test_option_acls.c revision 328828 
1/*-
2 * Copyright (c) 2017 Martin Matuska
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25#include "test.h"
26__FBSDID("$FreeBSD: stable/10/contrib/libarchive/tar/test/test_option_acls.c 328828 2018-02-03 02:17:25Z mm $");
27
28#if ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_LIBACL
29static const acl_perm_t acl_perms[] = {
30#if ARCHIVE_ACL_DARWIN
31    ACL_READ_DATA,
32    ACL_LIST_DIRECTORY,
33    ACL_WRITE_DATA,
34    ACL_ADD_FILE,
35    ACL_EXECUTE,
36    ACL_SEARCH,
37    ACL_DELETE,
38    ACL_APPEND_DATA,
39    ACL_ADD_SUBDIRECTORY,
40    ACL_DELETE_CHILD,
41    ACL_READ_ATTRIBUTES,
42    ACL_WRITE_ATTRIBUTES,
43    ACL_READ_EXTATTRIBUTES,
44    ACL_WRITE_EXTATTRIBUTES,
45    ACL_READ_SECURITY,
46    ACL_WRITE_SECURITY,
47    ACL_CHANGE_OWNER,
48    ACL_SYNCHRONIZE
49#else /* !ARCHIVE_ACL_DARWIN */
50    ACL_EXECUTE,
51    ACL_WRITE,
52    ACL_READ,
53#if ARCHIVE_ACL_FREEBSD_NFS4
54    ACL_READ_DATA,
55    ACL_LIST_DIRECTORY,
56    ACL_WRITE_DATA,
57    ACL_ADD_FILE,
58    ACL_APPEND_DATA,
59    ACL_ADD_SUBDIRECTORY,
60    ACL_READ_NAMED_ATTRS,
61    ACL_WRITE_NAMED_ATTRS,
62    ACL_DELETE_CHILD,
63    ACL_READ_ATTRIBUTES,
64    ACL_WRITE_ATTRIBUTES,
65    ACL_DELETE,
66    ACL_READ_ACL,
67    ACL_WRITE_ACL,
68    ACL_WRITE_OWNER,
69    ACL_SYNCHRONIZE
70#endif	/* ARCHIVE_ACL_FREEBSD_NFS4 */
71#endif /* !ARCHIVE_ACL_DARWIN */
72};
73#if ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD_NFS4
74static const acl_flag_t acl_flags[] = {
75#if ARCHIVE_ACL_DARWIN
76    ACL_ENTRY_INHERITED,
77    ACL_ENTRY_FILE_INHERIT,
78    ACL_ENTRY_DIRECTORY_INHERIT,
79    ACL_ENTRY_LIMIT_INHERIT,
80    ACL_ENTRY_ONLY_INHERIT
81#else	/* ARCHIVE_ACL_FREEBSD_NFS4 */
82    ACL_ENTRY_FILE_INHERIT,
83    ACL_ENTRY_DIRECTORY_INHERIT,
84    ACL_ENTRY_NO_PROPAGATE_INHERIT,
85    ACL_ENTRY_INHERIT_ONLY,
86    ACL_ENTRY_SUCCESSFUL_ACCESS,
87    ACL_ENTRY_FAILED_ACCESS,
88#ifdef ACL_ENTRY_INHERITED
89    ACL_ENTRY_INHERITED
90#endif
91#endif	/* ARCHIVE_ACL_FREEBSD_NFS4 */
92};
93#endif /* ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD_NFS4 */
94
95/*
96 * Compare two ACL entries on FreeBSD or on Mac OS X
97 */
98static int
99compare_acl_entry(acl_entry_t ae_a, acl_entry_t ae_b, int is_nfs4)
100{
101	acl_tag_t tag_a, tag_b;
102	acl_permset_t permset_a, permset_b;
103	int perm_a, perm_b, perm_start, perm_end;
104	void *qual_a, *qual_b;
105#if ARCHIVE_ACL_FREEBSD_NFS4
106	acl_entry_type_t type_a, type_b;
107#endif
108#if ARCHIVE_ACL_FREEBSD_NFS4 || ARCHIVE_ACL_DARWIN
109	acl_flagset_t flagset_a, flagset_b;
110	int flag_a, flag_b;
111#endif
112	int i, r;
113
114
115	/* Compare ACL tag */
116	r = acl_get_tag_type(ae_a, &tag_a);
117	failure("acl_get_tag_type() error: %s", strerror(errno));
118	if (assertEqualInt(r, 0) == 0)
119		return (-1);
120	r = acl_get_tag_type(ae_b, &tag_b);
121	failure("acl_get_tag_type() error: %s", strerror(errno));
