usr/src/lib/libsec/common/acltext.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
  24  */
  25
  26 /*LINTLIBRARY*/
  27
  28 #include <grp.h>
  29 #include <pwd.h>
  30 #include <string.h>
  31 #include <limits.h>
  32 #include <stdlib.h>
  33 #include <errno.h>
  34 #include <sys/param.h>
  35 #include <sys/types.h>
  36 #include <sys/stat.h>
  37 #include <sys/acl.h>
  38 #include <aclutils.h>
  39 #include <idmap.h>
  40 #include <synch.h>
  41
  42 #define ID_STR_MAX      20      /* digits in LONG_MAX */
  43
  44 #define APPENDED_ID_MAX ID_STR_MAX + 1          /* id + colon */
  45 /*
  46  * yyinteractive controls whether yyparse should print out
  47  * error messages to stderr, and whether or not id's should be
  48  * allowed from acl_fromtext().
  49  */
  50 int     yyinteractive;
  51 acl_t   *yyacl;
  52 char    *yybuf;
  53 mutex_t yymutex;
  54
  55 extern acl_t *acl_alloc(enum acl_type);
  56
  57 /*
  58  * dynamic string that will increase in size on an
  59  * as needed basis.
  60  */
  61 typedef struct dynaclstr {
  62         size_t d_bufsize;               /* current size of aclexport */
  63         char *d_aclexport;
  64         int d_pos;
  65 } dynaclstr_t;
  66
  67 static int str_append(dynaclstr_t *, char *);
  68 static int aclent_perm_txt(dynaclstr_t *, o_mode_t);
  69
  70 static void
  71 aclent_perms(int perm, char *txt_perms)
  72 {
  73         if (perm & S_IROTH)
  74                 txt_perms[0] = 'r';
  75         else
  76                 txt_perms[0] = '-';
  77         if (perm & S_IWOTH)
  78                 txt_perms[1] = 'w';
  79         else
  80                 txt_perms[1] = '-';
  81         if (perm & S_IXOTH)
  82                 txt_perms[2] = 'x';
  83         else
  84                 txt_perms[2] = '-';
  85         txt_perms[3] = '\0';
  86 }
  87
  88 static char *
  89 pruname(uid_t uid, char *uidp, size_t buflen, int noresolve)
  90 {
  91         struct passwd   *passwdp = NULL;
  92
  93         if (noresolve == 0)
  94                 passwdp = getpwuid(uid);
  95         if (passwdp == NULL) {
  96                 /* could not get passwd information: display uid instead */
  97                 (void) snprintf(uidp, buflen, "%u", uid);
  98         } else {
  99                 (void) strlcpy(uidp, passwdp->pw_name, buflen);
 100         }
 101         return (uidp);
 102 }
 103
 104 static char *
 105 prgname(gid_t gid, char *gidp, size_t buflen, int noresolve)
 106 {
 107         struct group    *groupp = NULL;
 108
 109         if (noresolve == 0)
 110                 groupp = getgrgid(gid);
 111         if (groupp == NULL) {
 112                 /* could not get group information: display gid instead */
 113                 (void) snprintf(gidp, buflen, "%u", gid);
 114         } else {
 115                 (void) strlcpy(gidp, groupp->gr_name, buflen);
 116         }
 117         return (gidp);
 118 }
 119
 120 static int
 121 getsidname(uid_t who, boolean_t user, char **sidp, boolean_t noresolve)
 122 {
 123         idmap_get_handle_t *get_hdl = NULL;
 124         idmap_stat status;
 125         idmap_rid_t rid;
 126         int error = IDMAP_ERR_NORESULT;
 127         int len;
 128         char *domain = NULL;
 129
 130         *sidp = NULL;
 131
 132         /*
 133          * First try and get windows name
 134          */
 135
 136         if (!noresolve) {
 137                 if (user)
 138                         error = idmap_getwinnamebyuid(who,
 139                             IDMAP_REQ_FLG_USE_CACHE, sidp, NULL);
 140                 else
 141                         error = idmap_getwinnamebygid(who,
 142                             IDMAP_REQ_FLG_USE_CACHE, sidp, NULL);
 143         }
 144         if (error != IDMAP_SUCCESS) {
 145                 if (idmap_get_create(&get_hdl) == IDMAP_SUCCESS) {
 146                         if (user)
 147                                 error = idmap_get_sidbyuid(get_hdl, who,
 148                                     IDMAP_REQ_FLG_USE_CACHE, &domain, &rid,
 149                                     &status);
 150                         else
 151                                 error = idmap_get_sidbygid(get_hdl, who,
 152                                     IDMAP_REQ_FLG_USE_CACHE, &domain, &rid,
 153                                     &status);
 154                         if (error == IDMAP_SUCCESS &&
 155                             idmap_get_mappings(get_hdl) == 0) {
 156                                 if (status == IDMAP_SUCCESS) {
 157                                         len = snprintf(NULL, 0,
 158                                             "%s-%d", domain, rid);
 159                                         if (*sidp = malloc(len + 1)) {
 160                                                 (void) snprintf(*sidp, len + 1,
 161                                                     "%s-%d", domain, rid);
 162                                         }
 163                                 }
 164                         }
 165                 }
 166                 if (get_hdl)
 167                         idmap_get_destroy(get_hdl);
 168         }
 169
 170         free(domain);
 171
 172         return (*sidp ? 0 : 1);
 173 }
 174
 175 static void
 176 aclent_printacl(acl_t *aclp)
 177 {
 178         aclent_t *tp;
 179         int aclcnt;
 180         int mask;
 181         int slot = 0;
 182         char perm[4];
 183         char uidp[ID_STR_MAX];
 184         char gidp[ID_STR_MAX];
 185
 186         /* display ACL: assume it is sorted. */
 187         aclcnt = aclp->acl_cnt;
 188         for (tp = aclp->acl_aclp; tp && aclcnt--; tp++) {
 189                 if (tp->a_type == CLASS_OBJ)
 190                         mask = tp->a_perm;
 191         }
 192         aclcnt = aclp->acl_cnt;
 193         for (tp = aclp->acl_aclp; aclcnt--; tp++) {
 194                 (void) printf("     %d:", slot++);
 195                 switch (tp->a_type) {
 196                 case USER:
 197                         aclent_perms(tp->a_perm, perm);
 198                         (void) printf("user:%s:%s\t\t",
 199                             pruname(tp->a_id, uidp, sizeof (uidp), 0), perm);
 200                         aclent_perms((tp->a_perm & mask), perm);
 201                         (void) printf("#effective:%s\n", perm);
 202                         break;
 203                 case USER_OBJ:
 204                         /* no need to display uid */
 205                         aclent_perms(tp->a_perm, perm);
 206                         (void) printf("user::%s\n", perm);
 207                         break;
 208                 case GROUP:
 209                         aclent_perms(tp->a_perm, perm);
