X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/5b934f5133cee8adea717e2ffff2b6358d96b519..cb197514d99d17dc3a1ce26ff8918d63307d75e4:/acls.c

diff --git a/acls.c b/acls.c
index a2aaf082..105b9855 100644
--- a/acls.c
+++ b/acls.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2006 Wayne Davison
+ * Copyright (C) 2006-2009 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -88,13 +88,26 @@ static const rsync_acl empty_rsync_acl = {
 static item_list access_acl_list = EMPTY_ITEM_LIST;
 static item_list default_acl_list = EMPTY_ITEM_LIST;
 
+static size_t prior_access_count = (size_t)-1;
+static size_t prior_default_count = (size_t)-1;
+
 /* === Calculations on ACL types === */
 
 static const char *str_acl_type(SMB_ACL_TYPE_T type)
 {
-	return type == SMB_ACL_TYPE_ACCESS ? "SMB_ACL_TYPE_ACCESS"
-	     : type == SMB_ACL_TYPE_DEFAULT ? "SMB_ACL_TYPE_DEFAULT"
-	     : "unknown SMB_ACL_TYPE_T";
+	switch (type) {
+	case SMB_ACL_TYPE_ACCESS:
+#ifdef HAVE_OSX_ACLS
+		return "ACL_TYPE_EXTENDED";
+#else
+		return "ACL_TYPE_ACCESS";
+#endif
+	case SMB_ACL_TYPE_DEFAULT:
+		return "ACL_TYPE_DEFAULT";
+	default:
+		break;
+	}
+	return "unknown ACL type!";
 }
 
 static int calc_sacl_entries(const rsync_acl *racl)
@@ -127,7 +140,8 @@ static void rsync_acl_strip_perms(rsync_acl *racl)
 	else {
 		if (racl->group_obj == racl->mask_obj)
 			racl->group_obj = NO_ENTRY;
-		racl->mask_obj = NO_ENTRY;
+		if (racl->names.count != 0)
+			racl->mask_obj = NO_ENTRY;
 	}
 	racl->other_obj = NO_ENTRY;
 }
@@ -300,7 +314,7 @@ static BOOL unpack_smb_acl(SMB_ACL_T sacl, rsync_acl *racl)
 		ida->access = access;
 	}
 	if (rc) {
-		rsyserr(FERROR, errno, "unpack_smb_acl: %s()", errfun);
+		rsyserr(FERROR_XFER, errno, "unpack_smb_acl: %s()", errfun);
 		rsync_acl_free(racl);
 		return False;
 	}
@@ -356,7 +370,7 @@ static BOOL unpack_smb_acl(SMB_ACL_T sacl, rsync_acl *racl)
 static int store_access_in_entry(uint32 access, SMB_ACL_ENTRY_T entry)
 {
 	if (sys_acl_set_access_bits(entry, access)) {
-		rsyserr(FERROR, errno, "store_access_in_entry sys_acl_set_access_bits()");
+		rsyserr(FERROR_XFER, errno, "store_access_in_entry sys_acl_set_access_bits()");
 		return -1;
 	}
 	return 0;
@@ -375,7 +389,7 @@ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl)
 	SMB_ACL_ENTRY_T entry;
 
 	if (!(*smb_acl = sys_acl_init(calc_sacl_entries(racl)))) {
-		rsyserr(FERROR, errno, "pack_smb_acl: sys_acl_init()");
+		rsyserr(FERROR_XFER, errno, "pack_smb_acl: sys_acl_init()");
 		return False;
 	}
 
@@ -390,13 +404,10 @@ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl)
 			break;
 #endif
 		COE( sys_acl_create_entry,(smb_acl, &entry) );
-		COE( sys_acl_set_info,(entry,
-#ifdef SMB_ACL_NEED_SORT
-				       SMB_ACL_USER,
-#else
-				       ida->access & NAME_IS_USER ? SMB_ACL_USER : SMB_ACL_GROUP,
-#endif
-				       ida->access & ~NAME_IS_USER, ida->id) );
+		COE( sys_acl_set_info,
+		    (entry,
+		     ida->access & NAME_IS_USER ? SMB_ACL_USER : SMB_ACL_GROUP,
+		     ida->access & ~NAME_IS_USER, ida->id) );
 	}
 
 #ifndef HAVE_OSX_ACLS
@@ -427,14 +438,14 @@ static BOOL pack_smb_acl(SMB_ACL_T *smb_acl, const rsync_acl *racl)
 
