Utilities/cmlibarchive/libarchive/archive_disk_acl_sunos.c

   1 /*-
   2  * Copyright (c) 2017 Martin Matuska
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include "archive_platform.h"
  27
  28 #if ARCHIVE_ACL_SUNOS
  29
  30 #ifdef HAVE_ERRNO_H
  31 #include <errno.h>
  32 #endif
  33 #ifdef HAVE_FCNTL_H
  34 #include <fcntl.h>
  35 #endif
  36 #ifdef HAVE_SYS_TYPES_H
  37 #include <sys/types.h>
  38 #endif
  39 #ifdef HAVE_SYS_ACL_H
  40 #define _ACL_PRIVATE /* For debugging */
  41 #include <sys/acl.h>
  42 #endif
  43
  44 #include "archive_entry.h"
  45 #include "archive_private.h"
  46 #include "archive_read_disk_private.h"
  47 #include "archive_write_disk_private.h"
  48
  49 typedef struct {
  50         const int a_perm;       /* Libarchive permission or flag */
  51         const int p_perm;       /* Platform permission or flag */
  52 } acl_perm_map_t;
  53
  54 static const acl_perm_map_t acl_posix_perm_map[] = {
  55         {ARCHIVE_ENTRY_ACL_EXECUTE, S_IXOTH },
  56         {ARCHIVE_ENTRY_ACL_WRITE, S_IWOTH },
  57         {ARCHIVE_ENTRY_ACL_READ, S_IROTH }
  58 };
  59
  60 static const int acl_posix_perm_map_size =
  61     (int)(sizeof(acl_posix_perm_map)/sizeof(acl_posix_perm_map[0]));
  62
  63 #if ARCHIVE_ACL_SUNOS_NFS4
  64 static const acl_perm_map_t acl_nfs4_perm_map[] = {
  65         {ARCHIVE_ENTRY_ACL_EXECUTE, ACE_EXECUTE},
  66         {ARCHIVE_ENTRY_ACL_READ_DATA, ACE_READ_DATA},
  67         {ARCHIVE_ENTRY_ACL_LIST_DIRECTORY, ACE_LIST_DIRECTORY},
  68         {ARCHIVE_ENTRY_ACL_WRITE_DATA, ACE_WRITE_DATA},
  69         {ARCHIVE_ENTRY_ACL_ADD_FILE, ACE_ADD_FILE},
  70         {ARCHIVE_ENTRY_ACL_APPEND_DATA, ACE_APPEND_DATA},
  71         {ARCHIVE_ENTRY_ACL_ADD_SUBDIRECTORY, ACE_ADD_SUBDIRECTORY},
  72         {ARCHIVE_ENTRY_ACL_READ_NAMED_ATTRS, ACE_READ_NAMED_ATTRS},
  73         {ARCHIVE_ENTRY_ACL_WRITE_NAMED_ATTRS, ACE_WRITE_NAMED_ATTRS},
  74         {ARCHIVE_ENTRY_ACL_DELETE_CHILD, ACE_DELETE_CHILD},
  75         {ARCHIVE_ENTRY_ACL_READ_ATTRIBUTES, ACE_READ_ATTRIBUTES},
  76         {ARCHIVE_ENTRY_ACL_WRITE_ATTRIBUTES, ACE_WRITE_ATTRIBUTES},
  77         {ARCHIVE_ENTRY_ACL_DELETE, ACE_DELETE},
  78         {ARCHIVE_ENTRY_ACL_READ_ACL, ACE_READ_ACL},
  79         {ARCHIVE_ENTRY_ACL_WRITE_ACL, ACE_WRITE_ACL},
  80         {ARCHIVE_ENTRY_ACL_WRITE_OWNER, ACE_WRITE_OWNER},
  81         {ARCHIVE_ENTRY_ACL_SYNCHRONIZE, ACE_SYNCHRONIZE}
  82 };
  83
  84 static const int acl_nfs4_perm_map_size =
  85     (int)(sizeof(acl_nfs4_perm_map)/sizeof(acl_nfs4_perm_map[0]));
  86
  87 static const acl_perm_map_t acl_nfs4_flag_map[] = {
  88         {ARCHIVE_ENTRY_ACL_ENTRY_FILE_INHERIT, ACE_FILE_INHERIT_ACE},
  89         {ARCHIVE_ENTRY_ACL_ENTRY_DIRECTORY_INHERIT, ACE_DIRECTORY_INHERIT_ACE},
  90         {ARCHIVE_ENTRY_ACL_ENTRY_NO_PROPAGATE_INHERIT, ACE_NO_PROPAGATE_INHERIT_ACE},
  91         {ARCHIVE_ENTRY_ACL_ENTRY_INHERIT_ONLY, ACE_INHERIT_ONLY_ACE},
  92         {ARCHIVE_ENTRY_ACL_ENTRY_SUCCESSFUL_ACCESS, ACE_SUCCESSFUL_ACCESS_ACE_FLAG},
  93         {ARCHIVE_ENTRY_ACL_ENTRY_FAILED_ACCESS, ACE_FAILED_ACCESS_ACE_FLAG},
  94 #ifdef ACE_INHERITED_ACE
  95         {ARCHIVE_ENTRY_ACL_ENTRY_INHERITED, ACE_INHERITED_ACE}