 210                         (void) printf("group:%s:%s\t\t",
 211                             prgname(tp->a_id, gidp, sizeof (gidp), 0), perm);
 212                         aclent_perms(tp->a_perm & mask, perm);
 213                         (void) printf("#effective:%s\n", perm);
 214                         break;
 215                 case GROUP_OBJ:
 216                         aclent_perms(tp->a_perm, perm);
 217                         (void) printf("group::%s\t\t", perm);
 218                         aclent_perms(tp->a_perm & mask, perm);
 219                         (void) printf("#effective:%s\n", perm);
 220                         break;
 221                 case CLASS_OBJ:
 222                         aclent_perms(tp->a_perm, perm);
 223                         (void) printf("mask:%s\n", perm);
 224                         break;
 225                 case OTHER_OBJ:
 226                         aclent_perms(tp->a_perm, perm);
 227                         (void) printf("other:%s\n", perm);
 228                         break;
 229                 case DEF_USER:
 230                         aclent_perms(tp->a_perm, perm);
 231                         (void) printf("default:user:%s:%s\n",
 232                             pruname(tp->a_id, uidp, sizeof (uidp), 0), perm);
 233                         break;
 234                 case DEF_USER_OBJ:
 235                         aclent_perms(tp->a_perm, perm);
 236                         (void) printf("default:user::%s\n", perm);
 237                         break;
 238                 case DEF_GROUP:
 239                         aclent_perms(tp->a_perm, perm);
 240                         (void) printf("default:group:%s:%s\n",
 241                             prgname(tp->a_id, gidp, sizeof (gidp), 0), perm);
 242                         break;
 243                 case DEF_GROUP_OBJ:
 244                         aclent_perms(tp->a_perm, perm);
 245                         (void) printf("default:group::%s\n", perm);
 246                         break;
 247                 case DEF_CLASS_OBJ:
 248                         aclent_perms(tp->a_perm, perm);
 249                         (void) printf("default:mask:%s\n", perm);
 250                         break;
 251                 case DEF_OTHER_OBJ:
 252                         aclent_perms(tp->a_perm, perm);
 253                         (void) printf("default:other:%s\n", perm);
 254                         break;
 255                 default:
 256                         (void) fprintf(stderr,
 257                             dgettext(TEXT_DOMAIN, "unrecognized entry\n"));
 258                         break;
 259                 }
 260         }
 261 }
 262
 263 static void
 264 split_line(char *str, int cols)
 265 {
 266         char *ptr;
 267         int len;
 268         int i;
 269         int last_split;
 270         char *pad = "";
 271         int pad_len;
 272
 273         len = strlen(str);
 274         ptr = str;
 275         pad_len = 0;
 276
 277         ptr = str;
 278         last_split = 0;
 279         for (i = 0; i != len; i++) {
 280                 if ((i + pad_len + 4) >= cols) {
 281                         (void) printf("%s%.*s\n", pad, last_split, ptr);
 282                         ptr = &ptr[last_split];
 283                         len = strlen(ptr);
 284                         i = 0;
 285                         pad_len = 4;
 286                         pad = "         ";
 287                 } else {
 288                         if (ptr[i] == '/' || ptr[i] == ':') {
 289                                 last_split = i;
 290                         }
 291                 }
 292         }
 293         if (i == len) {
 294                 (void) printf("%s%s\n", pad, ptr);
 295         }
 296 }
 297
 298 /*
 299  * compute entry type string, such as user:joe, group:staff,...
 300  */
 301 static int
 302 aclent_type_txt(dynaclstr_t *dstr, aclent_t *aclp, int flags)
 303 {
 304         char idp[ID_STR_MAX];
 305         int error;
 306
 307         switch (aclp->a_type) {
 308         case DEF_USER_OBJ:
 309         case USER_OBJ:
 310                 if (aclp->a_type == USER_OBJ)
 311                         error = str_append(dstr, "user::");
 312                 else
 313                         error = str_append(dstr, "defaultuser::");
 314                 break;
 315
 316         case DEF_USER:
 317         case USER:
 318                 if (aclp->a_type == USER)
 319                         error = str_append(dstr, "user:");
 320                 else
 321                         error = str_append(dstr, "defaultuser:");
 322                 if (error)
 323                         break;
 324                 error = str_append(dstr, pruname(aclp->a_id, idp,
 325                     sizeof (idp), flags & ACL_NORESOLVE));
 326                 if (error == 0)
 327                         error = str_append(dstr, ":");
 328                 break;
 329
 330         case DEF_GROUP_OBJ:
 331         case GROUP_OBJ:
 332                 if (aclp->a_type == GROUP_OBJ)
 333                         error = str_append(dstr, "group::");
 334                 else
 335                         error = str_append(dstr, "defaultgroup::");
 336                 break;
 337
 338         case DEF_GROUP:
 339         case GROUP:
 340                 if (aclp->a_type == GROUP)
 341                         error = str_append(dstr, "group:");
 342                 else
 343                         error = str_append(dstr, "defaultgroup:");
 344                 if (error)
 345                         break;
 346                 error = str_append(dstr, prgname(aclp->a_id, idp,
 347                     sizeof (idp), flags & ACL_NORESOLVE));
 348                 if (error == 0)
 349                         error = str_append(dstr, ":");
 350                 break;
 351
 352         case DEF_CLASS_OBJ:
 353         case CLASS_OBJ:
 354                 if (aclp->a_type == CLASS_OBJ)
 355                         error = str_append(dstr, "mask:");
 356                 else
 357                         error = str_append(dstr, "defaultmask:");
 358                 break;
 359
 360         case DEF_OTHER_OBJ:
 361         case OTHER_OBJ:
 362                 if (aclp->a_type == OTHER_OBJ)
 363                         error = str_append(dstr, "other:");
 364                 else
 365                         error = str_append(dstr, "defaultother:");
 366                 break;
 367
 368         default:
 369                 error = 1;
 370                 break;
 371         }
 372
 373         return (error);
 374 }
 375
 376 /*
 377  * compute entry type string such as, owner@:, user:joe, group:staff,...