 #ifdef DEBUG
 	if (sys_acl_valid(*smb_acl) < 0)
-		rprintf(FERROR, "pack_smb_acl: warning: system says the ACL I packed is invalid\n");
+		rprintf(FERROR_XFER, "pack_smb_acl: warning: system says the ACL I packed is invalid\n");
 #endif
 
 	return True;
 
   error_exit:
 	if (errfun) {
-		rsyserr(FERROR, errno, "pack_smb_acl %s()", errfun);
+		rsyserr(FERROR_XFER, errno, "pack_smb_acl %s()", errfun);
 	}
 	sys_acl_free_acl(*smb_acl);
 	return False;
@@ -467,9 +478,45 @@ static int find_matching_rsync_acl(const rsync_acl *racl, SMB_ACL_TYPE_T type,
 static int get_rsync_acl(const char *fname, rsync_acl *racl,
 			 SMB_ACL_TYPE_T type, mode_t mode)
 {
-	SMB_ACL_T sacl = sys_acl_get_file(fname, type);
+	SMB_ACL_T sacl;
 
-	if (sacl) {
+#ifdef SUPPORT_XATTRS
+	/* --fake-super support: load ACLs from an xattr. */
+	if (am_root < 0) {
+		char *buf;
+		size_t len;
+		int cnt;
+
+		if ((buf = get_xattr_acl(fname, type == SMB_ACL_TYPE_ACCESS, &len)) == NULL)
+			return 0;
+		cnt = (len - 4*4) / (4+4);
+		if (len < 4*4 || len != (size_t)cnt*(4+4) + 4*4) {
+			free(buf);
+			return -1;
+		}
+
+		racl->user_obj = IVAL(buf, 0);
+		racl->group_obj = IVAL(buf, 4);
+		racl->mask_obj = IVAL(buf, 8);
+		racl->other_obj = IVAL(buf, 12);
+
+		if (cnt) {
+			char *bp = buf + 4*4;
+			id_access *ida;
+			if (!(ida = racl->names.idas = new_array(id_access, cnt)))
+				out_of_memory("get_rsync_acl");
+			racl->names.count = cnt;
+			for ( ; cnt--; ida++, bp += 4+4) {
+				ida->id = IVAL(bp, 0);
+				ida->access = IVAL(bp, 4);
+			}
+		}
+		free(buf);
+		return 0;
+	}
+#endif
+
+	if ((sacl = sys_acl_get_file(fname, type)) != 0) {
 		BOOL ok = unpack_smb_acl(sacl, racl);
 
 		sys_acl_free_acl(sacl);
@@ -481,7 +528,7 @@ static int get_rsync_acl(const char *fname, rsync_acl *racl,
 		if (type == SMB_ACL_TYPE_ACCESS)
 			rsync_acl_fake_perms(racl, mode);
 	} else {
-		rsyserr(FERROR, errno, "get_acl: sys_acl_get_file(%s, %s)",
+		rsyserr(FERROR_XFER, errno, "get_acl: sys_acl_get_file(%s, %s)",
 			fname, str_acl_type(type));
 		return -1;
 	}
@@ -523,7 +570,7 @@ static void send_ida_entries(const ida_entries *idal, int f)
 
 	for (ida = idal->idas; count--; ida++) {
 		uint32 xbits = ida->access << 2;
-		char *name;
+		const char *name;
 		if (ida->access & NAME_IS_USER) {
 			xbits |= XFLAG_NAME_IS_USER;
 			name = add_uid(ida->id);
@@ -612,7 +659,7 @@ static uint32 recv_acl_access(uchar *name_follows_ptr, int f)
 	if (name_follows_ptr) {
 		int flags = access & 3;
 		access >>= 2;
-		if (access & ~SMB_ACL_VALID_NAME_BITS)
+		if (am_root >= 0 && access & ~SMB_ACL_VALID_NAME_BITS)
 			goto value_error;
 		if (flags & XFLAG_NAME_FOLLOWS)
 			*name_follows_ptr = 1;
@@ -620,9 +667,9 @@ static uint32 recv_acl_access(uchar *name_follows_ptr, int f)
 			*name_follows_ptr = 0;
 		if (flags & XFLAG_NAME_IS_USER)
 			access |= NAME_IS_USER;
-	} else if (access & ~SMB_ACL_VALID_OBJ_BITS) {
+	} else if (am_root >= 0 && access & ~SMB_ACL_VALID_OBJ_BITS) {
 	  value_error:
-		rprintf(FERROR, "recv_acl_access: value out of range: %x\n",
+		rprintf(FERROR_XFER, "recv_acl_access: value out of range: %x\n",
 			access);
 		exit_cleanup(RERR_STREAMIO);
 	}
@@ -677,7 +724,7 @@ static int recv_rsync_acl(item_list *racl_list, SMB_ACL_TYPE_T type, int f)
 	int ndx = read_varint(f);
 