  96 #endif
  97 };
  98
  99 const int acl_nfs4_flag_map_size =
 100     (int)(sizeof(acl_nfs4_flag_map)/sizeof(acl_nfs4_flag_map[0]));
 101
 102 #endif /* ARCHIVE_ACL_SUNOS_NFS4 */
 103
 104 static void *
 105 sunacl_get(int cmd, int *aclcnt, int fd, const char *path)
 106 {
 107         int cnt, cntcmd;
 108         size_t size;
 109         void *aclp;
 110
 111         if (cmd == GETACL) {
 112                 cntcmd = GETACLCNT;
 113                 size = sizeof(aclent_t);
 114         }
 115 #if ARCHIVE_ACL_SUNOS_NFS4
 116         else if (cmd == ACE_GETACL) {
 117                 cntcmd = ACE_GETACLCNT;
 118                 size = sizeof(ace_t);
 119         }
 120 #endif
 121         else {
 122                 errno = EINVAL;
 123                 *aclcnt = -1;
 124                 return (NULL);
 125         }
 126
 127         aclp = NULL;
 128         cnt = -2;
 129
 130         while (cnt == -2 || (cnt == -1 && errno == ENOSPC)) {
 131                 if (path != NULL)
 132                         cnt = acl(path, cntcmd, 0, NULL);
 133                 else
 134                         cnt = facl(fd, cntcmd, 0, NULL);
 135
 136                 if (cnt > 0) {
 137                         if (aclp == NULL)
 138                                 aclp = malloc(cnt * size);
 139                         else
 140                                 aclp = realloc(NULL, cnt * size);
 141                         if (aclp != NULL) {
 142                                 if (path != NULL)
 143                                         cnt = acl(path, cmd, cnt, aclp);
 144                                 else
 145                                         cnt = facl(fd, cmd, cnt, aclp);
 146                         }
 147                 } else {
 148                         free(aclp);
 149                         aclp = NULL;
 150                         break;
 151                 }
 152         }
 153
 154         *aclcnt = cnt;
 155         return (aclp);
 156 }
 157
 158 /*
 159  * Check if acl is trivial
 160  * This is a FreeBSD acl_is_trivial_np() implementation for Solaris
 161  */
 162 static int
 163 sun_acl_is_trivial(void *aclp, int aclcnt, mode_t mode, int is_nfs4,
 164     int is_dir, int *trivialp)
 165 {
 166 #if ARCHIVE_ACL_SUNOS_NFS4
 167         int i, p;
 168         const uint32_t rperm = ACE_READ_DATA;
 169         const uint32_t wperm = ACE_WRITE_DATA | ACE_APPEND_DATA;
 170         const uint32_t eperm = ACE_EXECUTE;
 171         const uint32_t pubset = ACE_READ_ATTRIBUTES | ACE_READ_NAMED_ATTRS |
 172             ACE_READ_ACL | ACE_SYNCHRONIZE;
 173         const uint32_t ownset = pubset | ACE_WRITE_ATTRIBUTES |
 174             ACE_WRITE_NAMED_ATTRS | ACE_WRITE_ACL | ACE_WRITE_OWNER;
 175
 176         ace_t *ace;
 177         ace_t tace[6];
 178 #endif
 179
 180         if (aclp == NULL || trivialp == NULL)
 181                 return (-1);
 182
 183         *trivialp = 0;
 184
 185         /*
 186          * POSIX.1e ACLs marked with ACL_IS_TRIVIAL are compatible with
 187          * FreeBSD acl_is_trivial_np(). On Solaris they have 4 entries,
 188          * including mask.