 378  */
 379 static int
 380 ace_type_txt(dynaclstr_t *dynstr, ace_t *acep, int flags)
 381 {
 382         char idp[ID_STR_MAX];
 383         int error;
 384         char *sidp = NULL;
 385
 386         switch (acep->a_flags & ACE_TYPE_FLAGS) {
 387         case ACE_OWNER:
 388                 error = str_append(dynstr, OWNERAT_TXT);
 389                 break;
 390
 391         case ACE_GROUP|ACE_IDENTIFIER_GROUP:
 392                 error = str_append(dynstr, GROUPAT_TXT);
 393                 break;
 394
 395         case ACE_IDENTIFIER_GROUP:
 396                 if ((flags & ACL_SID_FMT) && acep->a_who > MAXUID) {
 397                         if (error = str_append(dynstr,
 398                             GROUPSID_TXT))
 399                                 break;
 400                         if (error = getsidname(acep->a_who, B_FALSE,
 401                             &sidp, flags & ACL_NORESOLVE))
 402                                 break;
 403                         error = str_append(dynstr, sidp);
 404                 } else {
 405                         if (error = str_append(dynstr, GROUP_TXT))
 406                                 break;
 407                         error = str_append(dynstr, prgname(acep->a_who, idp,
 408                             sizeof (idp), flags & ACL_NORESOLVE));
 409                 }
 410                 if (error == 0)
 411                         error = str_append(dynstr, ":");
 412                 break;
 413
 414         case ACE_EVERYONE:
 415                 error = str_append(dynstr, EVERYONEAT_TXT);
 416                 break;
 417
 418         case 0:
 419                 if ((flags & ACL_SID_FMT) && acep->a_who > MAXUID) {
 420                         if (error = str_append(dynstr, USERSID_TXT))
 421                                 break;
 422                         if (error = getsidname(acep->a_who, B_TRUE,
 423                             &sidp, flags & ACL_NORESOLVE))
 424                                 break;
 425                         error = str_append(dynstr, sidp);
 426                 } else {
 427                         if (error = str_append(dynstr, USER_TXT))
 428                                 break;
 429                         error = str_append(dynstr, pruname(acep->a_who, idp,
 430                             sizeof (idp), flags & ACL_NORESOLVE));
 431                 }
 432                 if (error == 0)
 433                         error = str_append(dynstr, ":");
 434                 break;
 435         default:
 436                 error = 0;
 437                 break;
 438         }
 439
 440         free(sidp);
 441         return (error);
 442 }
 443
 444 /*
 445  * compute string of permissions, such as read_data/write_data or
 446  * rwxp,...
 447  * The format depends on the flags field which indicates whether the compact
 448  * or verbose format should be used.
 449  */
 450 static int
 451 ace_perm_txt(dynaclstr_t *dstr, uint32_t mask,
 452     uint32_t iflags, int isdir, int flags)
 453 {
 454         int error = 0;
 455
 456         if (flags & ACL_COMPACT_FMT) {
 457                 char buf[16];
 458
 459                 if (mask & ACE_READ_DATA)
 460                         buf[0] = 'r';
 461                 else
 462                         buf[0] = '-';
 463                 if (mask & ACE_WRITE_DATA)
 464                         buf[1] = 'w';
 465                 else
 466                         buf[1] = '-';
 467                 if (mask & ACE_EXECUTE)
 468                         buf[2] = 'x';
 469                 else
 470                         buf[2] = '-';
 471                 if (mask & ACE_APPEND_DATA)
 472                         buf[3] = 'p';
 473                 else
 474                         buf[3] = '-';
 475                 if (mask & ACE_DELETE)
 476                         buf[4] = 'd';
 477                 else
 478                         buf[4] = '-';
 479                 if (mask & ACE_DELETE_CHILD)
 480                         buf[5] = 'D';
 481                 else
 482                         buf[5] = '-';
 483                 if (mask & ACE_READ_ATTRIBUTES)
 484                         buf[6] = 'a';
 485                 else
 486                         buf[6] = '-';
 487                 if (mask & ACE_WRITE_ATTRIBUTES)
 488                         buf[7] = 'A';
 489                 else
 490                         buf[7] = '-';
 491                 if (mask & ACE_READ_NAMED_ATTRS)
 492                         buf[8] = 'R';
 493                 else
 494                         buf[8] = '-';
 495                 if (mask & ACE_WRITE_NAMED_ATTRS)
 496                         buf[9] = 'W';
 497                 else
 498                         buf[9] = '-';
 499                 if (mask & ACE_READ_ACL)
 500                         buf[10] = 'c';
 501                 else
 502                         buf[10] = '-';
 503                 if (mask & ACE_WRITE_ACL)
 504                         buf[11] = 'C';
 505                 else
 506                         buf[11] = '-';
 507                 if (mask & ACE_WRITE_OWNER)
 508                         buf[12] = 'o';
 509                 else
 510                         buf[12] = '-';
 511                 if (mask & ACE_SYNCHRONIZE)
 512                         buf[13] = 's';
 513                 else
 514                         buf[13] = '-';
 515                 buf[14] = ':';
 516                 buf[15] = '\0';
 517                 error = str_append(dstr, buf);
 518         } else {
 519                 /*
 520                  * If ACE is a directory, but inheritance indicates its
 521                  * for a file then print permissions for file rather than
 522                  * dir.
