X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/13710874ce907cd9405f83814cbebbe73f884e2e..cb197514d99d17dc3a1ce26ff8918d63307d75e4:/acls.c diff --git a/acls.c b/acls.c index cf79251d..105b9855 100644 --- a/acls.c +++ b/acls.c @@ -3,7 +3,7 @@ * * Copyright (C) 1996 Andrew Tridgell * Copyright (C) 1996 Paul Mackerras - * Copyright (C) 2006 Wayne Davison + * Copyright (C) 2006-2009 Wayne Davison * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -88,13 +88,26 @@ static const rsync_acl empty_rsync_acl = { static item_list access_acl_list = EMPTY_ITEM_LIST; static item_list default_acl_list = EMPTY_ITEM_LIST; +static size_t prior_access_count = (size_t)-1; +static size_t prior_default_count = (size_t)-1; + /* === Calculations on ACL types === */ static const char *str_acl_type(SMB_ACL_TYPE_T type) { - return type == SMB_ACL_TYPE_ACCESS ? "SMB_ACL_TYPE_ACCESS" - : type == SMB_ACL_TYPE_DEFAULT ? "SMB_ACL_TYPE_DEFAULT" - : "unknown SMB_ACL_TYPE_T"; + switch (type) { + case SMB_ACL_TYPE_ACCESS: +#ifdef HAVE_OSX_ACLS + return "ACL_TYPE_EXTENDED"; +#else + return "ACL_TYPE_ACCESS"; +#endif + case SMB_ACL_TYPE_DEFAULT: + return "ACL_TYPE_DEFAULT"; + default: + break; + } + return "unknown ACL type!"; } static int calc_sacl_entries(const rsync_acl *racl) @@ -127,7 +140,8 @@ static void rsync_acl_strip_perms(rsync_acl *racl) else { if (racl->group_obj == racl->mask_obj) racl->group_obj = NO_ENTRY; - racl->mask_obj = NO_ENTRY; + if (racl->names.count != 0) + racl->mask_obj = NO_ENTRY; } racl->other_obj = NO_ENTRY; } @@ -252,35 +266,27 @@ static BOOL unpack_smb_acl(SMB_ACL_T sacl, rsync_acl *racl) rc = sys_acl_get_entry(sacl, SMB_ACL_NEXT_ENTRY, &entry)) { SMB_ACL_TAG_T tag_type; uint32 access; - void *qualifier; + id_t g_u_id; id_access *ida; - if ((rc = sys_acl_get_tag_type(entry, &tag_type)) != 0) { - errfun = "sys_acl_get_tag_type"; - break; - } - if ((rc = sys_acl_get_access_bits(entry, &access)) != 0) { - errfun = "sys_acl_get_access_bits"; + if ((rc = sys_acl_get_info(entry, &tag_type, &access, &g_u_id)) != 0) { + errfun = "sys_acl_get_info"; break; } /* continue == done with entry; break == store in temporary ida list */ switch (tag_type) { +#ifndef HAVE_OSX_ACLS case SMB_ACL_USER_OBJ: if (racl->user_obj == NO_ENTRY) racl->user_obj = access; else rprintf(FINFO, "unpack_smb_acl: warning: duplicate USER_OBJ entry ignored\n"); continue; - case SMB_ACL_USER: - access |= NAME_IS_USER; - break; case SMB_ACL_GROUP_OBJ: if (racl->group_obj == NO_ENTRY) racl->group_obj = access; else rprintf(FINFO, "unpack_smb_acl: warning: duplicate GROUP_OBJ entry ignored\n"); continue; - case SMB_ACL_GROUP: - break; case SMB_ACL_MASK: if (racl->mask_obj == NO_ENTRY) racl->mask_obj = access; @@ -293,22 +299,22 @@ static BOOL unpack_smb_acl(SMB_ACL_T sacl, rsync_acl *racl) else rprintf(FINFO, "unpack_smb_acl: warning: duplicate OTHER entry ignored\n"); continue; +#endif + case SMB_ACL_USER: + access |= NAME_IS_USER; + break; + case SMB_ACL_GROUP: + break; default: rprintf(FINFO, "unpack_smb_acl: warning: entry with unrecognized tag type ignored\n"); continue; } - if (!