 189          */
 190         if (!is_nfs4) {
 191                 if (aclcnt == 4)
 192                         *trivialp = 1;
 193                 return (0);
 194         }
 195
 196 #if ARCHIVE_ACL_SUNOS_NFS4
 197         /*
 198          * Continue with checking NFSv4 ACLs
 199          *
 200          * Create list of trivial ace's to be compared
 201          */
 202
 203         /* owner@ allow pre */
 204         tace[0].a_flags = ACE_OWNER;
 205         tace[0].a_type = ACE_ACCESS_ALLOWED_ACE_TYPE;
 206         tace[0].a_access_mask = 0;
 207
 208         /* owner@ deny */
 209         tace[1].a_flags = ACE_OWNER;
 210         tace[1].a_type = ACE_ACCESS_DENIED_ACE_TYPE;
 211         tace[1].a_access_mask = 0;
 212
 213         /* group@ deny */
 214         tace[2].a_flags = ACE_GROUP | ACE_IDENTIFIER_GROUP;
 215         tace[2].a_type = ACE_ACCESS_DENIED_ACE_TYPE;
 216         tace[2].a_access_mask = 0;
 217
 218         /* owner@ allow */
 219         tace[3].a_flags = ACE_OWNER;
 220         tace[3].a_type = ACE_ACCESS_ALLOWED_ACE_TYPE;
 221         tace[3].a_access_mask = ownset;
 222
 223         /* group@ allow */
 224         tace[4].a_flags = ACE_GROUP | ACE_IDENTIFIER_GROUP;
 225         tace[4].a_type = ACE_ACCESS_ALLOWED_ACE_TYPE;
 226         tace[4].a_access_mask = pubset;
 227
 228         /* everyone@ allow */
 229         tace[5].a_flags = ACE_EVERYONE;
 230         tace[5].a_type = ACE_ACCESS_ALLOWED_ACE_TYPE;
 231         tace[5].a_access_mask = pubset;
 232
 233         /* Permissions for everyone@ */
 234         if (mode & 0004)
 235                 tace[5].a_access_mask |= rperm;
 236         if (mode & 0002)
 237                 tace[5].a_access_mask |= wperm;
 238         if (mode & 0001)
 239                 tace[5].a_access_mask |= eperm;
 240
 241         /* Permissions for group@ */
 242         if (mode & 0040)
 243                 tace[4].a_access_mask |= rperm;
 244         else if (mode & 0004)
 245                 tace[2].a_access_mask |= rperm;
 246         if (mode & 0020)
 247                 tace[4].a_access_mask |= wperm;
 248         else if (mode & 0002)
 249                 tace[2].a_access_mask |= wperm;
 250         if (mode & 0010)
 251                 tace[4].a_access_mask |= eperm;
 252         else if (mode & 0001)
 253                 tace[2].a_access_mask |= eperm;
 254
 255         /* Permissions for owner@ */
 256         if (mode & 0400) {
 257                 tace[3].a_access_mask |= rperm;
 258                 if (!(mode & 0040) && (mode & 0004))
 259                         tace[0].a_access_mask |= rperm;
 260         } else if ((mode & 0040) || (mode & 0004))
 261                 tace[1].a_access_mask |= rperm;
 262         if (mode & 0200) {
 263                 tace[3].a_access_mask |= wperm;
 264                 if (!(mode & 0020) && (mode & 0002))
 265                         tace[0].a_access_mask |= wperm;
 266         } else if ((mode & 0020) || (mode & 0002))
 267                 tace[1].a_access_mask |= wperm;
 268         if (mode & 0100) {
 269                 tace[3].a_access_mask |= eperm;
 270                 if (!(mode & 0010) && (mode & 0001))
 271                         tace[0].a_access_mask |= eperm;
 272         } else if ((mode & 0010) || (mode & 0001))
 273                 tace[1].a_access_mask |= eperm;
 274
 275         /* Check if the acl count matches */
 276         p = 3;
 277         for (i = 0; i < 3; i++) {
 278                 if (tace[i].a_access_mask != 0)
 279                         p++;
 280         }
 281         if (aclcnt != p)
 282                 return (0);
 283
 284         p = 0;
 285         for (i = 0; i < 6; i++) {
 286                 if (tace[i].a_access_mask != 0) {
 287                         ace = &((ace_t *)aclp)[p];
 288                         /*
 289                          * Illumos added ACE_DELETE_CHILD to write perms for
 290                          * directories. We have to check against that, too.
