aboutsummaryrefslogtreecommitdiff
path: root/winsup/utils/setfacl.c
AgeCommit message (Collapse)AuthorFilesLines
2020-08-07Cygwin: utils: convert usage() to proper noreturn function throughoutCorinna Vinschen1-34/+10
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2018-08-17setfacl: Rename the option --file to --set-file, as on LinuxKen Brown1-2/+3
Retain --file as an undocumented option for backwards compatibility.
2018-07-23getfacl and setfacl: Align with LinuxKen Brown1-3/+3
Make getfacl print two colons instead of one after "other" and "mask". Change the help text for setfacl to indicate that there can be either one colon or two.
2016-06-23Switching the Cygwin DLL to LGPLv3+, dropping commercial buyout optioncygwin-2_5_2-releaseCorinna Vinschen1-4/+1
Bump GPLv2+ to GPLv3+ for some files, clarify BSD 2-clause. Everything else stays under GPLv3+. New Linking Exception exempts resulting executables from LGPLv3 section 4. Add CONTRIBUTORS file to keep track of licensing. Remove 'Copyright Red Hat Inc' comments. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2016-03-08Implement POSIX.1e ACL functionsCorinna Vinschen1-2/+1
* Makefile.in (DLL_OFILES): Add sec_posixacl.o. (SUBLIBS): Add libacl.a (libacl.a): New rule to create libacl.a. * common.din: Export POSIX ACL functions as well as most libacl.a extensions. * fhandler.h (fhander_base::acl_get): New prototype. (fhander_base::acl_set): Ditto. (fhandler_disk_file::acl_get): Ditto. (fhandler_disk_file::acl_set): Ditto. * include/acl/libacl.h: New file. * include/cygwin/version.h: Bump API minor version. * include/sys/acl.h: Drop including cygwin/acl.h. Accommodate throughout Cygwin. Add POSIX ACL definitions. * sec_acl.cc: Include sec_posixacl.h. Replace ILLEGAL_UID and ILLEGAL_GID with ACL_UNDEFINED_ID where sensible. (__aclcheck): New internal acl check function to be used for Solaris and POSIX ACLs. (aclcheck32): Call __aclcheck. (__aclcalcmask): New function to compute ACL_MASK value. (__aclsort): New internal acl sort function to be used for Solaris and POSIX ACLs. (aclsort32): Call __aclsort. (permtostr): Work directly on provided buffer. (__acltotext): New internal acltotext function to be used for Solaris and POSIX ACLs. (acltotext32): Call __acltotext. (__aclfromtext): New internal aclfromtext function to be used for Solaris and POSIX ACLs. (aclfromtext32): Call __aclfromtext. * sec_posixacl.cc: New file implemeting POSIX ACL functions. * sec_posixacl.h: New internal header. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-25setfacl: Remove unused local variableCorinna Vinschen1-1/+1
* setfacl.cc (delacl): Remove unused local variable. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-21setfacl(1): Fix handling of -m and -x on a single commandlineCorinna Vinschen1-9/+22
* setfacl.cc (delace): New helper function to delete a single ACE. (delacl): Call delace. (modacl): Ditto, if entry is supposed to get deleted. Align comments. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-21setfacl(1): Rewrite support for mask recomputationCorinna Vinschen1-30/+51
* setfacl.cc (modacl): Move recomputing mask into new function. (check_got_mask): New function checking if mask is in input. (recompute_mask): New function to recompute mask. (addmissing): Align mask computation to Linux setfacl. (setfacl): Call check_got_mask and recompute_mask on Set, Delete and Modify actions. (usage): Rename --substitute to --set. (longopts): Add --set option. * utils.xml (setfacl): Rename --substitute to --set. * new-features.xml (ov-new2.4): Rephrase setfacl changes. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-20setfacl --mask/--no-mask really don't need an argumentHouder1-2/+2
* setfacl.cc (longopts): Drop accidentally requiring an argument to the --mask and --no-mask options. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-12-19Fix missing arg requirement for setfacl -x optionHouder1-1/+1
