid(id);
+ if (!p)
+ i = snprintf(buf, buf_len, "%d", id);
+ else
+ i = snprintf(buf, buf_len, "%s", p->pw_name);
+
+ if (i >= buf_len) {
+ errno = ENOMEM;
+ return (-1);
+ }
+ return (0);
+
+ case ACL_GROUP:
+ g = getgrgid(id);
+ if (!g)
+ i = snprintf(buf, buf_len, "%d", id);
+ else
+ i = snprintf(buf, buf_len, "%s", g->gr_name);
+
+ if (i >= buf_len) {
+ errno = ENOMEM;
+ return (-1);
+ }
+ return (0);
+
+ default:
+ return (EINVAL);
+ }
+}
+
+
+/*
+ * Given a username/groupname from a text form of an ACL, return the uid/gid
+ * XXX NOT THREAD SAFE, RELIES ON GETPWNAM, GETGRNAM
+ * XXX USES *PW* AND *GR* WHICH ARE STATEFUL AND THEREFORE THIS ROUTINE
+ * MAY HAVE SIDE-EFFECTS
+ *
+ * XXX currently doesn't deal correctly with a numeric uid being passed
+ * instead of a username. What is correct behavior here? Check chown.
+ */
+int
+acl_name_to_id(acl_tag_t tag, char *name, uid_t *id)
+{
+ struct group *g;
+ struct passwd *p;
+
+ switch(tag) {
+ case ACL_USER:
+ p = getpwnam(name);
+ if (!p) {
+ errno = EINVAL;
+ return (-1);
+ }
+ *id = p->pw_uid;
+ return (0);
+
+ case ACL_GROUP:
+ g = getgrnam(name);
+ if (g) {
+ errno = EINVAL;
+ return (-1);
+ }
+ *id = g->gr_gid;
+ return (0);
+
+ default:
+ return (EINVAL);
+ }
+}
+
+
+/*
+ * Given a right-shifted permission (i.e., direct ACL_PERM_* mask), fill
+ * in a string describing the permissions.
+ */
+int
+acl_perm_to_string(acl_perm_t perm, ssize_t buf_len, char *buf)
+{
+
+ if (buf_len < ACL_STRING_PERM_MAXSIZE + 1) {
+ errno = ENOMEM;
+ return (-1);
+ }
+
+ if ((perm | ACL_PERM_BITS) != ACL_PERM_BITS) {
+ errno = EINVAL;
+ return (-1);
+ }
+
+ buf[3] = 0; /* null terminate */
+
+ if (perm & ACL_PERM_READ)
+ buf[0] = ACL_STRING_PERM_READ;
+ else
+ buf[0] = ACL_STRING_PERM_NONE;
+
+ if (perm & ACL_PERM_WRITE)
+ buf[1] = ACL_STRING_PERM_WRITE;
+ else
+ buf[1] = ACL_STRING_PERM_NONE;
+
+ if (perm & ACL_PERM_EXEC)
+ buf[2] = ACL_STRING_PERM_EXEC;
+ else
+ buf[2] = ACL_STRING_PERM_NONE;
+
+ return (0);
+}
+
+
+/*
+ * given a string, return a permission describing it
+ */
+int
+acl_string_to_perm(char *string, acl_perm_t *perm)
+{
+ acl_perm_t myperm = ACL_PERM_NONE;
+ char *ch;
+
+ ch = string;
+ while (*ch) {
+ switch(*ch) {
+ case ACL_STRING_PERM_READ:
+ myperm |= ACL_PERM_READ;
+ break;
+ case ACL_STRING_PERM_WRITE:
+ myperm |= ACL_PERM_WRITE;
+ break;
+ case ACL_STRING_PERM_EXEC:
+ myperm |= ACL_PERM_EXEC;
+ break;
+ case ACL_STRING_PERM_NONE:
+ break;
+ default:
+ return (EINVAL);
+ }
+ ch++;
+ }
+
+ *perm = myperm;
+ return (0);
+}
+
+
+
+/*
+ * Add an ACL entry without doing much checking, et al
+ */
+int
+acl_add_entry(acl_t acl, acl_tag_t tag, uid_t id, acl_perm_t perm)
+{
+ struct acl_entry *e;
+
+ if (acl->acl_cnt >= MAX_ACL_ENTRIES) {
+ errno = ENOMEM;
+ return (-1);
+ }
+
+ e = &(acl->acl_entry[acl->acl_cnt]);
+ e->ae_perm = perm;
+ e->ae_tag = tag;
+ e->ae_id = id;
+ acl->acl_cnt++;
+
+ return (0);
+}
+
+
+
+
diff --git a/lib/libc/posix1e/acl_support.h b/lib/libc/posix1e/acl_support.h
new file mode 100644
index 0000000..237dd84
--- /dev/null
+++ b/lib/libc/posix1e/acl_support.h
@@ -0,0 +1,46 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * Support functionality for the POSIX.1e ACL interface
+ * These calls are intended only to be called within the library.