 291                          */
 292                         if (ace->a_flags != tace[i].a_flags ||
 293                             ace->a_type != tace[i].a_type ||
 294                             (ace->a_access_mask != tace[i].a_access_mask &&
 295                             (!is_dir || (tace[i].a_access_mask & wperm) == 0 ||
 296                             ace->a_access_mask !=
 297                             (tace[i].a_access_mask | ACE_DELETE_CHILD))))
 298                                 return (0);
 299                         p++;
 300                 }
 301         }
 302
 303         *trivialp = 1;
 304 #else   /* !ARCHIVE_ACL_SUNOS_NFS4 */
 305         (void)is_dir;   /* UNUSED */
 306         (void)aclp;     /* UNUSED */
 307 #endif  /* !ARCHIVE_ACL_SUNOS_NFS4 */
 308         return (0);
 309 }
 310
 311 /*
 312  * Translate Solaris POSIX.1e and NFSv4 ACLs into libarchive internal ACL
 313  */
 314 static int
 315 translate_acl(struct archive_read_disk *a,
 316     struct archive_entry *entry, void *aclp, int aclcnt,
 317     int default_entry_acl_type)
 318 {
 319         int e, i;
 320         int ae_id, ae_tag, ae_perm;
 321         int entry_acl_type;
 322         const char *ae_name;
 323         aclent_t *aclent;
 324 #if ARCHIVE_ACL_SUNOS_NFS4
 325         ace_t *ace;
 326 #endif
 327
 328         if (aclcnt <= 0)
 329                 return (ARCHIVE_OK);
 330
 331         for (e = 0; e < aclcnt; e++) {
 332                 ae_name = NULL;
 333                 ae_tag = 0;
 334                 ae_perm = 0;
 335
 336 #if ARCHIVE_ACL_SUNOS_NFS4
 337                 if (default_entry_acl_type == ARCHIVE_ENTRY_ACL_TYPE_NFS4) {
 338                         ace = &((ace_t *)aclp)[e];
 339                         ae_id = ace->a_who;
 340
 341                         switch(ace->a_type) {
 342                         case ACE_ACCESS_ALLOWED_ACE_TYPE:
 343                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ALLOW;
 344                                 break;
 345                         case ACE_ACCESS_DENIED_ACE_TYPE:
 346                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_DENY;
 347                                 break;
 348                         case ACE_SYSTEM_AUDIT_ACE_TYPE:
 349                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ACCESS;
 350                                 break;
 351                         case ACE_SYSTEM_ALARM_ACE_TYPE:
 352                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ALARM;
 353                                 break;
 354                         default:
 355                                 /* Unknown entry type, skip */
 356                                 continue;
 357                         }
 358
 359                         if ((ace->a_flags & ACE_OWNER) != 0)
 360                                 ae_tag = ARCHIVE_ENTRY_ACL_USER_OBJ;
 361                         else if ((ace->a_flags & ACE_GROUP) != 0)
 362                                 ae_tag = ARCHIVE_ENTRY_ACL_GROUP_OBJ;
 363                         else if ((ace->a_flags & ACE_EVERYONE) != 0)
 364                                 ae_tag = ARCHIVE_ENTRY_ACL_EVERYONE;
 365                         else if ((ace->a_flags & ACE_IDENTIFIER_GROUP) != 0) {
 366                                 ae_tag = ARCHIVE_ENTRY_ACL_GROUP;
 367                                 ae_name = archive_read_disk_gname(&a->archive,
 368                                     ae_id);
 369                         } else {
 370                                 ae_tag = ARCHIVE_ENTRY_ACL_USER;
 371                                 ae_name = archive_read_disk_uname(&a->archive,
 372                                     ae_id);
 373                         }
 374
 375                         for (i = 0; i < acl_nfs4_flag_map_size; ++i) {
 376                                 if ((ace->a_flags &
 377                                     acl_nfs4_flag_map[i].p_perm) != 0)
 378                                         ae_perm |= acl_nfs4_flag_map[i].a_perm;
 379                         }
 380
 381                         for (i = 0; i < acl_nfs4_perm_map_size; ++i) {
 382                                 if ((ace->a_access_mask &
 383                                     acl_nfs4_perm_map[i].p_perm) != 0)
 384                                         ae_perm |= acl_nfs4_perm_map[i].a_perm;
 385                         }
 386                 } else
 387 #endif  /* ARCHIVE_ACL_SUNOS_NFS4 */
 388                 if (default_entry_acl_type == ARCHIVE_ENTRY_ACL_TYPE_ACCESS) {