 523                  */
 524                 if (isdir) {
 525                         if (mask & ACE_LIST_DIRECTORY) {
 526                                 if (iflags == ACE_FILE_INHERIT_ACE) {
 527                                         error = str_append(dstr,
 528                                             READ_DATA_TXT);
 529                                 } else {
 530                                         error =
 531                                             str_append(dstr, READ_DIR_TXT);
 532                                 }
 533                         }
 534                         if (error == 0 && (mask & ACE_ADD_FILE)) {
 535                                 if (iflags == ACE_FILE_INHERIT_ACE) {
 536                                         error =
 537                                             str_append(dstr, WRITE_DATA_TXT);
 538                                 } else {
 539                                         error =
 540                                             str_append(dstr, ADD_FILE_TXT);
 541                                 }
 542                         }
 543                         if (error == 0 && (mask & ACE_ADD_SUBDIRECTORY)) {
 544                                 if (iflags == ACE_FILE_INHERIT_ACE) {
 545                                         error = str_append(dstr,
 546                                             APPEND_DATA_TXT);
 547                                 } else {
 548                                         error = str_append(dstr,
 549                                             ADD_DIR_TXT);
 550                                 }
 551                         }
 552                 } else {
 553                         if (mask & ACE_READ_DATA) {
 554                                 error = str_append(dstr, READ_DATA_TXT);
 555                         }
 556                         if (error == 0 && (mask & ACE_WRITE_DATA)) {
 557                                 error = str_append(dstr, WRITE_DATA_TXT);
 558                         }
 559                         if (error == 0 && (mask & ACE_APPEND_DATA)) {
 560                                 error = str_append(dstr, APPEND_DATA_TXT);
 561                         }
 562                 }
 563                 if (error == 0 && (mask & ACE_READ_NAMED_ATTRS)) {
 564                         error = str_append(dstr, READ_XATTR_TXT);
 565                 }
 566                 if (error == 0 && (mask & ACE_WRITE_NAMED_ATTRS)) {
 567                         error = str_append(dstr, WRITE_XATTR_TXT);
 568                 }
 569                 if (error == 0 && (mask & ACE_EXECUTE)) {
 570                         error = str_append(dstr, EXECUTE_TXT);
 571                 }
 572                 if (error == 0 && (mask & ACE_DELETE_CHILD)) {
 573                         error = str_append(dstr, DELETE_CHILD_TXT);
 574                 }
 575                 if (error == 0 && (mask & ACE_READ_ATTRIBUTES)) {
 576                         error = str_append(dstr, READ_ATTRIBUTES_TXT);
 577                 }
 578                 if (error == 0 && (mask & ACE_WRITE_ATTRIBUTES)) {
 579                         error = str_append(dstr, WRITE_ATTRIBUTES_TXT);
 580                 }
 581                 if (error == 0 && (mask & ACE_DELETE)) {
 582                         error = str_append(dstr, DELETE_TXT);
 583                 }
 584                 if (error == 0 && (mask & ACE_READ_ACL)) {
 585                         error = str_append(dstr, READ_ACL_TXT);
 586                 }
 587                 if (error == 0 && (mask & ACE_WRITE_ACL)) {
 588                         error = str_append(dstr, WRITE_ACL_TXT);
 589                 }
 590                 if (error == 0 && (mask & ACE_WRITE_OWNER)) {
 591                         error = str_append(dstr, WRITE_OWNER_TXT);
 592                 }
 593                 if (error == 0 && (mask & ACE_SYNCHRONIZE)) {
 594                         error = str_append(dstr, SYNCHRONIZE_TXT);
 595                 }
 596                 if (error == 0 && dstr->d_aclexport[dstr->d_pos-1] == '/') {
 597                         dstr->d_aclexport[--dstr->d_pos] = '\0';
 598                 }
 599                 if (error == 0)
 600                         error = str_append(dstr, ":");
 601         }
 602         return (error);
 603 }
 604
 605 /*
 606  * compute string of access type, such as allow, deny, ...
 607  */
 608 static int
 609 ace_access_txt(dynaclstr_t *dstr, int type)
 610 {
 611         int error;
 612
 613         if (type == ACE_ACCESS_ALLOWED_ACE_TYPE)
 614                 error = str_append(dstr, ALLOW_TXT);
 615         else if (type == ACE_ACCESS_DENIED_ACE_TYPE)
 616                 error = str_append(dstr, DENY_TXT);
 617         else if (type == ACE_SYSTEM_AUDIT_ACE_TYPE)
 618                 error = str_append(dstr, AUDIT_TXT);
 619         else if (type == ACE_SYSTEM_ALARM_ACE_TYPE)
 620                 error = str_append(dstr, ALARM_TXT);
 621         else
 622                 error = str_append(dstr, UNKNOWN_TXT);
 623
 624         return (error);
 625 }
 626
 627 static int
 628 ace_inherit_txt(dynaclstr_t *dstr, uint32_t iflags, int flags)
 629 {
 630         int error = 0;
 631
 632         if (flags & ACL_COMPACT_FMT) {
 633                 char buf[9];
 634
 635                 if (iflags & ACE_FILE_INHERIT_ACE)
 636                         buf[0] = 'f';
 637                 else
 638                         buf[0] = '-';
 639                 if (iflags & ACE_DIRECTORY_INHERIT_ACE)
 640                         buf[1] = 'd';
 641                 else
 642                         buf[1] = '-';
 643                 if (iflags & ACE_INHERIT_ONLY_ACE)
 644                         buf[2] = 'i';
 645                 else
 646                         buf[2] = '-';
 647                 if (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)
 648                         buf[3] = 'n';
 649                 else
 650                         buf[3] = '-';
 651                 if (iflags & ACE_SUCCESSFUL_ACCESS_ACE_FLAG)
 652                         buf[4] = 'S';
 653                 else
 654                         buf[4] = '-';
 655                 if (iflags & ACE_FAILED_ACCESS_ACE_FLAG)
 656                         buf[5] = 'F';
 657                 else
 658                         buf[5] = '-';
 659                 if (iflags & ACE_INHERITED_ACE)
 660                         buf[6] = 'I';
 661                 else
 662                         buf[6] = '-';
 663                 buf[7] = ':';
 664                 buf[8] = '\0';
 665                 error = str_append(dstr, buf);
 666         } else {
 667                 if (iflags & ACE_FILE_INHERIT_ACE) {
 668                         error = str_append(dstr, FILE_INHERIT_TXT);
 669                 }
 670                 if (error == 0 && (iflags & ACE_DIRECTORY_INHERIT_ACE)) {
 671                         error = str_append(dstr, DIR_INHERIT_TXT);
 672                 }
 673                 if (error == 0 && (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) {
 674                         error = str_append(dstr, NO_PROPAGATE_TXT);
 675                 }
 676                 if (error == 0 && (iflags & ACE_INHERIT_ONLY_ACE)) {
 677                         error = str_append(dstr, INHERIT_ONLY_TXT);
 678                 }
 679                 if (error == 0 && (iflags & ACE_SUCCESSFUL_ACCESS_ACE_FLAG)) {
 680                         error = str_append(dstr, SUCCESSFUL_ACCESS_TXT);
 681                 }
 682                 if (error == 0 && (iflags & ACE_FAILED_ACCESS_ACE_FLAG)) {
 683                         error = str_append(dstr, FAILED_ACCESS_TXT);
 684                 }
 685                 if (error == 0 && (iflags & ACE_INHERITED_ACE)) {
 686                         error = str_append(dstr, INHERITED_ACE_TXT);
 687                 }
 688                 if (error == 0 && dstr->d_aclexport[dstr->d_pos-1] == '/') {
 689                         dstr->d_aclexport[--dstr->d_pos] = '\0';
 690                         error = str_append(dstr, ":");
 691                 }
 692         }
 693
 694         return (error);
 695 }
 696
 697 /*
 698  * Convert internal acl representation to external representation.