* setfacl.cc (opts): Add colon to x option. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18setfacl: Allow to combine -b and -k optionsCorinna Vinschen1-125/+128
* setfacl.c (action_t): Rename DeleteAll to DeleteExt. Add DeleteAll. Rearrange for bit-wise testing later in the code. (delallacl): Handle -b -k combination. (setfacl): Handle DeleteExt/DeleteAll. (usage): Fix -b/-k output. Rearrange output to better fill 80 columns. (main): Allow to combine -b and -k. * utils.xml (setfacl): Accommodate -b/-k change. * new-features.xml (ov-new2.3): Add setfacl -b/-k change. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2015-11-18Reapply POSIX ACL changes.Corinna Vinschen1-135/+240
- New, unified implementation of POSIX permission and ACL handling. The new ACLs now store the POSIX ACL MASK/CLASS_OBJ permission mask, and they allow to inherit the S_ISGID bit. ACL inheritance now really works as desired, in a limited, but theoretically equivalent fashion even for non-Cygwin processes. To accommodate Windows default ACLs, the new code ignores SYSTEM and Administrators group permissions when computing the MASK/CLASS_OBJ permission mask on old ACLs, and it doesn't deny access to SYSTEM and Administrators group based on the value of MASK/CLASS_OBJ when creating the new ACLs. The new code now handles the S_ISGID bit on directories as on Linux: Setting S_ISGID on a directory causes new files and subdirs created within to inherit its group, rather than the primary group of the user who created the file. This only works for files and directories created by Cygwin processes. 2015-05-29 Corinna Vinschen <corinna@vinschen.de> Reapply POSIX ACL changes. * utils.xml (setfacl): Show new option output. (getfacl): Show new option output. * sec_acl.cc (get_posix_access): Check for Cygwin "standard" ACL. Apply umask, if so. Align comments. * security.cc (set_created_file_access): Fix permission masking by incoming requested file mode. * sec_acl.cc (set_posix_access): Apply mask only in terms of execute bit for SYSTEM and Admins group. * sec_acl.cc (set_posix_access): Don't create DENY ACEs for USER and GROUP entries if they are the same as USER_OBJ or GROUP_OBJ. * fhandler.h (fhandler_pty_slave::facl): Add prototype. * fhandler_tty.cc (fhandler_pty_slave::facl): New method. (fhandler_pty_slave::fchown): Fix uid/gid handling. * sec_acl.cc (set_posix_access): Drop superfluous class_idx variable. Simplify and move around code in a few places. To improve ACL readability, add r/w permissions to Admins ACE appended to pty ACL. Add comment to explain Windows ACE Mask filtering being in the way of creating a real CLASS_OBJ. (get_posix_access): Fake CLASS_OBJ for ptys. Explain why. * security.cc (get_object_attribute): Add S_IFCHR flag to attributes when calling get_posix_access. * sec_acl.cc (set_posix_access): Move merging group perms into owner perms in case of owner == group after mask has been computed. Take mask into account when doing so to avoid unnecessary ACCESS_DENIED_ACE. * sec_acl.cc (get_posix_access): Only set saw_group_obj flag if we saw the ACCESS_ALLOWED_ACE. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Deliberatly set GROUP_OBJ and CLASS_OBJ perms to new group perms. Add comment to explain why. * security.cc (set_created_file_access): Ditto. * sec_acl.cc (set_posix_access): Replace previous patch. Return EINVAL if uid and/or guid is invalid and not backed by an actual Windows account. * sec_acl.cc (set_posix_access): Workaround owner/group SIDs being NULL. * sec_acl.cc (set_posix_access): Handle files with owner == group. Rephrase switch statement checking against unfiltered a_type value. (get_posix_access): Handle files with owner == group. * sec_acl.cc (get_posix_access): Don't use GROUP_OBJ access to fix up CLASS_OBJ mask on old-style ACLs. Fix a comment. * sec_acl.cc (set_posix_access): Always make sure Admins have WRITE_DAC and WRITE_OWNER permissions. * security.h (create_object_sd_from_attribute): Drop handle parameter from prototype. * security.cc (create_object_sd_from_attribute): Drop handle parameter. Just create the standard POSIXy security descriptor. (set_object_attribute): Accommodate dropped paramter in call to create_object_sd_from_attribute. * fhandler_tty.cc: Ditto, throughout. