2 Bacula® - The Network Backup Solution
4 Copyright (C) 2004-2010 Free Software Foundation Europe e.V.
6 The main author of Bacula is Kern Sibbald, with contributions from
7 many others, a complete list can be found in the file AUTHORS.
8 This program is Free Software; you can redistribute it and/or
9 modify it under the terms of version three of the GNU Affero General Public
10 License as published by the Free Software Foundation and included
13 This program is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU Affero General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
23 Bacula® is a registered trademark of Kern Sibbald.
24 The licensor of Bacula is the Free Software Foundation Europe
25 (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zürich,
26 Switzerland, email:ftf@fsfeurope.org.
29 * Functions to handle ACLs for bacula.
31 * Currently we support the following OSes:
32 * - AIX (pre-5.3 and post 5.3 acls, acl_get and aclx_get interface)
34 * - FreeBSD (POSIX and NFSv4/ZFS acls)
38 * - Solaris (POSIX and NFSv4/ZFS acls)
41 * We handle two different types of ACLs: access and default ACLS.
42 * On most systems that support default ACLs they only apply to directories.
44 * On some systems (eg. linux and FreeBSD) we must obtain the two ACLs
45 * independently, while others (eg. Solaris) provide both in one call.
47 * The Filed saves ACLs in their native format and uses different streams
48 * for all different platforms. Currently we only allow ACLs to be restored
49 * which were saved in the native format of the platform they are extracted
50 * on. Later on we might add conversion functions for mapping from one
51 * platform to an other or allow restores of systems that use the same
54 * Its also interesting to see what the exact format of acl text is on
55 * certain platforms and if they use they same encoding we might allow
56 * different platform streams to be decoded on an other similar platform.
58 * Original written by Preben 'Peppe' Guldberg, December MMIV
59 * Major rewrite by Marco van Wieringen, November MMVIII
65 #if !defined(HAVE_ACL)
67 * Entry points when compiled without support for ACLs or on an unsupported platform.
69 bacl_exit_code build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
71 return bacl_exit_fatal;
74 bacl_exit_code parse_acl_streams(JCR *jcr, int stream)
76 return bacl_exit_fatal;
80 * Send an ACL stream to the SD.
82 static bacl_exit_code send_acl_stream(JCR *jcr, int stream)
84 BSOCK *sd = jcr->store_bsock;
86 #ifdef FD_NO_SEND_TEST
93 if (jcr->acl_data->content_length <= 0) {
100 if (!sd->fsend("%ld %d 0", jcr->JobFiles, stream)) {
101 Jmsg1(jcr, M_FATAL, 0, _("Network send error to SD. ERR=%s\n"),
103 return bacl_exit_fatal;
107 * Send the buffer to the storage deamon
109 Dmsg1(400, "Backing up ACL <%s>\n", jcr->acl_data->content);
111 sd->msg = jcr->acl_data->content;
112 sd->msglen = jcr->acl_data->content_length + 1;
116 Jmsg1(jcr, M_FATAL, 0, _("Network send error to SD. ERR=%s\n"),
118 return bacl_exit_fatal;
121 jcr->JobBytes += sd->msglen;
123 if (!sd->signal(BNET_EOD)) {
124 Jmsg1(jcr, M_FATAL, 0, _("Network send error to SD. ERR=%s\n"),
126 return bacl_exit_fatal;
129 Dmsg1(200, "ACL of file: %s successfully backed up!\n", jcr->last_fname);
134 * First the native ACLs.
136 #if defined(HAVE_ACL)
137 #if defined(HAVE_AIX_OS)
139 #if defined(HAVE_EXTENDED_ACL)
141 #include <sys/access.h>
144 static bool acl_is_trivial(struct acl *acl)
146 return (acl_last(acl) != acl->acl_ext ? false : true);
149 static bool acl_nfs4_is_trivial(nfs4_acl_int_t *acl)
151 return (acl->aclEntryN > 0 ? false : true);
155 * Define the supported ACL streams for this OS
157 static int os_access_acl_streams[3] = { STREAM_ACL_AIX_TEXT, STREAM_ACL_AIX_AIXC, STREAM_ACL_AIX_NFS4 };
158 static int os_default_acl_streams[1] = { -1 };
160 static bacl_exit_code aix_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
165 size_t aclsize, acltxtsize;
166 bacl_exit_code retval = bacl_exit_error;
167 POOLMEM *aclbuf = get_pool_memory(PM_MESSAGE);
170 * First see how big the buffers should be.
173 if (aclx_get(jcr->last_fname, GET_ACLINFO_ONLY, &type, NULL, &aclsize, NULL) < 0) {
176 retval = bacl_exit_ok;
179 Mmsg2(jcr->errmsg, _("aclx_get error on file \"%s\": ERR=%s\n"),
180 jcr->last_fname, be.bstrerror());
181 Dmsg2(100, "aclx_get error file=%s ERR=%s\n",
182 jcr->last_fname, be.bstrerror());
188 * Make sure the buffers are big enough.
190 aclbuf = check_pool_memory_size(aclbuf, aclsize + 1);
193 * Retrieve the ACL info.
195 if (aclx_get(jcr->last_fname, 0, &type, aclbuf, &aclsize, &mode) < 0) {
198 retval = bacl_exit_ok;
201 Mmsg2(jcr->errmsg, _("aclx_get error on file \"%s\": ERR=%s\n"),
202 jcr->last_fname, be.bstrerror());
203 Dmsg2(100, "aclx_get error file=%s ERR=%s\n",
204 jcr->last_fname, be.bstrerror());
210 * See if the acl is non trivial.
214 if (acl_is_trivial((struct acl *)aclbuf)) {
215 retval = bacl_exit_ok;
220 if (acl_nfs4_is_trivial((nfs4_acl_int_t *)aclbuf)) {
221 retval = bacl_exit_ok;
226 Mmsg2(jcr->errmsg, _("Unknown acl type encountered on file \"%s\": %ld\n"),
227 jcr->last_fname, type.u64);
228 Dmsg2(100, "Unknown acl type encountered on file \"%s\": %ld\n",
229 jcr->last_fname, type.u64);
234 * We have a non-trivial acl lets convert it into some ASCII form.
236 acltxtsize = sizeof_pool_memory(jcr->acl_data->content);
237 if (aclx_printStr(jcr->acl_data->content, &acltxtsize, aclbuf,
238 aclsize, type, jcr->last_fname, 0) < 0) {
242 * Our buffer is not big enough, acltxtsize should be updated with the value
243 * the aclx_printStr really need. So we increase the buffer and try again.