(qualifier = sys_acl_get_qualifier(entry))) { - errfun = "sys_acl_get_tag_type"; - rc = EINVAL; - break; - } ida = EXPAND_ITEM_LIST(&temp_ida_list, id_access, -10); - ida->id = *((id_t *)qualifier); + ida->id = g_u_id; ida->access = access; - sys_acl_free_qualifier(qualifier, tag_type); } if (rc) { - rsyserr(FERROR, errno, "unpack_smb_acl: %s()", errfun); + rsyserr(FERROR_XFER, errno, "unpack_smb_acl: %s()", errfun); rsync_acl_free(racl); return False; } @@ -359,15 +365,17 @@ static BOOL unpack_smb_acl(SMB_ACL_T sacl, rsync_acl *racl) #define COE(func,args) CALL_OR_ERROR(func,args,#func) #define COE2(func,args) CALL_OR_ERROR(func,args,NULL) +#ifndef HAVE_OSX_ACLS /* Store the permissions in the system ACL entry. */ static int store_access_in_entry(uint32 access, SMB_ACL_ENTRY_T entry) { if (sys_acl_set_access_bits(entry, access)) { - rsyserr(FERROR, errno, "store_access_in_entry sys_acl_set_access_bits()"); + rsyserr(FERROR_XFER, errno, "store_access_in_entry sys_acl_set_access_bits()"); return -1; } return 0; } +#endif /* Pack rsync ACL -> system ACL verbatim. Return whether we succeeded. */ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl) @@ -381,13 +389,14 @@ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl) SMB_ACL_ENTRY_T entry; if (!(*smb_acl = sys_acl_init(calc_sacl_entries(racl)))) { - rsyserr(FERROR, errno, "pack_smb_acl: sys_acl_init()"); + rsyserr(FERROR_XFER, errno, "pack_smb_acl: sys_acl_init()"); return False; } +#ifndef HAVE_OSX_ACLS COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_USER_OBJ) ); - COE2( store_access_in_entry,(racl->user_obj & ~NO_ENTRY, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_USER_OBJ, racl->user_obj & ~NO_ENTRY, 0) ); +#endif for (ida = racl->names.idas, count = racl->names.count; count; ida++, count--) { #ifdef SMB_ACL_NEED_SORT @@ -395,56 +404,48 @@ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl) break; #endif COE( sys_acl_create_entry,(smb_acl, &entry) ); -#ifdef SMB_ACL_NEED_SORT - COE( sys_acl_set_tag_type,(entry, SMB_ACL_USER) ); -#else - COE( sys_acl_set_tag_type,(entry, ida->access & NAME_IS_USER - ? SMB_ACL_USER : SMB_ACL_GROUP) ); -#endif - COE( sys_acl_set_qualifier,(entry, (void*)&ida->id) ); - COE2( store_access_in_entry,(ida->access & ~NAME_IS_USER, entry) ); + COE( sys_acl_set_info, + (entry, + ida->access & NAME_IS_USER ? SMB_ACL_USER : SMB_ACL_GROUP, + ida->access & ~NAME_IS_USER, ida->id) ); } +#ifndef HAVE_OSX_ACLS COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_GROUP_OBJ) ); - COE2( store_access_in_entry,(racl->group_obj & ~NO_ENTRY, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_GROUP_OBJ, racl->group_obj & ~NO_ENTRY, 0) ); #ifdef SMB_ACL_NEED_SORT for ( ; count; ida++, count--) { COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_GROUP) ); - COE( sys_acl_set_qualifier,(entry, (void*)&ida->id) ); - COE2( store_access_in_entry,(ida->access, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_GROUP, ida->access, ida->id) ); } #endif #ifdef ACLS_NEED_MASK mask_bits = racl->mask_obj == NO_ENTRY ? racl->group_obj & ~NO_ENTRY : racl->mask_obj; COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_MASK) ); - COE2( store_access_in_entry,(mask_bits, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_MASK, mask_bits, NULL) ); #else if (racl->mask_obj != NO_ENTRY) { COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_MASK) ); - COE2( store_access_in_entry,(racl->mask_obj, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_MASK, racl->mask_obj, 0) ); } #endif