rsync/lib/acl.c

/*
 * POSIX ACL get/set/delete via the generic xattr syscalls.
 *
 * POSIX ACLs are stored by the kernel as the "system.posix_acl_access" and
 * "system.posix_acl_default" extended attributes, in a fixed little-endian
 * wire format (see include/acl_ea.h in the acl package).  By serializing that
 * format ourselves and using fgetxattr/fsetxattr on a held O_NOFOLLOW fd -- or
 * getxattrat/setxattrat(AT_SYMLINK_NOFOLLOW) on a dirfd+leaf -- we get a
 * symlink-race-safe ACL primitive that also covers the *default* ACL, which
 * libacl's fd API (acl_get_fd/acl_set_fd, access-only) cannot.
 *
 * This file knows nothing about rsync's globals or its internal ACL form: it
 * speaks a neutral (tag, perm, id) entry array, which makes it directly
 * comparable against the system libacl in the t_acl unit test.
 *
 * Copyright (C) 2026 Wayne Davison & the rsync project
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, visit the http://fsf.org website.
 */

#include "rsync.h"
#include "acl.h"

#ifdef SUPPORT_ACL_FD

#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>		/* AT_SYMLINK_NOFOLLOW */

#if defined HAVE_SYS_XATTR_H
#include <sys/xattr.h>
#elif defined HAVE_ATTR_XATTR_H
#include <attr/xattr.h>
#endif

#ifdef HAVE_XATTRAT_SYSCALLS
#include <sys/syscall.h>
/* Self-contained copy of the kernel's struct xattr_args (stable ABI: an
 * 8-byte-aligned u64 pointer, then two u32s).  Defined locally to avoid
 * pulling <linux/xattr.h>, whose XATTR_* macros clash with <sys/xattr.h>. */
struct rsync_xattr_args {
	uint64_t value __attribute__((aligned(8)));
	uint32_t size;
	uint32_t flags;
};
#endif

/* Linux 2.4 didn't have a distinct ENOATTR. */
#ifndef ENOATTR
#define ENOATTR ENODATA
#endif

#define ACL_XATTR_ACCESS  "system.posix_acl_access"
#define ACL_XATTR_DEFAULT "system.posix_acl_default"

/* On-disk layout: a 4-byte LE version header followed by 8-byte LE entries. */
#define ACL_EA_VERSION 0x0002
#define ACL_EA_HDR_LEN 4
#define ACL_EA_ENT_LEN 8

/* === little-endian (de)serialization (host-endianness independent) === */

static void put_le16(unsigned char *p, uint16_t v)
{
	p[0] = (unsigned char)(v & 0xff);
	p[1] = (unsigned char)((v >> 8) & 0xff);
}

static void put_le32(unsigned char *p, uint32_t v)
{
	p[0] = (unsigned char)(v & 0xff);
	p[1] = (unsigned char)((v >> 8) & 0xff);
	p[2] = (unsigned char)((v >> 16) & 0xff);
	p[3] = (unsigned char)((v >> 24) & 0xff);
}

static uint16_t get_le16(const unsigned char *p)
{
	return (uint16_t)(p[0] | (p[1] << 8));
}

static uint32_t get_le32(const unsigned char *p)
{
	return (uint32_t)p[0] | ((uint32_t)p[1] << 8)
	     | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);
}

static int is_named_tag(uint16_t tag)
{
	return tag == RACL_USER || tag == RACL_GROUP;
}

/* Canonical order: tag ascending, then id ascending within a tag.  This is
 * the order libacl's __acl_reorder_obj_p() produces and what the kernel's
 * validator expects (USER_OBJ, USER*, GROUP_OBJ, GROUP*, MASK, OTHER). */
static int ent_compare(const void *a, const void *b)
{
	const rsync_acl_ent *x = a, *y = b;
	if (x->tag != y->tag)
		return x->tag < y->tag ? -1 : 1;
	if (x->id != y->id)
		return x->id < y->id ? -1 : 1;
	return 0;
}