245 jcr->acl_data->content = check_pool_memory_size(jcr->acl_data->content, acltxtsize + 1);
246 if (aclx_printStr(jcr->acl_data->content, &acltxtsize, aclbuf,
247 aclsize, type, jcr->last_fname, 0) < 0) {
248 Mmsg1(jcr->errmsg, _("Failed to convert acl into text on file \"%s\"\n"),
250 Dmsg2(100, "Failed to convert acl into text on file \"%s\": %ld\n",
251 jcr->last_fname, type.u64);
256 Mmsg1(jcr->errmsg, _("Failed to convert acl into text on file \"%s\"\n"),
258 Dmsg2(100, "Failed to convert acl into text on file \"%s\": %ld\n",
259 jcr->last_fname, type.u64);
264 jcr->acl_data->content_length = strlen(jcr->acl_data->content) + 1;
267 retval = send_acl_stream(jcr, STREAM_ACL_AIX_AIXC);
269 retval = send_acl_stream(jcr, STREAM_ACL_AIX_NFS4);
273 free_pool_memory(aclbuf);
278 static bacl_exit_code aix_parse_acl_streams(JCR *jcr, int stream)
284 bacl_exit_code retval = bacl_exit_error;
285 POOLMEM *aclbuf = get_pool_memory(PM_MESSAGE);
288 case STREAM_ACL_AIX_TEXT:
290 * Handle the old stream using the old system call for now.
292 if (acl_put(jcr->last_fname, jcr->acl_data->content, 0) != 0) {
293 retval = bacl_exit_error;
296 retval = bacl_exit_ok;
298 case STREAM_ACL_AIX_AIXC:
301 case STREAM_ACL_AIX_NFS4:
306 } /* end switch (stream) */
309 * Set the acl buffer to an initial size. For now we set it
310 * to the same size as the ASCII representation.
312 aclbuf = check_pool_memory_size(aclbuf, jcr->acl_data->content_length);
313 aclsize = jcr->acl_data->content_length;
314 if (aclx_scanStr(jcr->acl_data->content, aclbuf, &aclsize, type) < 0) {
318 * The buffer isn't big enough. The man page doesn't say that aclsize
319 * is updated to the needed size as what is done with aclx_printStr.
320 * So for now we try to increase the buffer a maximum of 3 times
321 * and retry the conversion.
323 for (cnt = 0; cnt < 3; cnt++) {
324 aclsize = 2 * aclsize;
325 aclbuf = check_pool_memory_size(aclbuf, aclsize);
327 if (aclx_scanStr(jcr->acl_data->content, aclbuf, &aclsize, type) == 0) {
332 * See why we failed this time, ENOSPC retry if max retries not met,
342 Mmsg2(jcr->errmsg, _("aclx_scanStr error on file \"%s\": ERR=%s\n"),
343 jcr->last_fname, be.bstrerror());
344 Dmsg2(100, "aclx_scanStr error file=%s ERR=%s\n",
345 jcr->last_fname, be.bstrerror());
351 Mmsg2(jcr->errmsg, _("aclx_scanStr error on file \"%s\": ERR=%s\n"),
352 jcr->last_fname, be.bstrerror());
353 Dmsg2(100, "aclx_scanStr error file=%s ERR=%s\n",
354 jcr->last_fname, be.bstrerror());
358 if (aclx_put(jcr->last_fname, SET_ACL, type, aclbuf, aclsize, 0) < 0) {
361 retval = bacl_exit_ok;
364 Mmsg2(jcr->errmsg, _("aclx_put error on file \"%s\": ERR=%s\n"),
365 jcr->last_fname, be.bstrerror());
366 Dmsg2(100, "aclx_put error file=%s ERR=%s\n",
367 jcr->last_fname, be.bstrerror());
372 retval = bacl_exit_ok;
375 free_pool_memory(aclbuf);
380 #else /* HAVE_EXTENDED_ACL */
382 #include <sys/access.h>
385 * Define the supported ACL streams for this OS
387 static int os_access_acl_streams[1] = { STREAM_ACL_AIX_TEXT };
388 static int os_default_acl_streams[1] = { -1 };
390 static bacl_exit_code aix_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
394 if ((acl_text = acl_get(jcr->last_fname)) != NULL) {
395 jcr->acl_data->content_length = pm_strcpy(jcr->acl_data->content, acl_text);
396 actuallyfree(acl_text);
397 return send_acl_stream(jcr, STREAM_ACL_AIX_TEXT);
399 return bacl_exit_error;
402 static bacl_exit_code aix_parse_acl_streams(JCR *jcr, int stream)
404 if (acl_put(jcr->last_fname, jcr->acl_data->content, 0) != 0) {
405 return bacl_exit_error;
409 #endif /* HAVE_EXTENDED_ACL */
412 * For this OS setup the build and parse function pointer to the OS specific functions.
414 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = aix_build_acl_streams;
415 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = aix_parse_acl_streams;
417 #elif defined(HAVE_DARWIN_OS) || \
418 defined(HAVE_FREEBSD_OS) || \
419 defined(HAVE_IRIX_OS) || \
420 defined(HAVE_OSF1_OS) || \
421 defined(HAVE_LINUX_OS)
423 #include <sys/types.h>
425 #ifdef HAVE_SYS_ACL_H
428 #error "configure failed to detect availability of sys/acl.h"
432 * On IRIX we can get shortened ACLs
434 #if defined(HAVE_IRIX_OS) && defined(BACL_WANT_SHORT_ACLS)
435 #define acl_to_text(acl,len) acl_to_short_text((acl), (len))
439 * On Linux we can get numeric and/or shorted ACLs
441 #if defined(HAVE_LINUX_OS)
442 #if defined(BACL_WANT_SHORT_ACLS) && defined(BACL_WANT_NUMERIC_IDS)
443 #define BACL_ALTERNATE_TEXT (TEXT_ABBREVIATE|TEXT_NUMERIC_IDS)
444 #elif defined(BACL_WANT_SHORT_ACLS)
445 #define BACL_ALTERNATE_TEXT TEXT_ABBREVIATE
446 #elif defined(BACL_WANT_NUMERIC_IDS)
447 #define BACL_ALTERNATE_TEXT TEXT_NUMERIC_IDS
449 #ifdef BACL_ALTERNATE_TEXT
450 #include <acl/libacl.h>
451 #define acl_to_text(acl,len) (acl_to_any_text((acl), NULL, ',', BACL_ALTERNATE_TEXT))
456 * On FreeBSD we can get numeric ACLs
458 #if defined(HAVE_FREEBSD_OS)
459 #if defined(BACL_WANT_NUMERIC_IDS)
460 #define BACL_ALTERNATE_TEXT ACL_TEXT_NUMERIC_IDS
462 #ifdef BACL_ALTERNATE_TEXT
463 #define acl_to_text(acl,len) (acl_to_text_np((acl), (len), BACL_ALTERNATE_TEXT))
468 * Some generic functions used by multiple OSes.
470 static acl_type_t bac_to_os_acltype(bacl_type acltype)
475 case BACL_TYPE_ACCESS:
476 ostype = ACL_TYPE_ACCESS;
478 case BACL_TYPE_DEFAULT:
479 ostype = ACL_TYPE_DEFAULT;
481 #ifdef HAVE_ACL_TYPE_NFS4
483 * FreeBSD has an additional acl type named ACL_TYPE_NFS4.