 699  *
 700  * The length of a non-owning user name or non-owning group name ie entries
 701  * of type DEF_USER, USER, DEF_GROUP or GROUP, can exceed LOGNAME_MAX.  We
 702  * thus check the length of these entries, and if greater than LOGNAME_MAX,
 703  * we realloc() via increase_length().
 704  *
 705  * The LOGNAME_MAX, ENTRYTYPELEN and PERMS limits are otherwise always
 706  * adhered to.
 707  */
 708
 709 /*
 710  * acltotext() converts each ACL entry to look like this:
 711  *
 712  *    entry_type:uid^gid^name:perms[:id]
 713  *
 714  * The maximum length of entry_type is 14 ("defaultgroup::" and
 715  * "defaultother::") hence ENTRYTYPELEN is set to 14.
 716  *
 717  * The max length of a uid^gid^name entry (in theory) is 8, hence we use,
 718  * however the ID could be a number so we therefore use ID_STR_MAX
 719  *
 720  * The length of a perms entry is 4 to allow for the comma appended to each
 721  * to each acl entry.  Hence PERMS is set to 4.
 722  */
 723
 724 #define ENTRYTYPELEN    14
 725 #define PERMS           4
 726 #define ACL_ENTRY_SIZE  (ENTRYTYPELEN + ID_STR_MAX + PERMS + APPENDED_ID_MAX)
 727
 728 char *
 729 aclent_acltotext(aclent_t  *aclp, int aclcnt, int flags)
 730 {
 731         dynaclstr_t     *dstr;
 732         char            *aclexport = NULL;
 733         int             i;
 734         int             error = 0;
 735
 736         if (aclp == NULL)
 737                 return (NULL);
 738         if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
 739                 return (NULL);
 740         dstr->d_bufsize = aclcnt * ACL_ENTRY_SIZE;
 741         if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
 742                 free(dstr);
 743                 return (NULL);
 744         }
 745         *dstr->d_aclexport = '\0';
 746         dstr->d_pos = 0;
 747
 748         for (i = 0; i < aclcnt; i++, aclp++) {
 749                 if (error = aclent_type_txt(dstr, aclp, flags))
 750                         break;
 751                 if (error = aclent_perm_txt(dstr, aclp->a_perm))
 752                         break;
 753
 754                 if ((flags & ACL_APPEND_ID) && ((aclp->a_type == USER) ||
 755                     (aclp->a_type == DEF_USER) || (aclp->a_type == GROUP) ||
 756                     (aclp->a_type == DEF_GROUP))) {
 757                         char id[ID_STR_MAX], *idstr;
 758
 759                         if (error = str_append(dstr, ":"))
 760                                 break;
 761                         id[ID_STR_MAX - 1] = '\0'; /* null terminate buffer */
 762                         idstr = lltostr(aclp->a_id, &id[ID_STR_MAX - 1]);
 763                         if (error = str_append(dstr, idstr))
 764                                 break;
 765                 }
 766                 if (i < aclcnt - 1)
 767                         if (error = str_append(dstr, ","))
 768                                 break;
 769         }
 770         if (error) {
 771                 free(dstr->d_aclexport);
 772         } else {
 773                 aclexport = dstr->d_aclexport;
 774         }
 775         free(dstr);
 776         return (aclexport);
 777 }
 778
 779 char *
 780 acltotext(aclent_t *aclp, int aclcnt)
 781 {
 782         return (aclent_acltotext(aclp, aclcnt, 0));
 783 }
 784
 785
 786 aclent_t *
 787 aclfromtext(char *aclstr, int *aclcnt)
 788 {
 789         acl_t *aclp;
 790         aclent_t *aclentp;
 791         int error;
 792
 793         error = acl_fromtext(aclstr, &aclp);
 794         if (error)
 795                 return (NULL);
 796
 797         aclentp = aclp->acl_aclp;
 798         aclp->acl_aclp = NULL;
 799         *aclcnt = aclp->acl_cnt;
 800
 801         acl_free(aclp);
 802         return (aclentp);
 803 }
 804
 805
 806 /*
 807  * Append string onto dynaclstr_t.
 808  *
 809  * Return 0 on success, 1 for failure.