COE( sys_acl_create_entry,(smb_acl, &entry) ); - COE( sys_acl_set_tag_type,(entry, SMB_ACL_OTHER) ); - COE2( store_access_in_entry,(racl->other_obj & ~NO_ENTRY, entry) ); + COE( sys_acl_set_info,(entry, SMB_ACL_OTHER, racl->other_obj & ~NO_ENTRY, 0) ); +#endif #ifdef DEBUG if (sys_acl_valid(*smb_acl) < 0) - rprintf(FERROR, "pack_smb_acl: warning: system says the ACL I packed is invalid\n"); + rprintf(FERROR_XFER, "pack_smb_acl: warning: system says the ACL I packed is invalid\n"); #endif return True; error_exit: if (errfun) { - rsyserr(FERROR, errno, "pack_smb_acl %s()", errfun); + rsyserr(FERROR_XFER, errno, "pack_smb_acl %s()", errfun); } sys_acl_free_acl(*smb_acl); return False; @@ -477,9 +478,45 @@ static int find_matching_rsync_acl(const rsync_acl *racl, SMB_ACL_TYPE_T type, static int get_rsync_acl(const char *fname, rsync_acl *racl, SMB_ACL_TYPE_T type, mode_t mode) { - SMB_ACL_T sacl = sys_acl_get_file(fname, type); + SMB_ACL_T sacl; + +#ifdef SUPPORT_XATTRS + /* --fake-super support: load ACLs from an xattr. */ + if (am_root < 0) { + char *buf; + size_t len; + int cnt; + + if ((buf = get_xattr_acl(fname, type == SMB_ACL_TYPE_ACCESS, &len)) == NULL) + return 0; + cnt = (len - 4*4) / (4+4); + if (len < 4*4 || len != (size_t)cnt*(4+4) + 4*4) { + free(buf); + return -1; + } + + racl->user_obj = IVAL(buf, 0); + racl->group_obj = IVAL(buf, 4); + racl->mask_obj = IVAL(buf, 8); + racl->other_obj = IVAL(buf, 12); + + if (cnt) { + char *bp = buf + 4*4; + id_access *ida; + if (!(ida = racl->names.idas = new_array(id_access, cnt))) + out_of_memory("get_rsync_acl"); + racl->names.count = cnt; + for ( ; cnt--; ida++, bp += 4+4) { + ida->id = IVAL(bp, 0); + ida->access = IVAL(bp, 4); + } + } + free(buf); + return 0; + } +#endif - if (sacl) { + if ((sacl = sys_acl_get_file(fname, type)) != 0) { BOOL ok = unpack_smb_acl(sacl, racl); sys_acl_free_acl(sacl); @@ -491,7 +528,7 @@ static int get_rsync_acl(const char *fname, rsync_acl *racl, if (type == SMB_ACL_TYPE_ACCESS) rsync_acl_fake_perms(racl, mode); } else { - rsyserr(FERROR, errno, "get_acl: sys_acl_get_file(%s, %s)", + rsyserr(FERROR_XFER, errno, "get_acl: sys_acl_get_file(%s, %s)", fname, str_acl_type(type)); return -1; } @@ -523,13 +560,6 @@ int get_acl(const char *fname, stat_x *sxp) /* === Send functions === */ -/* The general strategy with the tag_type <-> character mapping is that - * lowercase implies that no qualifier follows, where uppercase does. - * A similar idiom for the ACL type (access or default) itself, but - * lowercase in this instance means there's no ACL following, so the - * ACL is a repeat, so the receiver should reuse the last of the same - * type ACL. */ - /* Send the ida list over the file descriptor. */ static void send_ida_entries(const ida_entries *idal, int f) { @@ -540,7 +570,7 @@ static void send_ida_entries(const ida_entries *idal, int f) for (ida = idal->idas; count--; ida++) { uint32 xbits = ida->access << 2; - char *name; + const char *name; if (ida->access & NAME_IS_USER) { xbits |= XFLAG_NAME_IS_USER; name = add_uid(ida->id); @@ -629,7 +659,7 @@ static uint32 recv_acl_access(uchar *name_follows_ptr, int f) if (name_follows_ptr) { int flags = access & 3; access >>= 2; - if (access & ~SMB_ACL_VALID_NAME_BITS) + if (am_root >= 0 && access & ~SMB_ACL_VALID_NAME_BITS) goto value_error; if (flags & XFLAG_NAME_FOLLOWS) *name_follows_ptr = 1; @@ -637,9 +667,9 @@ static