486 ostype = ACL_TYPE_NFS4;
489 #ifdef HAVE_ACL_TYPE_DEFAULT_DIR
490 case BACL_TYPE_DEFAULT_DIR:
492 * TRU64 has an additional acl type named ACL_TYPE_DEFAULT_DIR.
494 ostype = ACL_TYPE_DEFAULT_DIR;
497 #ifdef HAVE_ACL_TYPE_EXTENDED
498 case BACL_TYPE_EXTENDED:
500 * MacOSX has an additional acl type named ACL_TYPE_EXTENDED.
502 ostype = ACL_TYPE_EXTENDED;
507 * This should never happen, as the per OS version function only tries acl
508 * types supported on a certain platform.
510 ostype = (acl_type_t)ACL_TYPE_NONE;
516 static int acl_count_entries(acl_t acl)
519 #if defined(HAVE_FREEBSD_OS) || \
520 defined(HAVE_LINUX_OS)
524 entry_available = acl_get_entry(acl, ACL_FIRST_ENTRY, &ace);
525 while (entry_available == 1) {
527 entry_available = acl_get_entry(acl, ACL_NEXT_ENTRY, &ace);
529 #elif defined(HAVE_IRIX_OS)
530 count = acl->acl_cnt;
531 #elif defined(HAVE_OSF1_OS)
532 count = acl->acl_num;
533 #elif defined(HAVE_DARWIN_OS)
537 entry_available = acl_get_entry(acl, ACL_FIRST_ENTRY, &ace);
538 while (entry_available == 0) {
540 entry_available = acl_get_entry(acl, ACL_NEXT_ENTRY, &ace);
546 #if !defined(HAVE_DARWIN_OS)
548 * See if an acl is a trivial one (e.g. just the stat bits encoded as acl.)
549 * There is no need to store those acls as we already store the stat bits too.
551 static bool acl_is_trivial(acl_t acl)
554 * acl is trivial if it has only the following entries:
561 #if defined(HAVE_FREEBSD_OS) || \
562 defined(HAVE_LINUX_OS)
565 entry_available = acl_get_entry(acl, ACL_FIRST_ENTRY, &ace);
566 while (entry_available == 1) {
568 * Get the tag type of this acl entry.
569 * If we fail to get the tagtype we call the acl non-trivial.
571 if (acl_get_tag_type(ace, &tag) < 0)
574 * Anything other the ACL_USER_OBJ, ACL_GROUP_OBJ or ACL_OTHER breaks the spell.
576 if (tag != ACL_USER_OBJ &&
577 tag != ACL_GROUP_OBJ &&
580 entry_available = acl_get_entry(acl, ACL_NEXT_ENTRY, &ace);
583 #elif defined(HAVE_IRIX_OS)
586 for (n = 0; n < acl->acl_cnt; n++) {
587 ace = &acl->acl_entry[n];
591 * Anything other the ACL_USER_OBJ, ACL_GROUP_OBJ or ACL_OTHER breaks the spell.
593 if (tag != ACL_USER_OBJ &&
594 tag != ACL_GROUP_OBJ &&
595 tag != ACL_OTHER_OBJ)
599 #elif defined(HAVE_OSF1_OS)
602 ace = acl->acl_first;
603 count = acl->acl_num;
606 tag = ace->entry->acl_type;
608 * Anything other the ACL_USER_OBJ, ACL_GROUP_OBJ or ACL_OTHER breaks the spell.
610 if (tag != ACL_USER_OBJ &&
611 tag != ACL_GROUP_OBJ &&
615 * On Tru64, perm can also contain non-standard bits such as
616 * PERM_INSERT, PERM_DELETE, PERM_MODIFY, PERM_LOOKUP, ...
618 if ((ace->entry->acl_perm & ~(ACL_READ | ACL_WRITE | ACL_EXECUTE)))
629 * Generic wrapper around acl_get_file call.
631 static bacl_exit_code generic_get_acl_from_os(JCR *jcr, bacl_type acltype)
637 bacl_exit_code retval = bacl_exit_ok;
639 ostype = bac_to_os_acltype(acltype);
640 acl = acl_get_file(jcr->last_fname, ostype);
643 * From observation, IRIX's acl_get_file() seems to return a
644 * non-NULL acl with a count field of -1 when a file has no ACL
645 * defined, while IRIX's acl_to_text() returns NULL when presented
648 * For all other implmentations we check if there are more then
649 * zero entries in the acl returned.
651 if (acl_count_entries(acl) <= 0) {
656 * Make sure this is not just a trivial ACL.
658 #if !defined(HAVE_DARWIN_OS)
659 if (acltype == BACL_TYPE_ACCESS && acl_is_trivial(acl)) {
661 * The ACLs simply reflect the (already known) standard permissions
662 * So we don't send an ACL stream to the SD.
667 #if defined(HAVE_FREEBSD_OS) && defined(_PC_ACL_NFS4)
668 if (acltype == BACL_TYPE_NFS4) {
670 if (acl_is_trivial_np(acl, &trivial) == 0) {
673 * The ACLs simply reflect the (already known) standard permissions
674 * So we don't send an ACL stream to the SD.
683 * Convert the internal acl representation into a text representation.
685 if ((acl_text = acl_to_text(acl, NULL)) != NULL) {
686 jcr->acl_data->content_length = pm_strcpy(jcr->acl_data->content, acl_text);
692 Mmsg2(jcr->errmsg, _("acl_to_text error on file \"%s\": ERR=%s\n"),
693 jcr->last_fname, be.bstrerror());
694 Dmsg2(100, "acl_to_text error file=%s ERR=%s\n",
695 jcr->last_fname, be.bstrerror());
697 retval = bacl_exit_error;
701 * Handle errors gracefully.
704 #if defined(BACL_ENOTSUP)
707 * If the filesystem reports it doesn't support ACLs we clear the
708 * BACL_FLAG_SAVE_NATIVE flag so we skip ACL saves on all other files
709 * on the same filesystem. The BACL_FLAG_SAVE_NATIVE flag gets set again
710 * when we change from one filesystem to an other.
712 jcr->acl_data->flags &= ~BACL_FLAG_SAVE_NATIVE;
718 /* Some real error */
719 Mmsg2(jcr->errmsg, _("acl_get_file error on file \"%s\": ERR=%s\n"),
720 jcr->last_fname, be.bstrerror());
721 Dmsg2(100, "acl_get_file error file=%s ERR=%s\n",
722 jcr->last_fname, be.bstrerror());
724 retval = bacl_exit_error;
733 pm_strcpy(jcr->acl_data->content, "");
734 jcr->acl_data->content_length = 0;
739 * Generic wrapper around acl_set_file call.