/* Serialize entries into a freshly-malloc'd xattr buffer (canonical order). */
static unsigned char *acl_to_xattr(const rsync_acl_ent *ents, int count, size_t *len_out)
{
	size_t len = ACL_EA_HDR_LEN + (size_t)count * ACL_EA_ENT_LEN;
	unsigned char *buf = malloc(len);
	rsync_acl_ent *sorted = NULL;
	unsigned char *p;
	int i;

	if (!buf)
		return NULL;
	if (count > 1) {
		sorted = malloc((size_t)count * sizeof sorted[0]);
		if (!sorted) {
			free(buf);
			return NULL;
		}
		memcpy(sorted, ents, (size_t)count * sizeof sorted[0]);
		qsort(sorted, count, sizeof sorted[0], ent_compare);
		ents = sorted;
	}

	put_le32(buf, ACL_EA_VERSION);
	p = buf + ACL_EA_HDR_LEN;
	for (i = 0; i < count; i++, p += ACL_EA_ENT_LEN) {
		put_le16(p, ents[i].tag);
		put_le16(p + 2, ents[i].perm);
		put_le32(p + 4, is_named_tag(ents[i].tag) ? ents[i].id : RACL_UNDEFINED_ID);
	}

	if (sorted)
		free(sorted);
	*len_out = len;
	return buf;
}

/* Parse an xattr buffer into a malloc'd entry array (canonical order). */
static int xattr_to_acl(const unsigned char *buf, size_t len,
			rsync_acl_ent **out, int *count_out)
{
	rsync_acl_ent *ents;
	const unsigned char *p;
	int n, i;

	if (len < ACL_EA_HDR_LEN || (len - ACL_EA_HDR_LEN) % ACL_EA_ENT_LEN != 0
	 || get_le32(buf) != ACL_EA_VERSION) {
		errno = EINVAL;
		return -1;
	}
	n = (int)((len - ACL_EA_HDR_LEN) / ACL_EA_ENT_LEN);

	ents = n ? malloc((size_t)n * sizeof ents[0]) : NULL;
	if (n && !ents)
		return -1;
	p = buf + ACL_EA_HDR_LEN;
	for (i = 0; i < n; i++, p += ACL_EA_ENT_LEN) {
		ents[i].tag = get_le16(p);
		ents[i].perm = get_le16(p + 2);
		ents[i].id = is_named_tag(ents[i].tag) ? get_le32(p + 4) : RACL_UNDEFINED_ID;
	}
	if (n > 1)
		qsort(ents, n, sizeof ents[0], ent_compare);

	*out = ents;
	*count_out = n;
	return 0;
}

/* === syscall dispatchers (fd-variant vs at-variant) === */

/* Pre-6.13 fallback for the dirfd+leaf at-variants: address the leaf as
 * /proc/self/fd/<dirfd>/<leaf> and use the l*xattr (no-follow-leaf) calls.  The
 * /proc/self/fd/<dirfd> magic symlink resolves to the pinned parent inode -- a
 * raced parent symlink cannot redirect it -- and l*xattr does not follow a raced
 * leaf symlink, so this is race-safe without the Linux 6.13 *xattrat syscalls, as
 * long as procfs is mounted.  (`leaf` is a single component, <= NAME_MAX.)
 * Returns 0 and fills `buf`, or -1 with ENAMETOOLONG. */
static int proc_fd_leaf_path(char *buf, size_t buflen, int dirfd, const char *leaf)
{
	int n = snprintf(buf, buflen, "/proc/self/fd/%d/%s", dirfd, leaf);
	if (n < 0 || (size_t)n >= buflen) {
		errno = ENAMETOOLONG;
		return -1;
	}
	return 0;
}

static ssize_t do_getxattr(int fd, int dirfd, const char *leaf,
			   const char *name, void *val, size_t size)
{
	char p[MAXPATHLEN];