uint32 recv_acl_access(uchar *name_follows_ptr, int f) *name_follows_ptr = 0; if (flags & XFLAG_NAME_IS_USER) access |= NAME_IS_USER; - } else if (access & ~SMB_ACL_VALID_OBJ_BITS) { + } else if (am_root >= 0 && access & ~SMB_ACL_VALID_OBJ_BITS) { value_error: - rprintf(FERROR, "recv_acl_access: value out of range: %x\n", + rprintf(FERROR_XFER, "recv_acl_access: value out of range: %x\n", access); exit_cleanup(RERR_STREAMIO); } @@ -694,7 +724,7 @@ static int recv_rsync_acl(item_list *racl_list, SMB_ACL_TYPE_T type, int f) int ndx = read_varint(f); if (ndx < 0 || (size_t)ndx > racl_list->count) { - rprintf(FERROR, "recv_acl_index: %s ACL index %d > %d\n", + rprintf(FERROR_XFER, "recv_acl_index: %s ACL index %d > %d\n", str_acl_type(type), ndx, (int)racl_list->count); exit_cleanup(RERR_STREAMIO); } @@ -719,15 +749,13 @@ static int recv_rsync_acl(item_list *racl_list, SMB_ACL_TYPE_T type, int f) if (flags & XMIT_NAME_LIST) computed_mask_bits |= recv_ida_entries(&duo_item->racl.names, f); - if (!duo_item->racl.names.count) { - /* If we received a superfluous mask, throw it away. */ - if (duo_item->racl.mask_obj != NO_ENTRY) { - /* Mask off the group perms with it first. */ - duo_item->racl.group_obj &= duo_item->racl.mask_obj | NO_ENTRY; - duo_item->racl.mask_obj = NO_ENTRY; - } - } else if (duo_item->racl.mask_obj == NO_ENTRY) /* Must be non-empty with lists. */ +#ifdef HAVE_OSX_ACLS + /* If we received a superfluous mask, throw it away. */ + duo_item->racl.mask_obj = NO_ENTRY; +#else + if (duo_item->racl.names.count && duo_item->racl.mask_obj == NO_ENTRY) /* Must be non-empty with lists. */ duo_item->racl.mask_obj = (computed_mask_bits | duo_item->racl.group_obj) & ~NO_ENTRY; +#endif duo_item->sacl = NULL; @@ -763,17 +791,51 @@ static int cache_rsync_acl(rsync_acl *racl, SMB_ACL_TYPE_T type, item_list *racl /* Turn the ACL data in stat_x into cached ACL data, setting the index * values in the file struct. */ -void cache_acl(struct file_struct *file, stat_x *sxp) +void cache_tmp_acl(struct file_struct *file, stat_x *sxp) { + if (prior_access_count == (size_t)-1) + prior_access_count = access_acl_list.count; + F_ACL(file) = cache_rsync_acl(sxp->acc_acl, SMB_ACL_TYPE_ACCESS, &access_acl_list); if (S_ISDIR(sxp->st.st_mode)) { + if (prior_default_count == (size_t)-1) + prior_default_count = default_acl_list.count; F_DIR_DEFACL(file) = cache_rsync_acl(sxp->def_acl, SMB_ACL_TYPE_DEFAULT, &default_acl_list); } } +static void uncache_duo_acls(item_list *duo_list, size_t start) +{ + acl_duo *duo_item = duo_list->items; + acl_duo *duo_start = duo_item + start; + + duo_item += duo_list->count; + duo_list->count = start; + + while (duo_item-- > duo_start) { + rsync_acl_free(&duo_item->racl); + if (duo_item->sacl) + sys_acl_free_acl(duo_item->sacl); + } +} + +void uncache_tmp_acls(void) +{ + if (prior_access_count != (size_t)-1) { + uncache_duo_acls(&access_acl_list, prior_access_count); + prior_access_count = (size_t)-1; + } + + if (prior_default_count != (size_t)-1) { + uncache_duo_acls(&default_acl_list, prior_default_count); + prior_default_count = (size_t)-1; + } +} + +#ifndef HAVE_OSX_ACLS static mode_t change_sacl_perms(SMB_ACL_T sacl, rsync_acl *racl, mode_t old_mode, mode_t mode) { SMB_ACL_ENTRY_T entry; @@ -833,7 +895,7 @@ static mode_t change_sacl_perms(SMB_ACL_T sacl, rsync_acl *racl, mode_t