741 static bacl_exit_code generic_set_acl_on_os(JCR *jcr, bacl_type acltype)
748 * If we get empty default ACLs, clear ACLs now
750 ostype = bac_to_os_acltype(acltype);
751 if (ostype == ACL_TYPE_DEFAULT && strlen(jcr->acl_data->content) == 0) {
752 if (acl_delete_def_file(jcr->last_fname) == 0) {
759 Mmsg2(jcr->errmsg, _("acl_delete_def_file error on file \"%s\": ERR=%s\n"),
760 jcr->last_fname, be.bstrerror());
761 return bacl_exit_error;
765 acl = acl_from_text(jcr->acl_data->content);
767 Mmsg2(jcr->errmsg, _("acl_from_text error on file \"%s\": ERR=%s\n"),
768 jcr->last_fname, be.bstrerror());
769 Dmsg3(100, "acl_from_text error acl=%s file=%s ERR=%s\n",
770 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
771 return bacl_exit_error;
774 #ifndef HAVE_FREEBSD_OS
776 * FreeBSD always fails acl_valid() - at least on valid input...
777 * As it does the right thing, given valid input, just ignore acl_valid().
779 if (acl_valid(acl) != 0) {
780 Mmsg2(jcr->errmsg, _("acl_valid error on file \"%s\": ERR=%s\n"),
781 jcr->last_fname, be.bstrerror());
782 Dmsg3(100, "acl_valid error acl=%s file=%s ERR=%s\n",
783 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
785 return bacl_exit_error;
790 * Restore the ACLs, but don't complain about links which really should
791 * not have attributes, and the file it is linked to may not yet be restored.
792 * This is only true for the old acl streams as in the new implementation we
793 * don't save acls of symlinks (which cannot have acls anyhow)
795 if (acl_set_file(jcr->last_fname, ostype, acl) != 0 && jcr->last_type != FT_LNK) {
801 Mmsg2(jcr->errmsg, _("acl_set_file error on file \"%s\": ERR=%s\n"),
802 jcr->last_fname, be.bstrerror());
803 Dmsg3(100, "acl_set_file error acl=%s file=%s ERR=%s\n",
804 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
806 return bacl_exit_error;
814 * OS specific functions for handling different types of acl streams.
816 #if defined(HAVE_DARWIN_OS)
818 * Define the supported ACL streams for this OS
820 static int os_access_acl_streams[1] = { STREAM_ACL_DARWIN_ACCESS_ACL };
821 static int os_default_acl_streams[1] = { -1 };
823 static bacl_exit_code darwin_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
825 #if defined(HAVE_ACL_TYPE_EXTENDED)
827 * On MacOS X, acl_get_file (name, ACL_TYPE_ACCESS)
828 * and acl_get_file (name, ACL_TYPE_DEFAULT)
829 * always return NULL / EINVAL. There is no point in making
830 * these two useless calls. The real ACL is retrieved through
831 * acl_get_file (name, ACL_TYPE_EXTENDED).
833 * Read access ACLs for files, dirs and links
835 if (generic_get_acl_from_os(jcr, BACL_TYPE_EXTENDED) == bacl_exit_fatal)
836 return bacl_exit_fatal;
839 * Read access ACLs for files, dirs and links
841 if (generic_get_acl_from_os(jcr, BACL_TYPE_ACCESS) == bacl_exit_fatal)
842 return bacl_exit_fatal;
845 if (jcr->acl_data->content_length > 0) {
846 return send_acl_stream(jcr, STREAM_ACL_DARWIN_ACCESS_ACL);
851 static bacl_exit_code darwin_parse_acl_streams(JCR *jcr, int stream)
853 #if defined(HAVE_ACL_TYPE_EXTENDED)
854 return generic_set_acl_on_os(jcr, BACL_TYPE_EXTENDED);
856 return generic_set_acl_on_os(jcr, BACL_TYPE_ACCESS);
861 * For this OS setup the build and parse function pointer to the OS specific functions.
863 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = darwin_build_acl_streams;
864 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = darwin_parse_acl_streams;
866 #elif defined(HAVE_FREEBSD_OS)
868 * Define the supported ACL streams for these OSes
870 static int os_access_acl_streams[2] = { STREAM_ACL_FREEBSD_ACCESS_ACL, STREAM_ACL_FREEBSD_NFS4_ACL };
871 static int os_default_acl_streams[1] = { STREAM_ACL_FREEBSD_DEFAULT_ACL };
873 static bacl_exit_code freebsd_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
876 bacl_type acltype = BACL_TYPE_NONE;
879 #if defined(_PC_ACL_NFS4)
881 * See if filesystem supports NFS4 acls.
883 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_NFS4);
884 switch (acl_enabled) {
890 Mmsg2(jcr->errmsg, _("pathconf error on file \"%s\": ERR=%s\n"),
891 jcr->last_fname, be.bstrerror());
892 Dmsg2(100, "pathconf error file=%s ERR=%s\n",
893 jcr->last_fname, be.bstrerror());
894 return bacl_exit_error;
899 acltype = BACL_TYPE_NFS4;
904 if (acl_enabled == 0) {
906 * See if filesystem supports POSIX acls.
908 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_EXTENDED);
909 switch (acl_enabled) {
915 Mmsg2(jcr->errmsg, _("pathconf error on file \"%s\": ERR=%s\n"),
916 jcr->last_fname, be.bstrerror());
917 Dmsg2(100, "pathconf error file=%s ERR=%s\n",
918 jcr->last_fname, be.bstrerror());
919 return bacl_exit_error;
924 acltype = BACL_TYPE_ACCESS;
930 * If the filesystem reports it doesn't support ACLs we clear the
931 * BACL_FLAG_SAVE_NATIVE flag so we skip ACL saves on all other files
932 * on the same filesystem. The BACL_FLAG_SAVE_NATIVE flag gets set again
933 * when we change from one filesystem to an other.
935 if (acl_enabled == 0) {
936 jcr->acl_data->flags &= ~BACL_FLAG_SAVE_NATIVE;
937 pm_strcpy(jcr->acl_data->content, "");
938 jcr->acl_data->content_length = 0;
943 * Based on the supported ACLs retrieve and store them.
948 * Read NFS4 ACLs for files, dirs and links
950 if (generic_get_acl_from_os(jcr, BACL_TYPE_NFS4) == bacl_exit_fatal)
951 return bacl_exit_fatal;
953 if (jcr->acl_data->content_length > 0) {
954 if (send_acl_stream(jcr, STREAM_ACL_FREEBSD_NFS4_ACL) == bacl_exit_fatal)
955 return bacl_exit_fatal;
958 case BACL_TYPE_ACCESS:
960 * Read access ACLs for files, dirs and links
962 if (generic_get_acl_from_os(jcr, BACL_TYPE_ACCESS) == bacl_exit_fatal)
963 return bacl_exit_fatal;
965 if (jcr->acl_data->content_length > 0) {
966 if (send_acl_stream(jcr, STREAM_ACL_FREEBSD_ACCESS_ACL) == bacl_exit_fatal)
967 return bacl_exit_fatal;
971 * Directories can have default ACLs too
973 if (ff_pkt->type == FT_DIREND) {
974 if (generic_get_acl_from_os(jcr, BACL_TYPE_DEFAULT) == bacl_exit_fatal)
975 return bacl_exit_fatal;
976 if (jcr->acl_data->content_length > 0) {
977 if (send_acl_stream(jcr, STREAM_ACL_FREEBSD_DEFAULT_ACL) == bacl_exit_fatal)
978 return bacl_exit_fatal;
989 static bacl_exit_code freebsd_parse_acl_streams(JCR *jcr, int stream)
992 const char *acl_type_name;
996 * First make sure the filesystem supports acls.