	if (fd >= 0)
		return fgetxattr(fd, name, val, size);
#ifdef HAVE_XATTRAT_SYSCALLS
	{
		struct rsync_xattr_args args;
		ssize_t ret;
		args.value = (uint64_t)(uintptr_t)val;
		args.size = (uint32_t)size;
		args.flags = 0;
		ret = syscall(SYS_getxattrat, dirfd, leaf, AT_SYMLINK_NOFOLLOW,
			      name, &args, sizeof args);
		if (ret != -1 || errno != ENOSYS)
			return ret;
		/* ENOSYS: kernel < 6.13 -- fall through to the /proc compat. */
	}
#endif
	if (proc_fd_leaf_path(p, sizeof p, dirfd, leaf) < 0)
		return -1;
	return lgetxattr(p, name, val, size);
}

static int do_setxattr(int fd, int dirfd, const char *leaf,
		       const char *name, const void *val, size_t size)
{
	char p[MAXPATHLEN];

	if (fd >= 0)
		return fsetxattr(fd, name, val, size, 0);
#ifdef HAVE_XATTRAT_SYSCALLS
	{
		struct rsync_xattr_args args;
		int ret;
		args.value = (uint64_t)(uintptr_t)val;
		args.size = (uint32_t)size;
		args.flags = 0;	/* replace */
		ret = syscall(SYS_setxattrat, dirfd, leaf, AT_SYMLINK_NOFOLLOW,
			      name, &args, sizeof args);
		if (ret != -1 || errno != ENOSYS)
			return ret;
	}
#endif
	if (proc_fd_leaf_path(p, sizeof p, dirfd, leaf) < 0)
		return -1;
	return lsetxattr(p, name, val, size, 0);
}

static int do_removexattr(int fd, int dirfd, const char *leaf, const char *name)
{
	char p[MAXPATHLEN];

	if (fd >= 0)
		return fremovexattr(fd, name);
#ifdef HAVE_XATTRAT_SYSCALLS
	{
		int ret = syscall(SYS_removexattrat, dirfd, leaf, AT_SYMLINK_NOFOLLOW, name);
		if (ret != -1 || errno != ENOSYS)
			return ret;
	}
#endif
	if (proc_fd_leaf_path(p, sizeof p, dirfd, leaf) < 0)
		return -1;
	return lremovexattr(p, name);
}

/* Read the whole named xattr into a malloc'd buffer, growing as needed. */
static int read_full_xattr(int fd, int dirfd, const char *leaf,
			   const char *name, unsigned char **buf_out, size_t *len_out)
{
	unsigned char *buf = NULL;
	size_t size = 0;
	int tries;

	for (tries = 0; tries < 8; tries++) {
		ssize_t n = do_getxattr(fd, dirfd, leaf, name, size ? buf : NULL, size);
		if (n >= 0) {
			if (size == 0) {
				/* First call just learned the length. */
				size = n ? (size_t)n : 1;
				buf = malloc(size);
				if (!buf)
					return -1;
				continue;
			}
			*buf_out = buf;
			*len_out = (size_t)n;
			return 0;
		}
		if (errno == ERANGE) {	/* grew under us: re-probe the size */
			if (buf)
				free(buf);
			buf = NULL;
			size = 0;
			continue;
		}
		if (buf)
			free(buf);
		return -1;	/* ENODATA / EOPNOTSUPP / ENOSYS / ... in errno */
	}
	if (buf)
		free(buf);
	errno = ERANGE;
	return -1;
}

/* === public API === */

static int acl_get_common(int fd, int dirfd, const char *leaf,
			  int want_default, rsync_acl_ent **entries, int *count)
{
	const char *name = want_default ? ACL_XATTR_DEFAULT : ACL_XATTR_ACCESS;
	unsigned char *buf;
	size_t len;
	int rc;