122	if (assertEqualInt(r, 0) == 0)
123		return (-1);
124	if (tag_a != tag_b)
125		return (0);
126
127	/* Compare ACL qualifier */
128#if ARCHIVE_ACL_DARWIN
129	if (tag_a == ACL_EXTENDED_ALLOW || tag_b == ACL_EXTENDED_DENY)
130#else
131	if (tag_a == ACL_USER || tag_a == ACL_GROUP)
132#endif
133	{
134		qual_a = acl_get_qualifier(ae_a);
135		failure("acl_get_qualifier() error: %s", strerror(errno));
136		if (assert(qual_a != NULL) == 0)
137			return (-1);
138		qual_b = acl_get_qualifier(ae_b);
139		failure("acl_get_qualifier() error: %s", strerror(errno));
140		if (assert(qual_b != NULL) == 0) {
141			acl_free(qual_a);
142			return (-1);
143		}
144#if ARCHIVE_ACL_DARWIN
145		if (memcmp(((guid_t *)qual_a)->g_guid,
146		    ((guid_t *)qual_b)->g_guid, KAUTH_GUID_SIZE) != 0)
147#else
148		if ((tag_a == ACL_USER &&
149		    (*(uid_t *)qual_a != *(uid_t *)qual_b)) ||
150		    (tag_a == ACL_GROUP &&
151		    (*(gid_t *)qual_a != *(gid_t *)qual_b)))
152#endif
153		{
154			acl_free(qual_a);
155			acl_free(qual_b);
156			return (0);
157		}
158		acl_free(qual_a);
159		acl_free(qual_b);
160	}
161
162#if ARCHIVE_ACL_FREEBSD_NFS4
163	if (is_nfs4) {
164		/* Compare NFS4 ACL type */
165		r = acl_get_entry_type_np(ae_a, &type_a);
166		failure("acl_get_entry_type_np() error: %s", strerror(errno));
167		if (assertEqualInt(r, 0) == 0)
168			return (-1);
169		r = acl_get_entry_type_np(ae_b, &type_b);
170		failure("acl_get_entry_type_np() error: %s", strerror(errno));
171		if (assertEqualInt(r, 0) == 0)
172			return (-1);
173		if (type_a != type_b)
174			return (0);
175	}
176#endif
177
178	/* Compare ACL perms */
179	r = acl_get_permset(ae_a, &permset_a);
180	failure("acl_get_permset() error: %s", strerror(errno));
181	if (assertEqualInt(r, 0) == 0)
182		return (-1);
183	r = acl_get_permset(ae_b, &permset_b);
184	failure("acl_get_permset() error: %s", strerror(errno));
185	if (assertEqualInt(r, 0) == 0)
186		return (-1);
187
188	perm_start = 0;
189	perm_end = (int)(sizeof(acl_perms) / sizeof(acl_perms[0]));
190#if ARCHIVE_ACL_FREEBSD_NFS4
191	if (is_nfs4)
192		perm_start = 3;
193	else
194		perm_end = 3;
195#endif
196	/* Cycle through all perms and compare their value */
197	for (i = perm_start; i < perm_end; i++) {
198#if ARCHIVE_ACL_LIBACL
199		perm_a = acl_get_perm(permset_a, acl_perms[i]);
200		perm_b = acl_get_perm(permset_b, acl_perms[i]);
201#else
202		perm_a = acl_get_perm_np(permset_a, acl_perms[i]);
203		perm_b = acl_get_perm_np(permset_b, acl_perms[i]);
204#endif
205		if (perm_a == -1 || perm_b == -1)
206			return (-1);
207		if (perm_a != perm_b)
208			return (0);
209	}
210
211#if ARCHIVE_ACL_FREEBSD_NFS4 || ARCHIVE_ACL_DARWIN
212	if (is_nfs4) {
213		r = acl_get_flagset_np(ae_a, &flagset_a);
214		failure("acl_get_flagset_np() error: %s", strerror(errno));
215		if (assertEqualInt(r, 0) == 0)
216			return (-1);
217		r = acl_get_flagset_np(ae_b, &flagset_b);