999 case STREAM_UNIX_ACCESS_ACL:
1000 case STREAM_ACL_FREEBSD_ACCESS_ACL:
1001 case STREAM_UNIX_DEFAULT_ACL:
1002 case STREAM_ACL_FREEBSD_DEFAULT_ACL:
1003 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_EXTENDED);
1004 acl_type_name = "POSIX";
1006 case STREAM_ACL_FREEBSD_NFS4_ACL:
1007 #if defined(_PC_ACL_NFS4)
1008 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_NFS4);
1010 acl_type_name = "NFS4";
1013 acl_type_name = "unknown";
1017 switch (acl_enabled) {
1021 return bacl_exit_ok;
1023 Mmsg2(jcr->errmsg, _("pathconf error on file \"%s\": ERR=%s\n"),
1024 jcr->last_fname, be.bstrerror());
1025 Dmsg3(100, "pathconf error acl=%s file=%s ERR=%s\n",
1026 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1027 return bacl_exit_error;
1030 Mmsg2(jcr->errmsg, _("Trying to restore acl on file \"%s\" on filesystem without %s acl support\n"),
1031 jcr->last_fname, acl_type_name);
1032 return bacl_exit_error;
1041 case STREAM_UNIX_ACCESS_ACL:
1042 case STREAM_ACL_FREEBSD_ACCESS_ACL:
1043 return generic_set_acl_on_os(jcr, BACL_TYPE_ACCESS);
1044 case STREAM_UNIX_DEFAULT_ACL:
1045 case STREAM_ACL_FREEBSD_DEFAULT_ACL:
1046 return generic_set_acl_on_os(jcr, BACL_TYPE_DEFAULT);
1047 case STREAM_ACL_FREEBSD_NFS4_ACL:
1048 return generic_set_acl_on_os(jcr, BACL_TYPE_NFS4);
1052 return bacl_exit_error;
1056 * For this OSes setup the build and parse function pointer to the OS specific functions.
1058 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = freebsd_build_acl_streams;
1059 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = freebsd_parse_acl_streams;
1061 #elif defined(HAVE_IRIX_OS) || \
1062 defined(HAVE_LINUX_OS)
1064 * Define the supported ACL streams for these OSes
1066 #if defined(HAVE_IRIX_OS)
1067 static int os_access_acl_streams[1] = { STREAM_ACL_IRIX_ACCESS_ACL };
1068 static int os_default_acl_streams[1] = { STREAM_ACL_IRIX_DEFAULT_ACL };
1069 #elif defined(HAVE_LINUX_OS)
1070 static int os_access_acl_streams[1] = { STREAM_ACL_LINUX_ACCESS_ACL };
1071 static int os_default_acl_streams[1] = { STREAM_ACL_LINUX_DEFAULT_ACL };
1074 static bacl_exit_code generic_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1077 * Read access ACLs for files, dirs and links
1079 if (generic_get_acl_from_os(jcr, BACL_TYPE_ACCESS) == bacl_exit_fatal)
1080 return bacl_exit_fatal;
1082 if (jcr->acl_data->content_length > 0) {
1083 if (send_acl_stream(jcr, os_access_acl_streams[0]) == bacl_exit_fatal)
1084 return bacl_exit_fatal;
1088 * Directories can have default ACLs too
1090 if (ff_pkt->type == FT_DIREND) {
1091 if (generic_get_acl_from_os(jcr, BACL_TYPE_DEFAULT) == bacl_exit_fatal)
1092 return bacl_exit_fatal;
1093 if (jcr->acl_data->content_length > 0) {
1094 if (send_acl_stream(jcr, os_default_acl_streams[0]) == bacl_exit_fatal)
1095 return bacl_exit_fatal;
1098 return bacl_exit_ok;
1101 static bacl_exit_code generic_parse_acl_streams(JCR *jcr, int stream)
1106 case STREAM_UNIX_ACCESS_ACL:
1107 return generic_set_acl_on_os(jcr, BACL_TYPE_ACCESS);
1108 case STREAM_UNIX_DEFAULT_ACL:
1109 return generic_set_acl_on_os(jcr, BACL_TYPE_DEFAULT);
1112 * See what type of acl it is.
1114 for (cnt = 0; cnt < sizeof(os_access_acl_streams) / sizeof(int); cnt++) {
1115 if (os_access_acl_streams[cnt] == stream) {
1116 return generic_set_acl_on_os(jcr, BACL_TYPE_ACCESS);
1119 for (cnt = 0; cnt < sizeof(os_default_acl_streams) / sizeof(int); cnt++) {
1120 if (os_default_acl_streams[cnt] == stream) {
1121 return generic_set_acl_on_os(jcr, BACL_TYPE_DEFAULT);
1126 return bacl_exit_error;
1130 * For this OSes setup the build and parse function pointer to the OS specific functions.
1132 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = generic_build_acl_streams;
1133 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = generic_parse_acl_streams;
1135 #elif defined(HAVE_OSF1_OS)
1138 * Define the supported ACL streams for this OS
1140 static int os_access_acl_streams[1] = { STREAM_ACL_TRU64_ACCESS_ACL };
1141 static int os_default_acl_streams[2] = { STREAM_ACL_TRU64_DEFAULT_ACL, STREAM_ACL_TRU64_DEFAULT_DIR_ACL };
1143 static bacl_exit_code tru64_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1146 * Read access ACLs for files, dirs and links
1148 if ((jcr->acl_data->content_length = generic_get_acl_from_os(jcr, BACL_TYPE_ACCESS)) < 0)
1149 return bacl_exit_error;
1150 if (jcr->acl_data->content_length > 0) {
1151 if (!send_acl_stream(jcr, STREAM_ACL_TRU64_ACCESS_ACL))
1152 return bacl_exit_error;
1155 * Directories can have default ACLs too
1157 if (ff_pkt->type == FT_DIREND) {
1158 if ((jcr->acl_data->content_length = generic_get_acl_from_os(jcr, BACL_TYPE_DEFAULT)) < 0)
1159 return bacl_exit_error;
1160 if (jcr->acl_data->content_length > 0) {
1161 if (!send_acl_stream(jcr, STREAM_ACL_TRU64_DEFAULT_ACL))
1162 return bacl_exit_error;
1165 * Tru64 has next to BACL_TYPE_DEFAULT also BACL_TYPE_DEFAULT_DIR acls.
1166 * This is an inherited acl for all subdirs.