	*entries = NULL;
	*count = 0;

	if (read_full_xattr(fd, dirfd, leaf, name, &buf, &len) < 0) {
		if (errno == ENODATA || errno == ENOATTR)
			return 0;	/* no explicit ACL present */
		return -1;		/* EOPNOTSUPP / ENOSYS / real error */
	}

	rc = xattr_to_acl(buf, len, entries, count);
	free(buf);
	return rc;
}

int xacl_get_fd(int fd, int want_default, rsync_acl_ent **entries, int *count)
{
	return acl_get_common(fd, -1, NULL, want_default, entries, count);
}

int xacl_get_at(int dirfd, const char *leaf, int want_default,
		rsync_acl_ent **entries, int *count)
{
	return acl_get_common(-1, dirfd, leaf, want_default, entries, count);
}

static int acl_set_common(int fd, int dirfd, const char *leaf,
			  int want_default, const rsync_acl_ent *ents, int count)
{
	const char *name = want_default ? ACL_XATTR_DEFAULT : ACL_XATTR_ACCESS;
	unsigned char *buf;
	size_t len;
	int rc, save_errno;

	buf = acl_to_xattr(ents, count, &len);
	if (!buf) {
		errno = ENOMEM;
		return -1;
	}
	rc = do_setxattr(fd, dirfd, leaf, name, buf, len);
	save_errno = errno;
	free(buf);
	errno = save_errno;
	return rc < 0 ? -1 : 0;
}

int xacl_set_fd(int fd, int want_default, const rsync_acl_ent *ents, int count)
{
	return acl_set_common(fd, -1, NULL, want_default, ents, count);
}

int xacl_set_at(int dirfd, const char *leaf, int want_default,
		const rsync_acl_ent *ents, int count)
{
	return acl_set_common(-1, dirfd, leaf, want_default, ents, count);
}

static int acl_del_default_common(int fd, int dirfd, const char *leaf)
{
	if (do_removexattr(fd, dirfd, leaf, ACL_XATTR_DEFAULT) < 0) {
		if (errno == ENODATA || errno == ENOATTR)
			return 0;	/* already absent: success, like acl_delete_def_file */
		return -1;
	}
	return 0;
}

int xacl_del_default_fd(int fd)
{
	return acl_del_default_common(fd, -1, NULL);
}

int xacl_del_default_at(int dirfd, const char *leaf)
{
	return acl_del_default_common(-1, dirfd, leaf);
}

/* True iff /proc/self/fd magic symlinks are usable, so the dirfd+leaf at-variants
 * work race-safely via the /proc compat on a pre-6.13 kernel. */
static int proc_self_fd_usable(void)
{
	int dfd = open(".", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
	char p[64];
	int usable = 0;

	if (dfd < 0)
		return 0;
	if (snprintf(p, sizeof p, "/proc/self/fd/%d/.", dfd) < (int)sizeof p) {
		/* The probe attr is absent; the path resolving (any errno but
		 * ENOENT/ENOTDIR -- e.g. ENODATA/ENOTSUP/EACCES) means procfs gives us
		 * the magic fd-symlink we need. */
		errno = 0;
		lgetxattr(p, "user.rsync_acl_probe", NULL, 0);
		usable = !(errno == ENOENT || errno == ENOTDIR);
	}
	close(dfd);
	return usable;
}

int xacl_at_available(void)
{
	static int avail = -1;

	if (avail < 0) {
#ifdef HAVE_XATTRAT_SYSCALLS
		/* Probe the *xattrat syscall directly (not via do_getxattr's /proc
		 * fallback): any errno other than ENOSYS means it is present (6.13+). */
		struct rsync_xattr_args args;
		args.value = 0;
		args.size = 0;
		args.flags = 0;
		errno = 0;
		syscall(SYS_getxattrat, AT_FDCWD, ".", AT_SYMLINK_NOFOLLOW,
			"user.rsync_acl_probe", &args, sizeof args);
		if (errno != ENOSYS) {
			avail = 1;
			return avail;
		}
#endif
		/* No *xattrat syscalls (pre-6.13, or a kernel built without them): the dirfd+leaf ACL ops
		 * are still race-safe via /proc/self/fd if procfs is mounted, closing
		 * the parent-symlink-race gap that otherwise forces the path-based set. */
		avail = proc_self_fd_usable();
	}
	return avail;
}

#endif /* SUPPORT_ACL_FD */