 	if (ndx < 0 || (size_t)ndx > racl_list->count) {
-		rprintf(FERROR, "recv_acl_index: %s ACL index %d > %d\n",
+		rprintf(FERROR_XFER, "recv_acl_index: %s ACL index %d > %d\n",
 			str_acl_type(type), ndx, (int)racl_list->count);
 		exit_cleanup(RERR_STREAMIO);
 	}
@@ -702,16 +749,11 @@ static int recv_rsync_acl(item_list *racl_list, SMB_ACL_TYPE_T type, int f)
 	if (flags & XMIT_NAME_LIST)
 		computed_mask_bits |= recv_ida_entries(&duo_item->racl.names, f);
 
-	if (!duo_item->racl.names.count) {
-		/* If we received a superfluous mask, throw it away. */
-		if (duo_item->racl.mask_obj != NO_ENTRY) {
-			/* Mask off the group perms with it first. */
-			duo_item->racl.group_obj &= duo_item->racl.mask_obj | NO_ENTRY;
-			duo_item->racl.mask_obj = NO_ENTRY;
-		}
-	}
-#ifndef HAVE_OSX_ACLS
-	else if (duo_item->racl.mask_obj == NO_ENTRY) /* Must be non-empty with lists. */
+#ifdef HAVE_OSX_ACLS
+	/* If we received a superfluous mask, throw it away. */
+	duo_item->racl.mask_obj = NO_ENTRY;
+#else
+	if (duo_item->racl.names.count && duo_item->racl.mask_obj == NO_ENTRY) /* Must be non-empty with lists. */
 		duo_item->racl.mask_obj = (computed_mask_bits | duo_item->racl.group_obj) & ~NO_ENTRY;
 #endif
 
@@ -749,17 +791,50 @@ static int cache_rsync_acl(rsync_acl *racl, SMB_ACL_TYPE_T type, item_list *racl
 
 /* Turn the ACL data in stat_x into cached ACL data, setting the index
  * values in the file struct. */
-void cache_acl(struct file_struct *file, stat_x *sxp)
+void cache_tmp_acl(struct file_struct *file, stat_x *sxp)
 {
+	if (prior_access_count == (size_t)-1)
+		prior_access_count = access_acl_list.count;
+
 	F_ACL(file) = cache_rsync_acl(sxp->acc_acl,
 				      SMB_ACL_TYPE_ACCESS, &access_acl_list);
 
 	if (S_ISDIR(sxp->st.st_mode)) {
+		if (prior_default_count == (size_t)-1)
+			prior_default_count = default_acl_list.count;
 		F_DIR_DEFACL(file) = cache_rsync_acl(sxp->def_acl,
 				      SMB_ACL_TYPE_DEFAULT, &default_acl_list);
 	}
 }
 