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Fix typo in mask computation. * fhandler.cc (fhandler_base::open_with_arch): Call open with mode not umasked. (fhandler_base::open): Explicitely umask mode on NFS here. Call new set_created_file_access rather than set_file_attribute. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Reimplement setting permissions on filesystems supporting ACLs using the new set_posix_access call. (fhandler_disk_file::fchown): Ditto. (fhandler_disk_file::mkdir): Call new set_created_file_access rather than set_file_attribute. * fhandler_socket.cc (fhandler_socket::bind): Don't umask here. Add WRITE_OWNER access to allow writing group in case of SGID bit set. Call new set_created_file_access rather than set_file_attribute. * path.cc (symlink_worker): Call new set_created_file_access rather than set_file_attribute. * sec_acl.cc (searchace): Un-staticize. (set_posix_access): New, complementary functionality to get_posix_access. (setacl): Implement in terms of get_posix_access/set_posix_access. (get_posix_access): Add handling for just created files requiring their first Cygwin ACL. Fix new_style recognition. Handle SGID bit. For old-style ACLs, ignore SYSTEM and Administrators when computing the {DEF_}CLASS_OBJ perms. * security.cc (get_file_sd): Revamp comment. Change and (hopefully) speed up inheritance processing for just created files. (alloc_sd): Remove. (set_security_attribute): Call set_posix_access instead of alloc_sd. (get_object_attribute): Fix return value. (create_object_sd_from_attribute): Call set_posix_access instead of alloc_sd. (set_file_attribute): Remove. (set_created_file_access): New function implemented in terms of get_posix_access/set_posix_access. * security.h (set_file_attribute): Remove prototype. (set_created_file_access): Add prototype. (searchace): Ditto. (set_posix_access): Ditto. * syscalls.cc (open): Call open_with_arch with mode not umasked. * sec_acl.cc: Change preceeding comment explaining new-style ACLs. Describe how to generate deny ACEs in more detail. Accommodate the fact that a NULL deny ACE is used for {DEF_}CLASS_OBJ, rather than a special Cygwin ACE. Improve further comments. (CYG_ACE_NEW_STYLE): Define. (get_posix_access): Change from Cygwin ACE to NULL deny ACE. Fix CLASS_OBJ handling to generate CLASS_OBJ and DEF_CLASS_OBJ from a single NULL deny ACE if the inheritance flags say so. * sec_helper.cc (well_known_cygwin_sid): Remove. * security.h (well_known_cygwin_sid): Drop declaration. * sec_acl.cc (CYG_ACE_ISBITS_TO_WIN): Fix typo. (get_posix_access): Rename index variable from i to idx. Define only once at top level. * security.cc (add_access_allowed_ace): Drop unused parameter "offset". Accommodate throughout. (add_access_denied_ace): Ditto. * sec_acl.cc: Accommodate above change throughout. * security.h (add_access_allowed_ace): Adjust prototype to above change. (add_access_denied_ace): Ditto. * sec_acl.cc (get_posix_access): Handle multiple ACEs for the owner and primary group of the file. Handle the default primary group ACE as DEF_GROUP_OBJ entry if the directory has the S_ISGID bit set. Add comments. Minor code rearrangements. Preliminary read side implementation of new permission handling. * acl.h (MAX_ACL_ENTRIES): Raise to 2730. Add comment to explain. * sec_acl.cc: Add leading comment to explain new ACL style. Add definitions and macros to use for bits in new Cygwin ACL. (DENY_RWX): New mask value for all