218		failure("acl_get_flagset_np() error: %s", strerror(errno));
219		if (assertEqualInt(r, 0) == 0)
220			return (-1);
221		/* Cycle through all flags and compare their status */
222		for (i = 0; i < (int)(sizeof(acl_flags) / sizeof(acl_flags[0]));
223		    i++) {
224			flag_a = acl_get_flag_np(flagset_a, acl_flags[i]);
225			flag_b = acl_get_flag_np(flagset_b, acl_flags[i]);
226			if (flag_a == -1 || flag_b == -1)
227				return (-1);
228			if (flag_a != flag_b)
229				return (0);
230		}
231	}
232#else	/* ARCHIVE_ACL_FREEBSD_NFS4 || ARCHIVE_ACL_DARWIN */
233	(void)is_nfs4;	/* UNUSED */
234#endif
235	return (1);
236}
237#endif	/* ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_LIBACL */
238
239#if ARCHIVE_ACL_SUPPORT
240/*
241 * Clear default ACLs or inheritance flags
242 */
243static void
244clear_inheritance_flags(const char *path, int type)
245{
246	switch (type) {
247	case ARCHIVE_TEST_ACL_TYPE_POSIX1E:
248#if ARCHIVE_ACL_POSIX1E
249#if !ARCHIVE_ACL_SUNOS
250		acl_delete_def_file(path);
251#else
252		/* Solaris */
253		setTestAcl(path);
254#endif
255#endif	/* ARCHIVE_ACL_POSIX1E */
256		break;
257	case ARCHIVE_TEST_ACL_TYPE_NFS4:
258#if ARCHIVE_ACL_NFS4
259		setTestAcl(path);
260#endif
261		break;
262	default:
263		(void)path;	/* UNUSED */
264		break;
265	}
266}
267
268static int
269compare_acls(const char *path_a, const char *path_b)
270{
271	int ret = 1;
272	int is_nfs4 = 0;
273#if ARCHIVE_ACL_SUNOS
274	void *acl_a, *acl_b;
275	int aclcnt_a, aclcnt_b;
276        aclent_t *aclent_a, *aclent_b;
277        ace_t *ace_a, *ace_b;
278	int e;
279#elif ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_LIBACL
280	acl_t acl_a, acl_b;
281	acl_entry_t aclent_a, aclent_b;
282	int a, b, r;
283#endif
284#if ARCHIVE_ACL_LIBRICHACL
285	struct richacl *richacl_a, *richacl_b;
286
287	richacl_a = NULL;
288	richacl_b = NULL;
289#endif
290
291#if ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_LIBACL || \
292    ARCHIVE_ACL_SUNOS
293	acl_a = NULL;
294	acl_b = NULL;
295#endif
296#if ARCHIVE_ACL_SUNOS
297	acl_a = sunacl_get(GETACL, &aclcnt_a, 0, path_a);
298	if (acl_a == NULL) {
299#if ARCHIVE_ACL_SUNOS_NFS4
300		is_nfs4 = 1;
301		acl_a = sunacl_get(ACE_GETACL, &aclcnt_a, 0, path_a);
302#endif
303		failure("acl_get() error: %s", strerror(errno));
304		if (assert(acl_a != NULL) == 0)
305			return (-1);
306#if ARCHIVE_ACL_SUNOS_NFS4
307		acl_b = sunacl_get(ACE_GETACL, &aclcnt_b, 0, path_b);
308#endif
309	} else
310		acl_b = sunacl_get(GETACL, &aclcnt_b, 0, path_b);
311	if (acl_b == NULL && (errno == ENOSYS || errno == ENOTSUP)) {
312		free(acl_a);
313		return (0);
314	}
315	failure("acl_get() error: %s", strerror(errno));
316	if (assert(acl_b != NULL) == 0) {
317		free(acl_a);
318		return (-1);
319	}
320
321	if (aclcnt_a != aclcnt_b) {
322		ret = 0;
323		goto exit_free;
324	}
325
326	for (e = 0; e < aclcnt_a; e++) {
327		if (!is_nfs4) {