 810  */
 811 static int
 812 str_append(dynaclstr_t *dstr, char *newstr)
 813 {
 814         size_t len = strlen(newstr);
 815
 816         if ((len + dstr->d_pos) >= dstr->d_bufsize) {
 817                 dstr->d_aclexport = realloc(dstr->d_aclexport,
 818                     dstr->d_bufsize + len + 1);
 819                 if (dstr->d_aclexport == NULL)
 820                         return (1);
 821                 dstr->d_bufsize += len;
 822         }
 823         (void) strcat(&dstr->d_aclexport[dstr->d_pos], newstr);
 824         dstr->d_pos += len;
 825         return (0);
 826 }
 827
 828 static int
 829 aclent_perm_txt(dynaclstr_t *dstr, o_mode_t perm)
 830 {
 831         char buf[4];
 832
 833         if (perm & S_IROTH)
 834                 buf[0] = 'r';
 835         else
 836                 buf[0] = '-';
 837         if (perm & S_IWOTH)
 838                 buf[1] = 'w';
 839         else
 840                 buf[1] = '-';
 841         if (perm & S_IXOTH)
 842                 buf[2] = 'x';
 843         else
 844                 buf[2] = '-';
 845         buf[3] = '\0';
 846         return (str_append(dstr, buf));
 847 }
 848
 849 /*
 850  * ace_acltotext() convert each ace formatted acl to look like this:
 851  *
 852  * entry_type:uid^gid^name:perms[:flags]:<allow|deny>[:id][,]
 853  *
 854  * The maximum length of entry_type is 5 ("group")
 855  *
 856  * The max length of a uid^gid^name entry (in theory) is 8,
 857  * however id could be a number so we therefore use ID_STR_MAX
 858  *
 859  * The length of a perms entry is 144 i.e read_data/write_data...
 860  * to each acl entry.
 861  *
 862  * iflags: file_inherit/dir_inherit/inherit_only/no_propagate/successful_access
 863  *         /failed_access
 864  *
 865  */
 866
 867 #define ACE_ENTRYTYPLEN         6
 868 #define IFLAGS_STR "file_inherit/dir_inherit/inherit_only/no_propagate/" \
 869         "successful_access/failed_access/inherited"
 870 #define IFLAGS_SIZE             (sizeof (IFLAGS_STR) - 1)
 871 #define ACCESS_TYPE_SIZE        7       /* if unknown */
 872 #define COLON_CNT               3
 873 #define PERMS_LEN               216
 874 #define ACE_ENTRY_SIZE  (ACE_ENTRYTYPLEN + ID_STR_MAX + PERMS_LEN + \
 875     ACCESS_TYPE_SIZE + IFLAGS_SIZE + COLON_CNT + APPENDED_ID_MAX)
 876
 877 static char *
 878 ace_acltotext(acl_t *aceaclp, int flags)
 879 {
 880         ace_t           *aclp = aceaclp->acl_aclp;
 881         int             aclcnt = aceaclp->acl_cnt;
 882         int             i;
 883         int             error = 0;
 884         int             isdir = (aceaclp->acl_flags & ACL_IS_DIR);
 885         dynaclstr_t     *dstr;
 886         char            *aclexport = NULL;
 887         char            *rawsidp = NULL;
 888
 889         if (aclp == NULL)
 890                 return (NULL);
 891
 892         if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
 893                 return (NULL);
 894         dstr->d_bufsize = aclcnt * ACL_ENTRY_SIZE;
 895         if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
 896                 free(dstr);
 897                 return (NULL);
 898         }
 899         *dstr->d_aclexport = '\0';
 900         dstr->d_pos = 0;
 901
 902         for (i = 0; i < aclcnt; i++, aclp++) {
 903
 904                 if (error = ace_type_txt(dstr, aclp, flags))
 905                         break;
 906                 if (error = ace_perm_txt(dstr, aclp->a_access_mask,
 907                     aclp->a_flags, isdir, flags))
 908                         break;
 909                 if (error = ace_inherit_txt(dstr, aclp->a_flags, flags))
 910                         break;
 911                 if (error = ace_access_txt(dstr, aclp->a_type))
 912                         break;
 913
 914                 if ((flags & ACL_APPEND_ID) &&
 915                     (((aclp->a_flags & ACE_TYPE_FLAGS) == 0) ||
 916                     ((aclp->a_flags & ACE_TYPE_FLAGS) ==
 917                     ACE_IDENTIFIER_GROUP))) {
 918                         char id[ID_STR_MAX], *idstr;
 919
 920                         if (error = str_append(dstr, ":"))
 921                                 break;
 922
 923                         rawsidp = NULL;
 924                         id[ID_STR_MAX -1] = '\0'; /* null terminate */
 925                         if (aclp->a_who > MAXUID && (flags & ACL_SID_FMT)) {
 926
 927                                 error = getsidname(aclp->a_who,
 928                                     ((aclp->a_flags & ACE_TYPE_FLAGS) == 0) ?