 389                         aclent = &((aclent_t *)aclp)[e];
 390                         if ((aclent->a_type & ACL_DEFAULT) != 0)
 391                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_DEFAULT;
 392                         else
 393                                 entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ACCESS;
 394                         ae_id = aclent->a_id;
 395
 396                         switch(aclent->a_type) {
 397                         case DEF_USER:
 398                         case USER:
 399                                 ae_name = archive_read_disk_uname(&a->archive,
 400                                     ae_id);
 401                                 ae_tag = ARCHIVE_ENTRY_ACL_USER;
 402                                 break;
 403                         case DEF_GROUP:
 404                         case GROUP:
 405                                 ae_name = archive_read_disk_gname(&a->archive,
 406                                     ae_id);
 407                                 ae_tag = ARCHIVE_ENTRY_ACL_GROUP;
 408                                 break;
 409                         case DEF_CLASS_OBJ:
 410                         case CLASS_OBJ:
 411                                 ae_tag = ARCHIVE_ENTRY_ACL_MASK;
 412                                 break;
 413                         case DEF_USER_OBJ:
 414                         case USER_OBJ:
 415                                 ae_tag = ARCHIVE_ENTRY_ACL_USER_OBJ;
 416                                 break;
 417                         case DEF_GROUP_OBJ:
 418                         case GROUP_OBJ:
 419                                 ae_tag = ARCHIVE_ENTRY_ACL_GROUP_OBJ;
 420                                 break;
 421                         case DEF_OTHER_OBJ:
 422                         case OTHER_OBJ:
 423                                 ae_tag = ARCHIVE_ENTRY_ACL_OTHER;
 424                                 break;
 425                         default:
 426                                 /* Unknown tag type, skip */
 427                                 continue;
 428                         }
 429
 430                         for (i = 0; i < acl_posix_perm_map_size; ++i) {
 431                                 if ((aclent->a_perm &
 432                                     acl_posix_perm_map[i].p_perm) != 0)
 433                                         ae_perm |= acl_posix_perm_map[i].a_perm;
 434                         }
 435                 } else
 436                         return (ARCHIVE_WARN);
 437
 438                 archive_entry_acl_add_entry(entry, entry_acl_type,
 439                     ae_perm, ae_tag, ae_id, ae_name);
 440         }
 441         return (ARCHIVE_OK);
 442 }
 443
 444 static int
 445 set_acl(struct archive *a, int fd, const char *name,
 446     struct archive_acl *abstract_acl,
 447     int ae_requested_type, const char *tname)
 448 {
 449         aclent_t         *aclent;
 450 #if ARCHIVE_ACL_SUNOS_NFS4
 451         ace_t            *ace;
 452 #endif
 453         int              cmd, e, r;
 454         void             *aclp;
 455         int              ret;
 456         int              ae_type, ae_permset, ae_tag, ae_id;
 457         int              perm_map_size;
 458         const acl_perm_map_t    *perm_map;
 459         uid_t            ae_uid;
 460         gid_t            ae_gid;
 461         const char      *ae_name;
 462         int              entries;
 463         int              i;
 464
 465         ret = ARCHIVE_OK;
 466         entries = archive_acl_reset(abstract_acl, ae_requested_type);
 467         if (entries == 0)
 468                 return (ARCHIVE_OK);
 469
 470
 471         switch (ae_requested_type) {
 472         case ARCHIVE_ENTRY_ACL_TYPE_POSIX1E:
 473                 cmd = SETACL;
 474                 aclp = malloc(entries * sizeof(aclent_t));
 475                 break;
 476 #if ARCHIVE_ACL_SUNOS_NFS4
 477         case ARCHIVE_ENTRY_ACL_TYPE_NFS4:
 478                 cmd = ACE_SETACL;
 479                 aclp = malloc(entries * sizeof(ace_t));
 480
 481                 break;
 482 #endif
 483         default:
 484                 errno = ENOENT;
 485                 archive_set_error(a, errno, "Unsupported ACL type");
 486                 return (ARCHIVE_FAILED);
 487         }
 488
 489         if (aclp == NULL) {
 490                 archive_set_error(a, errno,
 491                     "Can't allocate memory for acl buffer");
 492                 return (ARCHIVE_FAILED);