1167 * See http://www.helsinki.fi/atk/unix/dec_manuals/DOC_40D/AQ0R2DTE/DOCU_018.HTM
1168 * Section 21.5 Default ACLs
1170 if ((jcr->acl_data->content_length = generic_get_acl_from_os(jcr, BACL_TYPE_DEFAULT_DIR)) < 0)
1171 return bacl_exit_error;
1172 if (jcr->acl_data->content_length > 0) {
1173 if (!send_acl_stream(jcr, STREAM_ACL_TRU64_DEFAULT_DIR_ACL))
1174 return bacl_exit_error;
1177 return bacl_exit_ok;
1180 static bacl_exit_code tru64_parse_acl_streams(JCR *jcr, int stream)
1183 case STREAM_UNIX_ACCESS_ACL:
1184 case STREAM_ACL_TRU64_ACCESS_ACL:
1185 return generic_set_acl_on_os(jcr, BACL_TYPE_ACCESS);
1186 case STREAM_UNIX_DEFAULT_ACL:
1187 case STREAM_ACL_TRU64_DEFAULT_ACL:
1188 return generic_set_acl_on_os(jcr, BACL_TYPE_DEFAULT);
1189 case STREAM_ACL_TRU64_DEFAULT_DIR_ACL:
1190 return generic_set_acl_on_os(jcr, BACL_TYPE_DEFAULT_DIR);
1194 * For this OS setup the build and parse function pointer to the OS specific functions.
1196 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = tru64_build_acl_streams;
1197 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = tru64_parse_acl_streams;
1201 #elif defined(HAVE_HPUX_OS)
1202 #ifdef HAVE_SYS_ACL_H
1203 #include <sys/acl.h>
1205 #error "configure failed to detect availability of sys/acl.h"
1211 * Define the supported ACL streams for this OS
1213 static int os_access_acl_streams[1] = { STREAM_ACL_HPUX_ACL_ENTRY };
1214 static int os_default_acl_streams[1] = { -1 };
1217 * See if an acl is a trivial one (e.g. just the stat bits encoded as acl.)
1218 * There is no need to store those acls as we already store the stat bits too.
1220 static bool acl_is_trivial(int count, struct acl_entry *entries, struct stat sb)
1223 struct acl_entry ace
1225 for (n = 0; n < count; n++) {
1228 * See if this acl just is the stat mode in acl form.
1230 if (!((ace.uid == sb.st_uid && ace.gid == ACL_NSGROUP) ||
1231 (ace.uid == ACL_NSUSER && ace.gid == sb.st_gid) ||
1232 (ace.uid == ACL_NSUSER && ace.gid == ACL_NSGROUP)))
1239 * OS specific functions for handling different types of acl streams.
1241 static bacl_exit_code hpux_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1244 struct acl_entry acls[NACLENTRIES];
1248 if ((n = getacl(jcr->last_fname, 0, acls)) < 0) {
1250 #if defined(BACL_ENOTSUP)
1253 * Not supported, just pretend there is nothing to see
1255 * If the filesystem reports it doesn't support ACLs we clear the
1256 * BACL_FLAG_SAVE_NATIVE flag so we skip ACL saves on all other files
1257 * on the same filesystem. The BACL_FLAG_SAVE_NATIVE flag gets set again
1258 * when we change from one filesystem to an other.
1260 jcr->acl_data->flags &= ~BACL_FLAG_SAVE_NATIVE;
1261 pm_strcpy(jcr->acl_data->content, "");
1262 jcr->acl_data->content_length = 0;
1263 return bacl_exit_ok;
1266 pm_strcpy(jcr->acl_data->content, "");
1267 jcr->acl_data->content_length = 0;
1268 return bacl_exit_ok;
1270 Mmsg2(jcr->errmsg, _("getacl error on file \"%s\": ERR=%s\n"),
1271 jcr->last_fname, be.bstrerror());
1272 Dmsg2(100, "getacl error file=%s ERR=%s\n",
1273 jcr->last_fname, be.bstrerror());
1275 pm_strcpy(jcr->acl_data->content, "");
1276 jcr->acl_data->content_length = 0;
1277 return bacl_exit_error;
1281 pm_strcpy(jcr->acl_data->content, "");
1282 jcr->acl_data->content_length = 0;
1283 return bacl_exit_ok;
1285 if ((n = getacl(jcr->last_fname, n, acls)) > 0) {
1286 if (acl_is_trivial(n, acls, ff_pkt->statp)) {
1288 * The ACLs simply reflect the (already known) standard permissions
1289 * So we don't send an ACL stream to the SD.
1291 pm_strcpy(jcr->acl_data->content, "");
1292 jcr->acl_data->content_length = 0;
1293 return bacl_exit_ok;
1295 if ((acl_text = acltostr(n, acls, FORM_SHORT)) != NULL) {
1296 jcr->acl_data->content_length = pm_strcpy(jcr->acl_data->content, acl_text);
1297 actuallyfree(acl_text);
1299 return send_acl_stream(jcr, STREAM_ACL_HPUX_ACL_ENTRY);
1301 Mmsg2(jcr->errmsg, _("acltostr error on file \"%s\": ERR=%s\n"),
1302 jcr->last_fname, be.bstrerror());
1303 Dmsg3(100, "acltostr error acl=%s file=%s ERR=%s\n",
1304 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1305 return bacl_exit_error;
1307 return bacl_exit_error;
1310 static bacl_exit_code hpux_parse_acl_streams(JCR *jcr, int stream)
1313 struct acl_entry acls[NACLENTRIES];
1316 n = strtoacl(jcr->acl_data->content, 0, NACLENTRIES, acls, ACL_FILEOWNER, ACL_FILEGROUP);
1318 Mmsg2(jcr->errmsg, _("strtoacl error on file \"%s\": ERR=%s\n"),
1319 jcr->last_fname, be.bstrerror());
1320 Dmsg3(100, "strtoacl error acl=%s file=%s ERR=%s\n",
1321 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1322 return bacl_exit_error;
1324 if (strtoacl(jcr->acl_data->content, n, NACLENTRIES, acls, ACL_FILEOWNER, ACL_FILEGROUP) != n) {
1325 Mmsg2(jcr->errmsg, _("strtoacl error on file \"%s\": ERR=%s\n"),
1326 jcr->last_fname, be.bstrerror());
1327 Dmsg3(100, "strtoacl error acl=%s file=%s ERR=%s\n",
1328 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1330 return bacl_exit_error;
1333 * Restore the ACLs, but don't complain about links which really should
1334 * not have attributes, and the file it is linked to may not yet be restored.
1335 * This is only true for the old acl streams as in the new implementation we
1336 * don't save acls of symlinks (which cannot have acls anyhow)
1338 if (setacl(jcr->last_fname, n, acls) != 0 && jcr->last_type != FT_LNK) {
1341 return bacl_exit_ok;
1343 Mmsg2(jcr->errmsg, _("setacl error on file \"%s\": ERR=%s\n"),
1344 jcr->last_fname, be.bstrerror());
1345 Dmsg3(100, "setacl error acl=%s file=%s ERR=%s\n",
1346 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1347 return bacl_exit_error;
1350 return bacl_exit_ok;
1354 * For this OS setup the build and parse function pointer to the OS specific functions.