 929                                     B_TRUE : B_FALSE, &idstr, 1);
 930                                 rawsidp = idstr;
 931                                 if (error)
 932                                         break;
 933                         } else if (aclp->a_who > MAXUID &&
 934                             !(flags & ACL_NORESOLVE)) {
 935                                 idstr = lltostr(UID_NOBODY,
 936                                     &id[ID_STR_MAX - 1]);
 937                         } else {
 938                                 idstr = lltostr(aclp->a_who,
 939                                     &id[ID_STR_MAX - 1]);
 940                         }
 941                         if (error = str_append(dstr, idstr))
 942                                 break;
 943                         if (rawsidp) {
 944                                 free(rawsidp);
 945                                 rawsidp = NULL;
 946                         }
 947                 }
 948                 if (i < aclcnt - 1) {
 949                         if (error = str_append(dstr, ","))
 950                                 break;
 951                 }
 952         }
 953
 954         free(rawsidp);
 955         if (error) {
 956                 free(dstr->d_aclexport);
 957         } else {
 958                 aclexport = dstr->d_aclexport;
 959         }
 960         free(dstr);
 961         return (aclexport);
 962 }
 963
 964 char *
 965 acl_totext(acl_t *aclp, int flags)
 966 {
 967         char *txtp;
 968
 969         if (aclp == NULL)
 970                 return (NULL);
 971
 972         switch (aclp->acl_type) {
 973         case ACE_T:
 974                 txtp = ace_acltotext(aclp, flags);
 975                 break;
 976         case ACLENT_T:
 977                 txtp = aclent_acltotext(aclp->acl_aclp, aclp->acl_cnt, flags);
 978                 break;
 979         }
 980
 981         return (txtp);
 982 }
 983
 984 int
 985 acl_fromtext(const char *acltextp, acl_t **ret_aclp)
 986 {
 987         int error;
 988         char *buf;
 989
 990         buf = malloc(strlen(acltextp) + 2);
 991         if (buf == NULL)
 992                 return (EACL_MEM_ERROR);
 993         strcpy(buf, acltextp);
 994         strcat(buf, "\n");
 995
 996         (void) mutex_lock(&yymutex);
 997         yybuf = buf;
 998         yyreset();
 999         error = yyparse();
1000         free(buf);
1001
1002         if (yyacl) {
1003                 if (error == 0)
1004                         *ret_aclp = yyacl;
1005                 else {
1006                         acl_free(yyacl);
1007                 }
1008                 yyacl = NULL;
1009         }
1010         (void) mutex_unlock(&yymutex);
1011
1012         return (error);
1013 }
1014
1015 int
1016 acl_parse(const char *acltextp, acl_t **aclp)
1017 {
1018         int error;
1019
1020         yyinteractive = 1;
1021         error = acl_fromtext(acltextp, aclp);
1022         yyinteractive = 0;
1023         return (error);
1024 }
1025
1026 static void
1027 ace_compact_printacl(acl_t *aclp)
1028 {
1029         int cnt;
1030         ace_t *acep;
1031         dynaclstr_t *dstr;
1032         int len;
1033
1034         if ((dstr = malloc(sizeof (dynaclstr_t))) == NULL)
1035                 return;
1036         dstr->d_bufsize = ACE_ENTRY_SIZE;
1037         if ((dstr->d_aclexport = malloc(dstr->d_bufsize)) == NULL) {
1038                 free(dstr);
1039                 return;
1040         }
1041         *dstr->d_aclexport = '\0';
1042
1043         dstr->d_pos = 0;
1044         for (cnt = 0, acep = aclp->acl_aclp;
1045             cnt != aclp->acl_cnt; cnt++, acep++) {
1046                 dstr->d_aclexport[0] = '\0';
1047                 dstr->d_pos = 0;
1048
1049                 if (ace_type_txt(dstr, acep, 0))
1050                         break;
1051                 len = strlen(&dstr->d_aclexport[0]);
1052                 if (ace_perm_txt(dstr, acep->a_access_mask, acep->a_flags,
1053                     aclp->acl_flags & ACL_IS_DIR, ACL_COMPACT_FMT))
1054                         break;
1055                 if (ace_inherit_txt(dstr, acep->a_flags, ACL_COMPACT_FMT))
1056                         break;
1057                 if (ace_access_txt(dstr, acep->a_type) == -1)
1058                         break;
1059                 (void) printf("    %20.*s%s\n", len, dstr->d_aclexport,
1060                     &dstr->d_aclexport[len]);
1061         }
1062
1063         free(dstr->d_aclexport);
1064         free(dstr);
1065 }
1066
1067 static void
1068 ace_printacl(acl_t *aclp, int cols, int compact)
1069 {
1070         int  slot = 0;
1071         char *token;
1072         char *acltext;
1073
1074         if (compact) {
1075                 ace_compact_printacl(aclp);
1076                 return;
1077         }
1078
1079         acltext = acl_totext(aclp, 0);
1080
1081         if (acltext == NULL)
1082                 return;
1083
1084         token = strtok(acltext, ",");
1085         if (token == NULL) {
1086                 free(acltext);
1087                 return;
1088         }
1089
1090         do {
1091                 (void) printf("     %d:", slot++);
1092                 split_line(token, cols - 5);
1093         } while (token = strtok(NULL, ","));
1094         free(acltext);
1095 }
1096
1097 /*
1098  * pretty print an ACL.
1099  * For aclent_t ACL's the format is
1100  * similar to the old format used by getfacl,
1101  * with the addition of adding a "slot" number
1102  * before each entry.
1103  *
1104  * for ace_t ACL's the cols variable will break up
1105  * the long lines into multiple lines and will also
1106  * print a "slot" number.
1107  */
1108 void
1109 acl_printacl(acl_t *aclp, int cols, int compact)
1110 {
1111
1112         switch (aclp->acl_type) {
1113         case ACLENT_T:
1114                 aclent_printacl(aclp);
1115                 break;
1116         case ACE_T:
1117                 ace_printacl(aclp, cols, compact);
1118                 break;
1119         }
1120 }
1121
1122 typedef struct value_table {
1123         char            p_letter; /* perm letter such as 'r' */
1124         uint32_t        p_value; /* value for perm when pletter found */
1125 } value_table_t;
1126
1127 /*
1128  * The permission tables are laid out in positional order
1129  * a '-' character will indicate a permission at a given
1130  * position is not specified.  The '-' is not part of the
1131  * table, but will be checked for in the permission computation
1132  * routine.
1133  */
1134 value_table_t ace_perm_table[] = {
1135         { 'r', ACE_READ_DATA},
1136         { 'w', ACE_WRITE_DATA},
1137         { 'x', ACE_EXECUTE},
1138         { 'p', ACE_APPEND_DATA},
1139         { 'd', ACE_DELETE},
1140         { 'D', ACE_DELETE_CHILD},
1141         { 'a', ACE_READ_ATTRIBUTES},
1142         { 'A', ACE_WRITE_ATTRIBUTES},
1143         { 'R', ACE_READ_NAMED_ATTRS},
1144         { 'W', ACE_WRITE_NAMED_ATTRS},
1145         { 'c', ACE_READ_ACL},
1146         { 'C', ACE_WRITE_ACL},
1147         { 'o', ACE_WRITE_OWNER},
1148         { 's', ACE_SYNCHRONIZE}
1149 };
1150
1151 #define ACE_PERM_COUNT (sizeof (ace_perm_table) / sizeof (value_table_t))
1152
1153 value_table_t aclent_perm_table[] = {
1154         { 'r', S_IROTH},
1155         { 'w', S_IWOTH},
1156         { 'x', S_IXOTH}
1157 };
1158
1159 #define ACLENT_PERM_COUNT (sizeof (aclent_perm_table) / sizeof (value_table_t))
1160
1161 value_table_t inherit_table[] = {
1162         {'f', ACE_FILE_INHERIT_ACE},
1163         {'d', ACE_DIRECTORY_INHERIT_ACE},
1164         {'i', ACE_INHERIT_ONLY_ACE},
1165         {'n', ACE_NO_PROPAGATE_INHERIT_ACE},
1166         {'S', ACE_SUCCESSFUL_ACCESS_ACE_FLAG},
1167         {'F', ACE_FAILED_ACCESS_ACE_FLAG},
1168         {'I', ACE_INHERITED_ACE}
1169 };
1170
1171 #define IFLAG_COUNT (sizeof (inherit_table) / sizeof (value_table_t))
1172 #define IFLAG_COUNT_V1 6 /* Older version compatibility */
1173
1174 /*
1175  * compute value from a permission table or inheritance table
1176  * based on string passed in.  If positional is set then
1177  * string must match order in permtab, otherwise any order
1178  * is allowed.
