tmpfiles: add 'a' type to set ACLs

[elogind.git] / src / shared / acl-util.c

diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c
index d1eb6f226876813b403e2520346e47722c44b8f2..22bb8444e5d1c5512f31603da1ec855ac5fa22c3 100644 (file)
--- a/src/shared/acl-util.c
+++ b/src/shared/acl-util.c
@@ -3,7 +3,7 @@
 /***
   This file is part of systemd.
 
 /***
   This file is part of systemd.
 

-  Copyright 2011 Lennart Poettering
+  Copyright 2011,2013 Lennart Poettering

 
   systemd is free software; you can redistribute it and/or modify it
   under the terms of the GNU Lesser General Public License as published by
 
   systemd is free software; you can redistribute it and/or modify it
   under the terms of the GNU Lesser General Public License as published by


@@ -20,12 +20,12 @@
 ***/
 
 #include <assert.h>
 ***/
 
 #include <assert.h>

-#include <sys/acl.h>
-#include <acl/libacl.h>

 #include <errno.h>
 #include <stdbool.h>
 
 #include "acl-util.h"
 #include <errno.h>
 #include <stdbool.h>
 
 #include "acl-util.h"

+#include "util.h"
+#include "strv.h"

 
 int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
         acl_entry_t i;
 
 int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
         acl_entry_t i;


@@ -66,3 +66,150 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
 
         return 0;
 }
 
         return 0;
 }

+
+int calc_acl_mask_if_needed(acl_t *acl_p) {
+        acl_entry_t i;
+        int found;
+
+        assert(acl_p);
+
+        for (found = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i);
+             found > 0;
+             found = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) {
+
+                acl_tag_t tag;
+
+                if (acl_get_tag_type(i, &tag) < 0)
+                        return -errno;
+
+                if (tag == ACL_MASK)
+                        return 0;
+        }
+
+        if (found < 0)
+                return -errno;
+
+        if (acl_calc_mask(acl_p) < 0)
+                return -errno;
+
+        return 0;
+}
+
+int search_acl_groups(char*** dst, const char* path, bool* belong) {
+        acl_t acl;
+
+        assert(path);
+        assert(belong);
+
+        acl = acl_get_file(path, ACL_TYPE_DEFAULT);
+        if (acl) {
+                acl_entry_t entry;
+                int r;
+
+                r = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
+                while (r > 0) {
+                        acl_tag_t tag;
+                        gid_t *gid;
+                        char *name;
+
+                        r = acl_get_tag_type(entry, &tag);
+                        if (r < 0)
+                                break;
+
+                        if (tag != ACL_GROUP)
+                                goto next;
+
+                        gid = acl_get_qualifier(entry);
+                        if (!gid)
+                                break;
+
+                        if (in_gid(*gid) > 0) {
+                                *belong = true;
+                                break;
+                        }
+
+                        name = gid_to_name(*gid);
+                        if (!name) {
+                                acl_free(acl);
+                                return log_oom();
+                        }
+
+                        r = strv_consume(dst, name);
+                        if (r < 0) {
+                                acl_free(acl);
+                                return log_oom();
+                        }
+
+                next:
+                        r = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
+                }
+
+                acl_free(acl);
+        }
+
+        return 0;
+}
+
+int parse_acl(char *text, acl_t *acl_access, acl_t *acl_default) {
+        _cleanup_free_ char **a = NULL, **d = NULL; /* strings are not be freed */
+        _cleanup_strv_free_ char **split;
+        char **entry;
+        int r = -EINVAL;
+        _cleanup_(acl_freep) acl_t a_acl = NULL, d_acl = NULL;
+
+        split = strv_split(text, ",");
+        if (!split)
+                return log_oom();
+
+        STRV_FOREACH(entry, split) {
+                char *p;
+
+                p = startswith(*entry, "default:");
+                if (!p)
+                        p = startswith(*entry, "d:");
+
+                if (p)
+                        r = strv_push(&d, p);
+                else
+                        r = strv_push(&a, *entry);
+        }
+        if (r < 0)
+                return r;
+
+        if (!strv_isempty(a)) {
+                _cleanup_free_ char *join;
+
+                join = strv_join(a, ",");
+                if (!join)
+                        return -ENOMEM;
+
+                a_acl = acl_from_text(join);
+                if (!a_acl)
+                        return -EINVAL;
+
+                r = calc_acl_mask_if_needed(&a_acl);
+                if (r < 0)
+                        return r;
+        }
+
+        if (!strv_isempty(d)) {
+                _cleanup_free_ char *join;
+
+                join = strv_join(d, ",");
+                if (!join)
+                        return -ENOMEM;
+
+                d_acl = acl_from_text(join);
+                if (!d_acl)
+                        return -EINVAL;
+
+                r = calc_acl_mask_if_needed(&d_acl);
+                if (r < 0)
+                        return r;
+        }
+
+        *acl_access = a_acl;
+        *acl_default = d_acl;
+        a_acl = d_acl = NULL;
+        return 0;
+}