328			aclent_a = &((aclent_t *)acl_a)[e];
329			aclent_b = &((aclent_t *)acl_b)[e];
330			if (aclent_a->a_type != aclent_b->a_type ||
331			    aclent_a->a_id != aclent_b->a_id ||
332			    aclent_a->a_perm != aclent_b->a_perm) {
333				ret = 0;
334				goto exit_free;
335			}
336		}
337#if ARCHIVE_ACL_SUNOS_NFS4
338		else {
339			ace_a = &((ace_t *)acl_a)[e];
340			ace_b = &((ace_t *)acl_b)[e];
341			if (ace_a->a_who != ace_b->a_who ||
342			    ace_a->a_access_mask != ace_b->a_access_mask ||
343			    ace_a->a_flags != ace_b->a_flags ||
344			    ace_a->a_type != ace_b->a_type) {
345				ret = 0;
346				goto exit_free;
347			}
348		}
349#endif
350	}
351#else	/* !ARCHIVE_ACL_SUNOS */
352#if ARCHIVE_ACL_LIBRICHACL
353	richacl_a = richacl_get_file(path_a);
354#if !ARCHIVE_ACL_LIBACL
355	if (richacl_a == NULL &&
356	    (errno == ENODATA || errno == ENOTSUP || errno == ENOSYS))
357		return (0);
358	failure("richacl_get_file() error: %s (%s)", path_a, strerror(errno));
359	if (assert(richacl_a != NULL) == 0)
360		return (-1);
361#endif
362	if (richacl_a != NULL) {
363		richacl_b = richacl_get_file(path_b);
364		if (richacl_b == NULL &&
365		    (errno == ENODATA || errno == ENOTSUP || errno == ENOSYS))
366			return (0);
367		failure("richacl_get_file() error: %s (%s)", path_b,
368		    strerror(errno));
369		if (assert(richacl_b != NULL) == 0) {
370			richacl_free(richacl_a);
371			return (-1);
372		}
373		if (richacl_compare(richacl_a, richacl_b) == 0)
374			ret = 0;
375		richacl_free(richacl_a);
376		richacl_free(richacl_b);
377		return (ret);
378        }
379#endif /* ARCHIVE_ACL_LIBRICHACL */
380#if ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_LIBACL
381#if ARCHIVE_ACL_DARWIN
382	is_nfs4 = 1;
383	acl_a = acl_get_file(path_a, ACL_TYPE_EXTENDED);
384#elif ARCHIVE_ACL_FREEBSD_NFS4
385	acl_a = acl_get_file(path_a, ACL_TYPE_NFS4);
386	if (acl_a != NULL)
387		is_nfs4 = 1;
388#endif
389	if (acl_a == NULL)
390		acl_a = acl_get_file(path_a, ACL_TYPE_ACCESS);
391	failure("acl_get_file() error: %s (%s)", path_a, strerror(errno));
392	if (assert(acl_a != NULL) == 0)
393		return (-1);
394#if ARCHIVE_ACL_DARWIN
395	acl_b = acl_get_file(path_b, ACL_TYPE_EXTENDED);
396#elif ARCHIVE_ACL_FREEBSD_NFS4
397	acl_b = acl_get_file(path_b, ACL_TYPE_NFS4);
398#endif
399#if !ARCHIVE_ACL_DARWIN
400	if (acl_b == NULL) {
401#if ARCHIVE_ACL_FREEBSD_NFS4
402		if (is_nfs4) {
403			acl_free(acl_a);
404			return (0);
405		}
406#endif
407		acl_b = acl_get_file(path_b, ACL_TYPE_ACCESS);
408	}
409	failure("acl_get_file() error: %s (%s)", path_b, strerror(errno));
410	if (assert(acl_b != NULL) == 0) {
411		acl_free(acl_a);
412		return (-1);
413	}
414#endif
415	a = acl_get_entry(acl_a, ACL_FIRST_ENTRY, &aclent_a);
416	if (a == -1) {
417		ret = 0;
418		goto exit_free;
419	}
420	b = acl_get_entry(acl_b, ACL_FIRST_ENTRY, &aclent_b);
421	if (b == -1) {
422		ret = 0;