temporary deny bits. (getace): Add bool parameter to decide when leaving all bits intact, rather than filtering them per the already set bits. (get_posix_access): New function, taking over functionality to read POSIX ACL from SECURITY_DESCRIPTOR. (getacl): Just call get_posix_access. * sec_helper.cc (well_known_cygwin_sid): Define. * security.cc (get_attribute_from_acl): Remove. (get_info_from_sd): Remove. (get_reg_sd): Call get_posix_access instead of get_info_from_sd. (get_file_attribute): Ditto. (get_object_attribute): Ditto. * security.h (well_known_cygwin_sid): Declare. (get_posix_access): Add prototype. * Throughout, use simpler ACE macros from Windows' accctrl.h. * getfacl.c (main): Special-case SYSTEM and Admins group. Add comments. * setfacl.c: Align more to Linux tool. (delacl): New function to delete acl entries only. (modacl): Drop delete functionality. Add handling of recomputing the mask and default mask values. (delallacl): Rename from delacl. (setfacl): Call delacl in Delete case. Call delallacl in DeleteAll and DeleteDef case. (usage): Accommodate new options. Rearrange and rephrase slightly. (longopts): Emit 'x' in --delete case. Add --no-mask and --mask options. (opts): Add -x and -n options. (main): Handle -d and -x the same. Handle -n and --mask options. Drop handling for -r option. * getfacl.c (usage): Align more closely to Linux version. Add new options -c, -e, -E. Change formatting to accommodate longer options. (longopts): Rename --noname to --numeric. Keep --noname for backward compatibility. Add --omit-header, --all-effective and --no-effective options. (opts): Add -c, -e and -E option. (main): Handle new -c, -e, and -E options. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2014-12-15 * setfacl.c (action_t): Add DeleteDef value.Corinna Vinschen1-7/+26
(delacl): Take new parameter to differe between DeleteAll and DeleteDef. Extend conditional to handle DefaultDef. Change comment accordingly. (setfacl): Call delacl in DefaultDef case as well. (usage): Add and describe -k option. Add -k to require options. (longopts): Add --remove-default option. (opts): Add -k option. (main): Handle -k option.
2014-10-29 * setfacl.c (setfacl): Fix bracketing in expression.Corinna Vinschen1-1/+1
2014-10-27 * setfacl.c (usage): Add -b to require options.Corinna Vinschen1-1/+1
2014-10-27 * setfacl.c (action_t): Add DeleteAll value.Corinna Vinschen1-13/+67
(delacl): New function to remove all ACL entries not representing POSIX permissions. (setfacl): Rearrange conditional expression into switch statement. Add DeleteAll case. (usage): Add and describe -b option. (longopts): Add --remove-all option. (opts): Add -b option. (main): Handle -b option.
2014-09-03 * setfacl.c (addmissing): New function to add missing acl entries toCorinna Vinschen1-0/+65
a modified acl per the rules set by aclcheck. (setfacl): Call addmissing unless action is Delete.
2014-09-03 * setfacl.c (getaclentry): Fix previous fix again. Allow lone 'm' asCorinna Vinschen1-10/+17
well as any lone default entry if action is Delete. Fix comments. (usage): Align usage text.
2014-09-03 * setfacl.c (getaclentry): Fix return value in case of a lone 'm' ifCorinna Vinschen1-4/+2
action is Delete. Drop requirement for a trailing colon if action is Delete.
2014-08-31 * setfacl.c (usage): Drop outdated note that default ACEs are notCorinna Vinschen1-3/+3
taken into account.
2011-12-17Clean up whitespace.Christopher Faylor1-234/+234
2011-10-10 * Align usage output, version output, as well as usage and versionCorinna Vinschen1-34/+21
option handling to use the same style throughout all Cygwin utils. Throughout use program_invocation_short_name to refer to current process name in Cygwin executables. * utils.sgml: Align documentation to above change. Add missing sections for getconf, ldd, and setmetamode. * strace.cc (proc_child): Avoid compiler warning.