 493         }
 494
 495         e = 0;
 496
 497         while (archive_acl_next(a, abstract_acl, ae_requested_type, &ae_type,
 498                    &ae_permset, &ae_tag, &ae_id, &ae_name) == ARCHIVE_OK) {
 499                 aclent = NULL;
 500 #if ARCHIVE_ACL_SUNOS_NFS4
 501                 ace = NULL;
 502 #endif
 503                 if (cmd == SETACL) {
 504                         aclent = &((aclent_t *)aclp)[e];
 505                         aclent->a_id = -1;
 506                         aclent->a_type = 0;
 507                         aclent->a_perm = 0;
 508                 }
 509 #if ARCHIVE_ACL_SUNOS_NFS4
 510                 else {  /* cmd == ACE_SETACL */
 511                         ace = &((ace_t *)aclp)[e];
 512                         ace->a_who = -1;
 513                         ace->a_access_mask = 0;
 514                         ace->a_flags = 0;
 515                 }
 516 #endif  /* ARCHIVE_ACL_SUNOS_NFS4 */
 517
 518                 switch (ae_tag) {
 519                 case ARCHIVE_ENTRY_ACL_USER:
 520                         ae_uid = archive_write_disk_uid(a, ae_name, ae_id);
 521                         if (aclent != NULL) {
 522                                 aclent->a_id = ae_uid;
 523                                 aclent->a_type |= USER;
 524                         }
 525 #if ARCHIVE_ACL_SUNOS_NFS4
 526                         else {
 527                                 ace->a_who = ae_uid;
 528                         }
 529 #endif
 530                         break;
 531                 case ARCHIVE_ENTRY_ACL_GROUP:
 532                         ae_gid = archive_write_disk_gid(a, ae_name, ae_id);
 533                         if (aclent != NULL) {
 534                                 aclent->a_id = ae_gid;
 535                                 aclent->a_type |= GROUP;
 536                         }
 537 #if ARCHIVE_ACL_SUNOS_NFS4
 538                         else {
 539                                 ace->a_who = ae_gid;
 540                                 ace->a_flags |= ACE_IDENTIFIER_GROUP;
 541                         }
 542 #endif
 543                         break;
 544                 case ARCHIVE_ENTRY_ACL_USER_OBJ:
 545                         if (aclent != NULL)
 546                                 aclent->a_type |= USER_OBJ;
 547 #if ARCHIVE_ACL_SUNOS_NFS4
 548                         else {
 549                                 ace->a_flags |= ACE_OWNER;
 550                         }
 551 #endif
 552                         break;
 553                 case ARCHIVE_ENTRY_ACL_GROUP_OBJ:
 554                         if (aclent != NULL)
 555                                 aclent->a_type |= GROUP_OBJ;
 556 #if ARCHIVE_ACL_SUNOS_NFS4
 557                         else {
 558                                 ace->a_flags |= ACE_GROUP;
 559                                 ace->a_flags |= ACE_IDENTIFIER_GROUP;
 560                         }
 561 #endif
 562                         break;
 563                 case ARCHIVE_ENTRY_ACL_MASK:
 564                         if (aclent != NULL)
 565                                 aclent->a_type |= CLASS_OBJ;
 566                         break;
 567                 case ARCHIVE_ENTRY_ACL_OTHER:
 568                         if (aclent != NULL)
 569                                 aclent->a_type |= OTHER_OBJ;
 570                         break;
 571 #if ARCHIVE_ACL_SUNOS_NFS4
 572                 case ARCHIVE_ENTRY_ACL_EVERYONE:
 573                         if (ace != NULL)
 574                                 ace->a_flags |= ACE_EVERYONE;
 575                         break;
 576 #endif
 577                 default:
 578                         archive_set_error(a, ARCHIVE_ERRNO_MISC,
 579                             "Unsupported ACL tag");
 580                         ret = ARCHIVE_FAILED;
 581                         goto exit_free;
 582                 }
 583
 584                 r = 0;
 585                 switch (ae_type) {
 586 #if ARCHIVE_ACL_SUNOS_NFS4
 587                 case ARCHIVE_ENTRY_ACL_TYPE_ALLOW:
 588                         if (ace != NULL)
 589                                 ace->a_type = ACE_ACCESS_ALLOWED_ACE_TYPE;
 590                         else
 591                                 r = -1;
 592                         break;
 593                 case ARCHIVE_ENTRY_ACL_TYPE_DENY:
 594                         if (ace != NULL)
 595                                 ace->a_type = ACE_ACCESS_DENIED_ACE_TYPE;
 596                         else