+ */
+#ifndef _ACL_SUPPORT_H
+#define _ACL_SUPPORT_H
+
+#define ACL_STRING_PERM_MAXSIZE 3 /* read, write, exec */
+
+int acl_check(struct acl *acl);
+int acl_sort(acl_t acl);
+int acl_posix1e(acl_t acl);
+int acl_id_to_name(acl_tag_t tag, uid_t id, ssize_t buf_len, char *buf);
+int acl_name_to_id(acl_tag_t tag, char *name, uid_t *id);
+int acl_perm_to_string(acl_perm_t perm, ssize_t buf_len, char *buf);
+int acl_string_to_perm(char *string, acl_perm_t *perm);
+int acl_add_entry(acl_t acl, acl_tag_t tag, uid_t id, acl_perm_t perm);
+
+#endif
diff --git a/lib/libc/posix1e/acl_to_text.c b/lib/libc/posix1e/acl_to_text.c
new file mode 100644
index 0000000..566a507
--- /dev/null
+++ b/lib/libc/posix1e/acl_to_text.c
@@ -0,0 +1,244 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_to_text - return a text string with a text representation of the acl
+ * in it.
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <utmp.h>
+
+#include "acl_support.h"
+
+
+/*
+ * acl_to_text - generate a text form of an acl
+ * spec says nothing about output ordering, so leave in acl order
+ *
+ * For the time-being, reject the printing of ACLs that aren't an
+ * understood semantic. Later on, we might want to try and have a
+ * generic printing mechanism...
+ */
+char *
+acl_to_text(acl_t acl, ssize_t *len_p)
+{
+ char *buf, *tmpbuf;
+ char name_buf[UT_NAMESIZE+1];
+ char perm_buf[ACL_STRING_PERM_MAXSIZE+1],
+ effective_perm_buf[ACL_STRING_PERM_MAXSIZE+1];
+ int i, error, len;
+ uid_t ae_id;
+ acl_tag_t ae_tag;
+ acl_perm_t ae_perm, effective_perm, mask_perm;
+
+ if (!acl_posix1e(acl)) {
+ errno = EINVAL;
+ return (0);
+ }
+
+ buf = strdup("");
+
+ mask_perm = ACL_PERM_BITS; /* effective is regular if no mask */
+ for (i = 0; i < acl->acl_cnt; i++)
+ if (acl->acl_entry[i].ae_tag == ACL_MASK)
+ mask_perm = acl->acl_entry[i].ae_perm;
+
+ for (i = 0; i < acl->acl_cnt; i++) {
+ ae_tag = acl->acl_entry[i].ae_tag;
+ ae_id = acl->acl_entry[i].ae_id;
+ ae_perm = acl->acl_entry[i].ae_perm;
+
+ switch(ae_tag) {
+ case ACL_USER_OBJ:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+ len = asprintf(&tmpbuf, "%suser::%s\n", buf,
+ perm_buf);
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ case ACL_USER:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+
+ error = acl_id_to_name(ae_tag, ae_id, UT_NAMESIZE+1,
+ name_buf);
+ if (error)
+ goto error_label;
+
+ effective_perm = ae_perm & mask_perm;
+ if (effective_perm != ae_perm) {
+ error = acl_perm_to_string(effective_perm,
+ ACL_STRING_PERM_MAXSIZE+1,
+ effective_perm_buf);
+ if (error)
+ goto error_label;
+ len = asprintf(&tmpbuf, "%suser:%s:%s\t\t# "
+ "effective: %s\n",
+ buf, name_buf, perm_buf,
+ effective_perm_buf);
+ } else {
+ len = asprintf(&tmpbuf, "%suser:%s:%s\n", buf,
+ name_buf, perm_buf);
+ }
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ case ACL_GROUP_OBJ:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+
+ effective_perm = ae_perm & mask_perm;
+ if (effective_perm != ae_perm) {
+ error = acl_perm_to_string(effective_perm,
+ ACL_STRING_PERM_MAXSIZE+1,
+ effective_perm_buf);
+ if (error)
+ goto error_label;