1356 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = hpux_build_acl_streams;
1357 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = hpux_parse_acl_streams;
1359 #elif defined(HAVE_SUN_OS)
1360 #ifdef HAVE_SYS_ACL_H
1361 #include <sys/acl.h>
1363 #error "configure failed to detect availability of sys/acl.h"
1366 #if defined(HAVE_EXTENDED_ACL)
1368 * We define some internals of the Solaris acl libs here as those
1369 * are not exposed yet. Probably because they want us to see the
1370 * acls as opague data. But as we need to support different platforms
1371 * and versions of Solaris we need to expose some data to be able
1372 * to determine the type of acl used to stuff it into the correct
1373 * data stream. I know this is far from portable, but maybe the
1374 * proper interface is exposed later on and we can get ride of
1375 * this kludge. Newer versions of Solaris include sys/acl_impl.h
1376 * which has implementation details of acls, if thats included we
1377 * don't have to define it ourself.
1379 #if !defined(_SYS_ACL_IMPL_H)
1380 typedef enum acl_type {
1387 * Two external references to functions in the libsec library function not in current include files.
1390 int acl_type(acl_t *);
1391 char *acl_strerror(int);
1395 * Define the supported ACL streams for this OS
1397 static int os_access_acl_streams[2] = { STREAM_ACL_SOLARIS_ACLENT, STREAM_ACL_SOLARIS_ACE };
1398 static int os_default_acl_streams[1] = { -1 };
1401 * As the new libsec interface with acl_totext and acl_fromtext also handles
1402 * the old format from acltotext we can use the new functions even
1403 * for acls retrieved and stored in the database with older fd versions. If the
1404 * new interface is not defined (Solaris 9 and older we fall back to the old code)
1406 static bacl_exit_code solaris_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1408 int acl_enabled, flags;
1411 bacl_exit_code stream_status = bacl_exit_error;
1415 * See if filesystem supports acls.
1417 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_ENABLED);
1418 switch (acl_enabled) {
1421 * If the filesystem reports it doesn't support ACLs we clear the
1422 * BACL_FLAG_SAVE_NATIVE flag so we skip ACL saves on all other files
1423 * on the same filesystem. The BACL_FLAG_SAVE_NATIVE flag gets set again
1424 * when we change from one filesystem to an other.
1426 jcr->acl_data->flags &= ~BACL_FLAG_SAVE_NATIVE;
1427 pm_strcpy(jcr->acl_data->content, "");
1428 jcr->acl_data->content_length = 0;
1429 return bacl_exit_ok;
1433 return bacl_exit_ok;
1435 Mmsg2(jcr->errmsg, _("pathconf error on file \"%s\": ERR=%s\n"),
1436 jcr->last_fname, be.bstrerror());
1437 Dmsg2(100, "pathconf error file=%s ERR=%s\n",
1438 jcr->last_fname, be.bstrerror());
1439 return bacl_exit_error;
1446 * Get ACL info: don't bother allocating space if there is only a trivial ACL.
1448 if (acl_get(jcr->last_fname, ACL_NO_TRIVIAL, &aclp) != 0) {
1451 return bacl_exit_ok;
1453 Mmsg2(jcr->errmsg, _("acl_get error on file \"%s\": ERR=%s\n"),
1454 jcr->last_fname, acl_strerror(errno));
1455 Dmsg2(100, "acl_get error file=%s ERR=%s\n",
1456 jcr->last_fname, acl_strerror(errno));
1457 return bacl_exit_error;
1463 * The ACLs simply reflect the (already known) standard permissions
1464 * So we don't send an ACL stream to the SD.
1466 pm_strcpy(jcr->acl_data->content, "");
1467 jcr->acl_data->content_length = 0;
1468 return bacl_exit_ok;
1471 #if defined(ACL_SID_FMT)
1473 * New format flag added in newer Solaris versions.
1475 flags = ACL_APPEND_ID | ACL_COMPACT_FMT | ACL_SID_FMT;
1477 flags = ACL_APPEND_ID | ACL_COMPACT_FMT;
1478 #endif /* ACL_SID_FMT */
1480 if ((acl_text = acl_totext(aclp, flags)) != NULL) {
1481 jcr->acl_data->content_length = pm_strcpy(jcr->acl_data->content, acl_text);
1482 actuallyfree(acl_text);
1484 switch (acl_type(aclp)) {
1486 stream_status = send_acl_stream(jcr, STREAM_ACL_SOLARIS_ACLENT);
1489 stream_status = send_acl_stream(jcr, STREAM_ACL_SOLARIS_ACE);
1497 return stream_status;
1500 static bacl_exit_code solaris_parse_acl_streams(JCR *jcr, int stream)
1503 int acl_enabled, error;
1507 case STREAM_UNIX_ACCESS_ACL:
1508 case STREAM_ACL_SOLARIS_ACLENT:
1509 case STREAM_ACL_SOLARIS_ACE:
1511 * First make sure the filesystem supports acls.
1513 acl_enabled = pathconf(jcr->last_fname, _PC_ACL_ENABLED);
1514 switch (acl_enabled) {
1516 Mmsg1(jcr->errmsg, _("Trying to restore acl on file \"%s\" on filesystem without acl support\n"),
1518 return bacl_exit_error;
1522 return bacl_exit_ok;
1524 Mmsg2(jcr->errmsg, _("pathconf error on file \"%s\": ERR=%s\n"),
1525 jcr->last_fname, be.bstrerror());
1526 Dmsg3(100, "pathconf error acl=%s file=%s ERR=%s\n",
1527 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1528 return bacl_exit_error;
1532 * On a filesystem with ACL support make sure this particular ACL type can be restored.
1535 case STREAM_ACL_SOLARIS_ACLENT:
1537 * An aclent can be restored on filesystems with _ACL_ACLENT_ENABLED or _ACL_ACE_ENABLED support.
1539 if ((acl_enabled & (_ACL_ACLENT_ENABLED | _ACL_ACE_ENABLED)) == 0) {
1540 Mmsg1(jcr->errmsg, _("Trying to restore acl on file \"%s\" on filesystem without aclent acl support\n"),
1542 return bacl_exit_error;
1545 case STREAM_ACL_SOLARIS_ACE:
1547 * An ace can only be restored on a filesystem with _ACL_ACE_ENABLED support.
1549 if ((acl_enabled & _ACL_ACE_ENABLED) == 0) {
1550 Mmsg1(jcr->errmsg, _("Trying to restore acl on file \"%s\" on filesystem without ace acl support\n"),
1552 return bacl_exit_error;
1557 * Stream id which doesn't describe the type of acl which is encoded.