 597                                 r = -1;
 598                         break;
 599                 case ARCHIVE_ENTRY_ACL_TYPE_AUDIT:
 600                         if (ace != NULL)
 601                                 ace->a_type = ACE_SYSTEM_AUDIT_ACE_TYPE;
 602                         else
 603                                 r = -1;
 604                         break;
 605                 case ARCHIVE_ENTRY_ACL_TYPE_ALARM:
 606                         if (ace != NULL)
 607                                 ace->a_type = ACE_SYSTEM_ALARM_ACE_TYPE;
 608                         else
 609                                 r = -1;
 610                         break;
 611 #endif
 612                 case ARCHIVE_ENTRY_ACL_TYPE_ACCESS:
 613                         if (aclent == NULL)
 614                                 r = -1;
 615                         break;
 616                 case ARCHIVE_ENTRY_ACL_TYPE_DEFAULT:
 617                         if (aclent != NULL)
 618                                 aclent->a_type |= ACL_DEFAULT;
 619                         else
 620                                 r = -1;
 621                         break;
 622                 default:
 623                         archive_set_error(a, ARCHIVE_ERRNO_MISC,
 624                             "Unsupported ACL entry type");
 625                         ret = ARCHIVE_FAILED;
 626                         goto exit_free;
 627                 }
 628
 629                 if (r != 0) {
 630                         errno = EINVAL;
 631                         archive_set_error(a, errno,
 632                             "Failed to set ACL entry type");
 633                         ret = ARCHIVE_FAILED;
 634                         goto exit_free;
 635                 }
 636
 637 #if ARCHIVE_ACL_SUNOS_NFS4
 638                 if (ae_requested_type == ARCHIVE_ENTRY_ACL_TYPE_NFS4) {
 639                         perm_map_size = acl_nfs4_perm_map_size;
 640                         perm_map = acl_nfs4_perm_map;
 641                 } else {
 642 #endif
 643                         perm_map_size = acl_posix_perm_map_size;
 644                         perm_map = acl_posix_perm_map;
 645 #if ARCHIVE_ACL_SUNOS_NFS4
 646                 }
 647 #endif
 648                 for (i = 0; i < perm_map_size; ++i) {
 649                         if (ae_permset & perm_map[i].a_perm) {
 650 #if ARCHIVE_ACL_SUNOS_NFS4
 651                                 if (ae_requested_type ==
 652                                     ARCHIVE_ENTRY_ACL_TYPE_NFS4)
 653                                         ace->a_access_mask |=
 654                                             perm_map[i].p_perm;
 655                                 else
 656 #endif
 657                                         aclent->a_perm |= perm_map[i].p_perm;
 658                         }
 659                 }
 660
 661 #if ARCHIVE_ACL_SUNOS_NFS4
 662                 if (ae_requested_type == ARCHIVE_ENTRY_ACL_TYPE_NFS4) {
 663                         for (i = 0; i < acl_nfs4_flag_map_size; ++i) {
 664                                 if (ae_permset & acl_nfs4_flag_map[i].a_perm) {
 665                                         ace->a_flags |=
 666                                             acl_nfs4_flag_map[i].p_perm;
 667                                 }
 668                         }
 669                 }
 670 #endif
 671         e++;
 672         }
 673
 674         /* Try restoring the ACL through 'fd' if we can. */
 675         if (fd >= 0) {
 676                 if (facl(fd, cmd, entries, aclp) == 0)
 677                         ret = ARCHIVE_OK;
 678                 else {
 679                         if (errno == EOPNOTSUPP) {
 680                                 /* Filesystem doesn't support ACLs */
 681                                 ret = ARCHIVE_OK;
 682                         } else {
 683                                 archive_set_error(a, errno,
 684                                     "Failed to set acl on fd: %s", tname);
 685                                 ret = ARCHIVE_WARN;
 686                         }
 687                 }
 688         } else if (acl(name, cmd, entries, aclp) != 0) {
 689                 if (errno == EOPNOTSUPP) {
 690                         /* Filesystem doesn't support ACLs */
 691                         ret = ARCHIVE_OK;
 692                 } else {
 693                         archive_set_error(a, errno, "Failed to set acl: %s",
 694                             tname);
 695                         ret = ARCHIVE_WARN;