1179  */
1180 int
1181 compute_values(value_table_t *permtab, int count,
1182     char *permstr, int positional, uint32_t *mask)
1183 {
1184         uint32_t perm_val = 0;
1185         char *pstr;
1186         int i, found;
1187
1188         if (count < 0)
1189                 return (1);
1190
1191         if (positional) {
1192                 for (i = 0, pstr = permstr; i != count && pstr &&
1193                     *pstr; i++, pstr++) {
1194                         if (*pstr == permtab[i].p_letter) {
1195                                 perm_val |= permtab[i].p_value;
1196                         } else if (*pstr != '-') {
1197                                 return (1);
1198                         }
1199                 }
1200         } else {  /* random order single letters with no '-' */
1201                 for (pstr = permstr; pstr && *pstr; pstr++) {
1202                         for (found = 0, i = 0; i != count; i++) {
1203                                 if (*pstr == permtab[i].p_letter) {
1204                                         perm_val |= permtab[i].p_value;
1205                                         found = 1;
1206                                         break;
1207                                 }
1208                         }
1209                         if (found == 0)
1210                                 return (1);
1211                 }
1212         }
1213
1214         *mask = perm_val;
1215         return (0);
1216 }
1217
1218
1219 int
1220 ace_inherit_helper(char *str, uint32_t *imask, int table_length)
1221 {
1222         int rc = 0;
1223
1224         if (strlen(str) == table_length) {
1225                 /*
1226                  * If the string == table_length then first check to see it's
1227                  * in positional format.  If that fails then see if it's in
1228                  * non-positional format.
1229                  */
1230                 if (compute_values(inherit_table, table_length, str,
1231                     1, imask) && compute_values(inherit_table,
1232                     table_length, str, 0, imask)) {
1233                         rc = 1;
1234                 }
1235         } else {
1236                 rc = compute_values(inherit_table, table_length, str, 0, imask);
1237         }
1238
1239         return (rc ? EACL_INHERIT_ERROR : 0);
1240 }
1241
1242 /*
1243  * compute value for inheritance flags.
1244  */
1245 int
1246 compute_ace_inherit(char *str, uint32_t *imask)
1247 {
1248         int rc = 0;
1249
1250         rc = ace_inherit_helper(str, imask, IFLAG_COUNT);
1251
1252         if (rc && strlen(str) != IFLAG_COUNT) {
1253
1254                 /* is it an old formatted inherit string? */
1255                 rc = ace_inherit_helper(str, imask, IFLAG_COUNT_V1);
1256         }
1257
1258         return (rc);
1259 }
1260
1261
1262 /*
1263  * compute value for ACE permissions.
1264  */
1265 int
1266 compute_ace_perms(char *str, uint32_t *mask)
1267 {
1268         int positional = 0;
1269         int error;
1270
1271         if (strlen(str) == ACE_PERM_COUNT)
1272                 positional = 1;
1273
1274         error = compute_values(ace_perm_table, ACE_PERM_COUNT,
1275             str, positional, mask);
1276
1277         if (error && positional) {
1278                 /*
1279                  * If positional was set, then make sure permissions
1280                  * aren't actually valid in non positional case where
1281                  * all permissions are specified, just in random order.
1282                  */
1283                 error = compute_values(ace_perm_table,
1284                     ACE_PERM_COUNT, str, 0, mask);
1285         }
1286         if (error)
1287                 error = EACL_PERM_MASK_ERROR;
1288
1289         return (error);
1290 }
1291
1292
1293
1294 /*
1295  * compute values for aclent permissions.
1296  */
1297 int
1298 compute_aclent_perms(char *str, o_mode_t *mask)
1299 {
1300         int error;
1301         uint32_t pmask;
1302
1303         if (strlen(str) != ACLENT_PERM_COUNT)
1304                 return (EACL_PERM_MASK_ERROR);
1305
1306         *mask = 0;
1307         error = compute_values(aclent_perm_table, ACLENT_PERM_COUNT,
1308             str, 1, &pmask);
1309         if (error == 0) {
1310                 *mask = (o_mode_t)pmask;
1311         } else
1312                 error = EACL_PERM_MASK_ERROR;
1313         return (error);
1314 }
1315
1316 /*
1317  * determine ACE permissions.
1318  */
1319 int
1320 ace_perm_mask(struct acl_perm_type *aclperm, uint32_t *mask)
1321 {
1322         int error;
1323
1324         if (aclperm->perm_style == PERM_TYPE_EMPTY) {
1325                 *mask = 0;
1326                 return (0);
1327         }
1328
1329         if (aclperm->perm_style == PERM_TYPE_ACE) {
1330                 *mask = aclperm->perm_val;
1331                 return (0);
1332         }
1333
1334         error = compute_ace_perms(aclperm->perm_str, mask);
1335         if (error) {
1336                 acl_error(dgettext(TEXT_DOMAIN,
1337                     "Invalid permission(s) '%s' specified\n"),
1338                     aclperm->perm_str);
1339                 return (EACL_PERM_MASK_ERROR);
1340         }
1341
1342         return (0);
1343 }