+ len = asprintf(&tmpbuf, "%sgroup::%s\t\t# "
+ "effective: %s\n",
+ buf, perm_buf, effective_perm_buf);
+ } else {
+ len = asprintf(&tmpbuf, "%sgroup::%s\n", buf,
+ perm_buf);
+ }
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ case ACL_GROUP:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+
+ error = acl_id_to_name(ae_tag, ae_id, UT_NAMESIZE+1,
+ name_buf);
+ if (error)
+ goto error_label;
+
+ effective_perm = ae_perm & mask_perm;
+ if (effective_perm != ae_perm) {
+ error = acl_perm_to_string(effective_perm,
+ ACL_STRING_PERM_MAXSIZE+1,
+ effective_perm_buf);
+ if (error)
+ goto error_label;
+ len = asprintf(&tmpbuf, "%sgroup::%s\t\t# "
+ "effective: %s\n",
+ buf, perm_buf, effective_perm_buf);
+ } else {
+ len = asprintf(&tmpbuf, "%sgroup:%s:%s\n", buf,
+ name_buf, perm_buf);
+ }
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ case ACL_MASK:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+
+ len = asprintf(&tmpbuf, "%smask::%s\n", buf,
+ perm_buf);
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ case ACL_OTHER:
+ error = acl_perm_to_string(ae_perm,
+ ACL_STRING_PERM_MAXSIZE+1, perm_buf);
+ if (error)
+ goto error_label;
+
+ len = asprintf(&tmpbuf, "%sother::%s\n", buf,
+ perm_buf);
+ if (len == -1) {
+ errno = ENOMEM;
+ goto error_label;
+ }
+ free(buf);
+ buf = tmpbuf;
+ break;
+
+ default:
+ free(buf);
+ errno = EINVAL;
+ return (0);
+ }
+ }
+
+ if (len_p) {
+ *len_p = strlen(buf);
+ }
+ return (buf);
+
+error_label:
+ /* jump to here sets errno already, we just clean up */
+ if (buf) free(buf);
+ return (0);
+}
+
+
+
+
diff --git a/lib/libc/posix1e/acl_valid.c b/lib/libc/posix1e/acl_valid.c
new file mode 100644
index 0000000..683525e
--- /dev/null
+++ b/lib/libc/posix1e/acl_valid.c
@@ -0,0 +1,98 @@
+/*-
+ * Copyright (c) 1999 Robert N. M. Watson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+/*
+ * acl_valid -- POSIX.1e ACL check routine
+ */
+
+#include <sys/types.h>
+#include <sys/acl.h>
+#include <sys/errno.h>
+
+#include "acl_support.h"
+
+/*
+ * acl_valid: accepts an ACL, returns 0 on valid ACL, -1 for invalid,
+ * and errno set to EINVAL.
+ *
+ * Implemented by calling the acl_check routine in acl_support, which
+ * requires ordering. We call acl_support's acl_sort to make this
+ * true.
+ *
+ * POSIX.1e allows acl_valid() to reorder the ACL as it sees fit.
+ *
+ * This call is deprecated, as it doesn't ask whether the ACL is valid
+ * for a particular target.
+ */
+int
+acl_valid(acl_t acl)
+{
+ int error;
+
+ acl_sort(acl);
+ error = acl_check(acl);
+ if (error) {
+ errno = error;
+ return (-1);
+ } else {
+ return (0);
+ }
+}
+
+
+int
+acl_valid_file(const char *pathp, acl_type_t type, acl_t acl)
+{
+ int error;
+
+ if (acl_posix1e(acl)) {
+ error = acl_sort(acl);
+ if (error) {
+ errno = error;
+ return (-1);
+ }
+ }
+
+ return (acl_syscall_aclcheck_file(pathp, type, acl));
+}
+
+
+int
+acl_valid_fd(int fd, acl_type_t type, acl_t acl)
+{
+ int error;
+
+ if (acl_posix1e(acl)) {
+ error = acl_sort(acl);
+ if (error) {
+ errno = error;
+ return (-1);
+ }
+ }
+
+ return (acl_syscall_aclcheck_fd(fd, type, acl));
+}
OpenPOWER on IntegriCloud