 696                 }
 697         }
 698 exit_free:
 699         free(aclp);
 700         return (ret);
 701 }
 702
 703 int
 704 archive_read_disk_entry_setup_acls(struct archive_read_disk *a,
 705     struct archive_entry *entry, int *fd)
 706 {
 707         const char      *accpath;
 708         void            *aclp;
 709         int             aclcnt;
 710         int             r;
 711
 712         accpath = NULL;
 713
 714         if (*fd < 0) {
 715                 accpath = archive_read_disk_entry_setup_path(a, entry, fd);
 716                 if (accpath == NULL)
 717                         return (ARCHIVE_WARN);
 718         }
 719
 720         archive_entry_acl_clear(entry);
 721
 722         aclp = NULL;
 723
 724 #if ARCHIVE_ACL_SUNOS_NFS4
 725         if (*fd >= 0)
 726                 aclp = sunacl_get(ACE_GETACL, &aclcnt, *fd, NULL);
 727         else if ((!a->follow_symlinks)
 728             && (archive_entry_filetype(entry) == AE_IFLNK))
 729                 /* We can't get the ACL of a symlink, so we assume it can't
 730                    have one. */
 731                 aclp = NULL;
 732         else
 733                 aclp = sunacl_get(ACE_GETACL, &aclcnt, 0, accpath);
 734
 735         if (aclp != NULL && sun_acl_is_trivial(aclp, aclcnt,
 736             archive_entry_mode(entry), 1, S_ISDIR(archive_entry_mode(entry)),
 737             &r) == 0 && r == 1) {
 738                 free(aclp);
 739                 aclp = NULL;
 740                 return (ARCHIVE_OK);
 741         }
 742
 743         if (aclp != NULL) {
 744                 r = translate_acl(a, entry, aclp, aclcnt,
 745                     ARCHIVE_ENTRY_ACL_TYPE_NFS4);
 746                 free(aclp);
 747                 aclp = NULL;
 748
 749                 if (r != ARCHIVE_OK) {
 750                         archive_set_error(&a->archive, errno,
 751                             "Couldn't translate NFSv4 ACLs");
 752                 }
 753                 return (r);
 754         }
 755 #endif  /* ARCHIVE_ACL_SUNOS_NFS4 */
 756
 757         /* Retrieve POSIX.1e ACLs from file. */
 758         if (*fd >= 0)
 759                 aclp = sunacl_get(GETACL, &aclcnt, *fd, NULL);
 760         else if ((!a->follow_symlinks)
 761             && (archive_entry_filetype(entry) == AE_IFLNK))
 762                 /* We can't get the ACL of a symlink, so we assume it can't
 763                    have one. */
 764                 aclp = NULL;
 765         else
 766                 aclp = sunacl_get(GETACL, &aclcnt, 0, accpath);
 767
 768         /* Ignore "trivial" ACLs that just mirror the file mode. */
 769         if (aclp != NULL && sun_acl_is_trivial(aclp, aclcnt,
 770             archive_entry_mode(entry), 0, S_ISDIR(archive_entry_mode(entry)),
 771             &r) == 0 && r == 1) {
 772                 free(aclp);
 773                 aclp = NULL;
 774         }
 775
 776         if (aclp != NULL)
 777         {
 778                 r = translate_acl(a, entry, aclp, aclcnt,
 779                     ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
 780                 free(aclp);
 781                 aclp = NULL;
 782
 783                 if (r != ARCHIVE_OK) {
 784                         archive_set_error(&a->archive, errno,
 785                             "Couldn't translate access ACLs");
 786                         return (r);
 787                 }
 788         }
 789
 790         return (ARCHIVE_OK);
 791 }
 792
 793 int
 794 archive_write_disk_set_acls(struct archive *a, int fd, const char *name,
 795     struct archive_acl *abstract_acl, __LA_MODE_T mode)
 796 {
 797         int             ret = ARCHIVE_OK;
 798
 799         (void)mode;     /* UNUSED */
 800
 801         if ((archive_acl_types(abstract_acl)
 802             & ARCHIVE_ENTRY_ACL_TYPE_POSIX1E) != 0) {
 803                 /* Solaris writes POSIX.1e access and default ACLs together */
 804                 ret = set_acl(a, fd, name, abstract_acl,
 805                     ARCHIVE_ENTRY_ACL_TYPE_POSIX1E, "posix1e");
 806
 807                 /* Simultaneous POSIX.1e and NFSv4 is not supported */
 808                 return (ret);
 809         }
 810 #if ARCHIVE_ACL_SUNOS_NFS4
 811         else if ((archive_acl_types(abstract_acl) &
 812             ARCHIVE_ENTRY_ACL_TYPE_NFS4) != 0) {
 813                 ret = set_acl(a, fd, name, abstract_acl,
 814                     ARCHIVE_ENTRY_ACL_TYPE_NFS4, "nfs4");
 815         }
 816 #endif
 817         return (ret);
 818 }
 819 #endif  /* ARCHIVE_ACL_SUNOS */