423		goto exit_free;
424	}
425#if ARCHIVE_ACL_DARWIN
426	while (a == 0 && b == 0)
427#else	/* FreeBSD, Linux */
428	while (a == 1 && b == 1)
429#endif
430	{
431		r = compare_acl_entry(aclent_a, aclent_b, is_nfs4);
432		if (r != 1) {
433			ret = r;
434			goto exit_free;
435		}
436		a = acl_get_entry(acl_a, ACL_NEXT_ENTRY, &aclent_a);
437		b = acl_get_entry(acl_b, ACL_NEXT_ENTRY, &aclent_b);
438	}
439	/* Entry count must match */
440	if (a != b)
441		ret = 0;
442#endif	/* ARCHIVE_ACL_DARWIN || ARCHIVE_ACL_FREEBSD || ARCHIVE_ACL_LIBACL */
443#endif	/* !ARCHIVE_ACL_SUNOS */
444exit_free:
445#if ARCHIVE_ACL_SUNOS
446	free(acl_a);
447	free(acl_b);
448#else
449	acl_free(acl_a);
450	acl_free(acl_b);
451#endif
452	return (ret);
453}
454#endif	/* ARCHIVE_ACL_SUPPORT */
455
456DEFINE_TEST(test_option_acls)
457{
458#if !ARCHIVE_ACL_SUPPORT
459        skipping("ACLs are not supported on this platform");
460#else   /* ARCHIVE_ACL_SUPPORT */
461	int acltype, r;
462
463	assertMakeFile("f", 0644, "a");
464	acltype = setTestAcl("f");
465	if (acltype == 0) {
466		skipping("Can't write ACLs on the filesystem");
467		return;
468	}
469
470	/* Archive it with acls */
471        r = systemf("%s -c --no-mac-metadata --acls -f acls.tar f >acls.out 2>acls.err", testprog);
472        assertEqualInt(r, 0);
473
474	/* Archive it without acls */
475	r = systemf("%s -c --no-mac-metadata --no-acls -f noacls.tar f >noacls.out 2>noacls.err", testprog);
476	assertEqualInt(r, 0);
477
478	/* Extract acls with acls */
479	assertMakeDir("acls_acls", 0755);
480	clear_inheritance_flags("acls_acls", acltype);
481	r = systemf("%s -x -C acls_acls --no-same-permissions --acls -f acls.tar >acls_acls.out 2>acls_acls.err", testprog);
482	assertEqualInt(r, 0);
483	r = compare_acls("f", "acls_acls/f");
484	assertEqualInt(r, 1);
485
486	/* Extract acls without acls */
487	assertMakeDir("acls_noacls", 0755);
488	clear_inheritance_flags("acls_noacls", acltype);
489	r = systemf("%s -x -C acls_noacls -p --no-acls -f acls.tar >acls_noacls.out 2>acls_noacls.err", testprog);
490	assertEqualInt(r, 0);
491	r = compare_acls("f", "acls_noacls/f");
492	assertEqualInt(r, 0);
493
494	/* Extract noacls with acls flag */
495	assertMakeDir("noacls_acls", 0755);
496	clear_inheritance_flags("noacls_acls", acltype);
497	r = systemf("%s -x -C noacls_acls --no-same-permissions --acls -f noacls.tar >noacls_acls.out 2>noacls_acls.err", testprog);
498	assertEqualInt(r, 0);
499	r = compare_acls("f", "noacls_acls/f");
500	assertEqualInt(r, 0);
501
502	/* Extract noacls with noacls */
503	assertMakeDir("noacls_noacls", 0755);
504	clear_inheritance_flags("noacls_noacls", acltype);
505	r = systemf("%s -x -C noacls_noacls -p --no-acls -f noacls.tar >noacls_noacls.out 2>noacls_noacls.err", testprog);
506	assertEqualInt(r, 0);
507	r = compare_acls("f", "noacls_noacls/f");
508	assertEqualInt(r, 0);
509#endif	/* ARCHIVE_ACL_SUPPORT */
510}
511