+static void uncache_duo_acls(item_list *duo_list, size_t start)
+{
+	acl_duo *duo_item = duo_list->items;
+	acl_duo *duo_start = duo_item + start;
+
+	duo_item += duo_list->count;
+	duo_list->count = start;
+
+	while (duo_item-- > duo_start) {
+		rsync_acl_free(&duo_item->racl);
+		if (duo_item->sacl)
+			sys_acl_free_acl(duo_item->sacl);
+	}
+}
+
+void uncache_tmp_acls(void)
+{
+	if (prior_access_count != (size_t)-1) {
+		uncache_duo_acls(&access_acl_list, prior_access_count);
+		prior_access_count = (size_t)-1;
+	}
+
+	if (prior_default_count != (size_t)-1) {
+		uncache_duo_acls(&default_acl_list, prior_default_count);
+		prior_default_count = (size_t)-1;
+	}
+}
+
 #ifndef HAVE_OSX_ACLS
 static mode_t change_sacl_perms(SMB_ACL_T sacl, rsync_acl *racl, mode_t old_mode, mode_t mode)
 {
@@ -820,7 +895,7 @@ static mode_t change_sacl_perms(SMB_ACL_T sacl, rsync_acl *racl, mode_t old_mode
 	if (rc) {
 	  error_exit:
 		if (errfun) {
-			rsyserr(FERROR, errno, "change_sacl_perms: %s()",
+			rsyserr(FERROR_XFER, errno, "change_sacl_perms: %s()",
 				errfun);
 		}
 		return (mode_t)~0;
@@ -843,11 +918,44 @@ static int set_rsync_acl(const char *fname, acl_duo *duo_item,
 {
 	if (type == SMB_ACL_TYPE_DEFAULT
 	 && duo_item->racl.user_obj == NO_ENTRY) {
-		if (sys_acl_delete_def_file(fname) < 0) {
-			rsyserr(FERROR, errno, "set_acl: sys_acl_delete_def_file(%s)",
+		int rc;
+#ifdef SUPPORT_XATTRS
+		/* --fake-super support: delete default ACL from xattrs. */
+		if (am_root < 0)
+			rc = del_def_xattr_acl(fname);
+		else
+#endif
+			rc = sys_acl_delete_def_file(fname);
+		if (rc < 0) {
+			rsyserr(FERROR_XFER, errno, "set_acl: sys_acl_delete_def_file(%s)",
 				fname);
 			return -1;
 		}
+#ifdef SUPPORT_XATTRS
+	} else if (am_root < 0) {
+		/* --fake-super support: store ACLs in an xattr. */
+		int cnt = duo_item->racl.names.count;
+		size_t len = 4*4 + cnt * (4+4);
+		char *buf = new_array(char, len);
+		int rc;
+
+		SIVAL(buf, 0, duo_item->racl.user_obj);
+		SIVAL(buf, 4, duo_item->racl.group_obj);
+		SIVAL(buf, 8, duo_item->racl.mask_obj);
+		SIVAL(buf, 12, duo_item->racl.other_obj);
+
+		if (cnt) {
+			char *bp = buf + 4*4;
+			id_access *ida = duo_item->racl.names.idas;
+			for ( ; cnt--; ida++, bp += 4+4) {
+				SIVAL(bp, 0, ida->id);
+				SIVAL(bp, 4, ida->access);
+			}
+		}
+		rc = set_xattr_acl(fname, type == SMB_ACL_TYPE_ACCESS, buf, len);
+		free(buf);
+		return rc;
+#endif
 	} else {
 		mode_t cur_mode = sxp->st.st_mode;
 		if (!duo_item->sacl
@@ -864,8 +972,8 @@ static int set_rsync_acl(const char *fname, acl_duo *duo_item,
 		}
 #endif
 		if (sys_acl_set_file(fname, type, duo_item->sacl) < 0) {
-			rsyserr(FERROR, errno, "set_acl: sys_acl_set_file(%s, %s)",
-			fname, str_acl_type(type));
+			rsyserr(FERROR_XFER, errno, "set_acl: sys_acl_set_file(%s, %s)",
+				fname, str_acl_type(type));
 			return -1;
 		}
 		if (type == SMB_ACL_TYPE_ACCESS)
@@ -984,7 +1092,8 @@ int default_perms_for_dir(const char *dir)
 			}
 			/* Otherwise fall through. */
 		default:
-			rprintf(FERROR, "default_perms_for_dir: sys_acl_get_file(%s, %s): %s, falling back on umask\n",
+			rprintf(FWARNING,
+				"default_perms_for_dir: sys_acl_get_file(%s, %s): %s, falling back on umask\n",
 				dir, str_acl_type(SMB_ACL_TYPE_DEFAULT), strerror(errno));
 		}
 		return perms;
@@ -995,14 +1104,14 @@ int default_perms_for_dir(const char *dir)
 	ok = unpack_smb_acl(sacl, &racl);
 	sys_acl_free_acl(sacl);
 	if (!ok) {
-		rprintf(FERROR, "default_perms_for_dir: unpack_smb_acl failed, falling back on umask\n");
+		rprintf(FWARNING, "default_perms_for_dir: unpack_smb_acl failed, falling back on umask\n");
 		return perms;
 	}
 
 	/* Apply the permission-bit entries of the default ACL, if any. */
 	if (racl.user_obj != NO_ENTRY) {
 		perms = rsync_acl_get_perms(&racl);
-		if (verbose > 2)
+		if (DEBUG_GTE(ACL, 1))
 			rprintf(FINFO, "got ACL-based default perms %o for directory %s\n", perms, dir);
 	}