old_mode if (rc) { error_exit: if (errfun) { - rsyserr(FERROR, errno, "change_sacl_perms: %s()", + rsyserr(FERROR_XFER, errno, "change_sacl_perms: %s()", errfun); } return (mode_t)~0; @@ -849,31 +911,69 @@ static mode_t change_sacl_perms(SMB_ACL_T sacl, rsync_acl *racl, mode_t old_mode /* Return the mode of the file on disk, as we will set them. */ return (old_mode & ~ACCESSPERMS) | (mode & ACCESSPERMS); } +#endif static int set_rsync_acl(const char *fname, acl_duo *duo_item, SMB_ACL_TYPE_T type, stat_x *sxp, mode_t mode) { if (type == SMB_ACL_TYPE_DEFAULT && duo_item->racl.user_obj == NO_ENTRY) { - if (sys_acl_delete_def_file(fname) < 0) { - rsyserr(FERROR, errno, "set_acl: sys_acl_delete_def_file(%s)", + int rc; +#ifdef SUPPORT_XATTRS + /* --fake-super support: delete default ACL from xattrs. */ + if (am_root < 0) + rc = del_def_xattr_acl(fname); + else +#endif + rc = sys_acl_delete_def_file(fname); + if (rc < 0) { + rsyserr(FERROR_XFER, errno, "set_acl: sys_acl_delete_def_file(%s)", fname); return -1; } +#ifdef SUPPORT_XATTRS + } else if (am_root < 0) { + /* --fake-super support: store ACLs in an xattr. */ + int cnt = duo_item->racl.names.count; + size_t len = 4*4 + cnt * (4+4); + char *buf = new_array(char, len); + int rc; + + SIVAL(buf, 0, duo_item->racl.user_obj); + SIVAL(buf, 4, duo_item->racl.group_obj); + SIVAL(buf, 8, duo_item->racl.mask_obj); + SIVAL(buf, 12, duo_item->racl.other_obj); + + if (cnt) { + char *bp = buf + 4*4; + id_access *ida = duo_item->racl.names.idas; + for ( ; cnt--; ida++, bp += 4+4) { + SIVAL(bp, 0, ida->id); + SIVAL(bp, 4, ida->access); + } + } + rc = set_xattr_acl(fname, type == SMB_ACL_TYPE_ACCESS, buf, len); + free(buf); + return rc; +#endif } else { mode_t cur_mode = sxp->st.st_mode; if (!duo_item->sacl && !pack_smb_acl(&duo_item->sacl, &duo_item->racl)) return -1; +#ifdef HAVE_OSX_ACLS + mode = 0; /* eliminate compiler warning */ +#else if (type == SMB_ACL_TYPE_ACCESS) { cur_mode = change_sacl_perms(duo_item->sacl, &duo_item->racl, cur_mode, mode); if (cur_mode == (mode_t)~0) return 0; } +#endif if (sys_acl_set_file(fname, type, duo_item->sacl) < 0) { - rsyserr(FERROR, errno, "set_acl: sys_acl_set_file(%s, %s)", - fname, str_acl_type(type)); + rsyserr(FERROR_XFER, errno, "set_acl: sys_acl_set_file(%s, %s)", + fname, str_acl_type(type)); return -1; } if (type == SMB_ACL_TYPE_ACCESS) @@ -992,7 +1092,8 @@ int default_perms_for_dir(const char *dir) } /* Otherwise fall through. */ default: - rprintf(FERROR, "default_perms_for_dir: sys_acl_get_file(%s, %s): %s, falling back on umask\n", + rprintf(FWARNING, + "default_perms_for_dir: sys_acl_get_file(%s, %s): %s, falling back on umask\n", dir, str_acl_type(SMB_ACL_TYPE_DEFAULT), strerror(errno)); } return perms; @@ -1003,14 +1104,14 @@ int default_perms_for_dir(const char *dir) ok = unpack_smb_acl(sacl, &racl); sys_acl_free_acl(sacl); if (!ok) { - rprintf(FERROR, "default_perms_for_dir: unpack_smb_acl failed, falling back on umask\n"); + rprintf(FWARNING, "default_perms_for_dir: unpack_smb_acl failed, falling back on umask\n"); return perms; } /* Apply the permission-bit entries of the default ACL, if any. */ if (racl.user_obj != NO_ENTRY) { perms = rsync_acl_get_perms(&racl); - if (verbose > 2) + if (DEBUG_GTE(ACL, 1)) rprintf(FINFO, "got ACL-based default perms %o for directory %s\n", perms, dir); }