2011-04-18 * setfacl.c (getaclentry): Allow extra colon in mask and other entries.Corinna Vinschen1-1/+5
2011-03-28 * setfacl.c (strchrnul): Drop local implementation.Corinna Vinschen1-11/+1
2010-12-11 * setfacl.c (strchrnul): New function.Corinna Vinschen1-68/+66
(getaclentry): Rewrite.
2009-11-29 * setfacl.c (getaclentry): Allow to delete default entries for theCorinna Vinschen1-3/+12
owner and owner group.
2009-05-06 * mkpasswd.c (current_user): Don't use HOMEDRIVE/HOMEPATH to generateCorinna Vinschen1-3/+3
user's homedir. * mkgroup.c: Accommodate ctype changes. * mkpasswd.c: Ditto. * setfacl.c: Ditto. * ssp.c: Ditto.
2008-05-22 * setfacl.c (setfacl): Change from void to int. Return 2 in case ofCorinna Vinschen1-7/+14
error. (main): Return with error code from setfacl.
2006-01-18bad_keywordsChristopher Faylor1-4/+4
2003-09-11 * getfacl (main): Remove extern declaration of optind.Corinna Vinschen1-2/+0
* setfacl (main): Remove extern declaration of optarg and optind.
2003-04-26* cygcheck.cc (usage) Add description output.Joshua Daniel Franklin1-1/+0
2003-01-15 * mkgroup.c: Fix copyright date.Corinna Vinschen1-1/+1
* mkpasswd.c: Ditto. * setfacl.c: Ditto. Fix ChangeLog typos.
2003-01-10 * setfacl (usage): Remove double ":" for mask and other.Corinna Vinschen1-2/+2
2002-12-15 * setfacl.c (main): Place a single : after other and mask.Corinna Vinschen1-3/+3
* getfacl.c (getaclentry): Allow both : and :: for other and mask. (main): Remove extraneous break.
2002-11-24 * setfacl.c (getperm): Set only `other' permission bits.Corinna Vinschen1-4/+4
(getaclentry): Set a_id to -1 by default.
2002-11-08 * setfacl.c (usage): Add missing LF.Corinna Vinschen1-1/+1
2002-09-15Add final newlines to utilsJoshua Daniel Franklin1-1/+2
2002-05-24 * setfacl.c (usage): Standardize usage output. Change return type toCorinna Vinschen1-122/+195
static void. (print_version): New function. (longopts): Added longopts for all options. (main): Accommodate changes in usage function and new version option.
2001-11-04 * getfacl.c (username): New function.Corinna Vinschen1-36/+143
(groupname): Ditto. (usage): Ditto. Add more user friendly help text. (main): Add -n and --help option. Print names instead of IDs unless -n option is given. * setfacl.c (getperm): Tolerate whitespace and comment chars in input. (getaclentry): Fix several input string misdetections. (getaclentries): Allow - as input file name to read from stdin. Tolerate whitespace and comment chars in input. (usage): Add more user friendly help text. (main): Add --help option.
2001-03-05 * getfacl.c: Add copyright hint.Corinna Vinschen1-0/+11
* setfacl.c: Ditto. * strace.cc: Ditto.
2000-10-28* Makefile.in: Accomodate newer gcc's which require linking of c++ programsChristopher Faylor1-1/+1
with g++. Fixup output for some compilations. * cygcheck.cc: Respond to compiler warnings. * dumper.cc (main): Ditto. * parse_pe.cc (exclusion::sort_and_check): Ditto. * setfacl.cc (getaclentry): Ditto.
2000-02-17import winsup-2000-02-17 snapshotChristopher Faylor1-0/+377
generated by cgit v1.1 at 2025-01-01 02:31:29 +0000