1564 if ((error = acl_fromtext(jcr->acl_data->content, &aclp)) != 0) {
1565 Mmsg2(jcr->errmsg, _("acl_fromtext error on file \"%s\": ERR=%s\n"),
1566 jcr->last_fname, acl_strerror(error));
1567 Dmsg3(100, "acl_fromtext error acl=%s file=%s ERR=%s\n",
1568 jcr->acl_data->content, jcr->last_fname, acl_strerror(error));
1569 return bacl_exit_error;
1573 * Validate that the conversion gave us the correct acl type.
1576 case STREAM_ACL_SOLARIS_ACLENT:
1577 if (acl_type(aclp) != ACLENT_T) {
1578 Mmsg1(jcr->errmsg, _("wrong encoding of acl type in acl stream on file \"%s\"\n"),
1580 return bacl_exit_error;
1583 case STREAM_ACL_SOLARIS_ACE:
1584 if (acl_type(aclp) != ACE_T) {
1585 Mmsg1(jcr->errmsg, _("wrong encoding of acl type in acl stream on file \"%s\"\n"),
1587 return bacl_exit_error;
1592 * Stream id which doesn't describe the type of acl which is encoded.
1598 * Restore the ACLs, but don't complain about links which really should
1599 * not have attributes, and the file it is linked to may not yet be restored.
1600 * This is only true for the old acl streams as in the new implementation we
1601 * don't save acls of symlinks (which cannot have acls anyhow)
1603 if ((error = acl_set(jcr->last_fname, aclp)) == -1 && jcr->last_type != FT_LNK) {
1607 return bacl_exit_ok;
1609 Mmsg2(jcr->errmsg, _("acl_set error on file \"%s\": ERR=%s\n"),
1610 jcr->last_fname, acl_strerror(error));
1611 Dmsg3(100, "acl_set error acl=%s file=%s ERR=%s\n",
1612 jcr->acl_data->content, jcr->last_fname, acl_strerror(error));
1614 return bacl_exit_error;
1619 return bacl_exit_ok;
1621 return bacl_exit_error;
1622 } /* end switch (stream) */
1625 #else /* HAVE_EXTENDED_ACL */
1628 * Define the supported ACL streams for this OS
1630 static int os_access_acl_streams[2] = { STREAM_ACL_SOLARIS_ACLENT };
1631 static int os_default_acl_streams[1] = { -1 };
1634 * See if an acl is a trivial one (e.g. just the stat bits encoded as acl.)
1635 * There is no need to store those acls as we already store the stat bits too.
1637 static bool acl_is_trivial(int count, aclent_t *entries)
1642 for (n = 0; n < count; n++) {
1645 if (!(ace->a_type == USER_OBJ ||
1646 ace->a_type == GROUP_OBJ ||
1647 ace->a_type == OTHER_OBJ ||
1648 ace->a_type == CLASS_OBJ))
1655 * OS specific functions for handling different types of acl streams.
1657 static bacl_exit_code solaris_build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1664 n = acl(jcr->last_fname, GETACLCNT, 0, NULL);
1665 if (n < MIN_ACL_ENTRIES)
1666 return bacl_exit_error;
1668 acls = (aclent_t *)malloc(n * sizeof(aclent_t));
1669 if (acl(jcr->last_fname, GETACL, n, acls) == n) {
1670 if (acl_is_trivial(n, acls)) {
1672 * The ACLs simply reflect the (already known) standard permissions
1673 * So we don't send an ACL stream to the SD.
1676 pm_strcpy(jcr->acl_data->content, "");
1677 jcr->acl_data->content_length = 0;
1678 return bacl_exit_ok;
1681 if ((acl_text = acltotext(acls, n)) != NULL) {
1682 jcr->acl_data->content_length = pm_strcpy(jcr->acl_data->content, acl_text);
1683 actuallyfree(acl_text);
1685 return send_acl_stream(jcr, STREAM_ACL_SOLARIS_ACLENT);
1688 Mmsg2(jcr->errmsg, _("acltotext error on file \"%s\": ERR=%s\n"),
1689 jcr->last_fname, be.bstrerror());
1690 Dmsg3(100, "acltotext error acl=%s file=%s ERR=%s\n",
1691 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1695 return bacl_exit_error;
1698 static bacl_exit_code solaris_parse_acl_streams(JCR *jcr, int stream)
1704 acls = aclfromtext(jcr->acl_data->content, &n);
1706 Mmsg2(jcr->errmsg, _("aclfromtext error on file \"%s\": ERR=%s\n"),
1707 jcr->last_fname, be.bstrerror());
1708 Dmsg3(100, "aclfromtext error acl=%s file=%s ERR=%s\n",
1709 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1710 return bacl_exit_error;
1714 * Restore the ACLs, but don't complain about links which really should
1715 * not have attributes, and the file it is linked to may not yet be restored.
1717 if (acl(jcr->last_fname, SETACL, n, acls) == -1 && jcr->last_type != FT_LNK) {
1721 return bacl_exit_ok;
1723 Mmsg2(jcr->errmsg, _("acl(SETACL) error on file \"%s\": ERR=%s\n"),
1724 jcr->last_fname, be.bstrerror());
1725 Dmsg3(100, "acl(SETACL) error acl=%s file=%s ERR=%s\n",
1726 jcr->acl_data->content, jcr->last_fname, be.bstrerror());
1728 return bacl_exit_error;
1732 return bacl_exit_ok;
1734 #endif /* HAVE_EXTENDED_ACL */
1737 * For this OS setup the build and parse function pointer to the OS specific functions.
1739 static bacl_exit_code (*os_build_acl_streams)(JCR *jcr, FF_PKT *ff_pkt) = solaris_build_acl_streams;
1740 static bacl_exit_code (*os_parse_acl_streams)(JCR *jcr, int stream) = solaris_parse_acl_streams;
1742 #endif /* HAVE_SUN_OS */
1743 #endif /* HAVE_ACL */
1746 * Entry points when compiled with support for ACLs on a supported platform.
1750 * Read and send an ACL for the last encountered file.
1752 bacl_exit_code build_acl_streams(JCR *jcr, FF_PKT *ff_pkt)
1755 * See if we are changing from one device to an other.
1756 * We save the current device we are scanning and compare
1757 * it with the current st_dev in the last stat performed on
1758 * the file we are currently storing.
1760 if (jcr->acl_data->current_dev != ff_pkt->statp.st_dev) {
1762 * Reset the acl save flags.
1764 jcr->acl_data->flags = 0;
1766 jcr->acl_data->flags |= BACL_FLAG_SAVE_NATIVE;
1769 * Save that we started scanning a new filesystem.
1771 jcr->acl_data->current_dev = ff_pkt->statp.st_dev;
1774 #if defined(HAVE_ACL)
1776 * See if the BACL_FLAG_SAVE_NATIVE flag is set which lets us know if we should
1779 if (jcr->acl_data->flags & BACL_FLAG_SAVE_NATIVE) {
1781 * Call the appropriate function.
1783 if (os_build_acl_streams) {
1784 return (*os_build_acl_streams)(jcr, ff_pkt);
1787 return bacl_exit_ok;
1790 return bacl_exit_error;
1793 bacl_exit_code parse_acl_streams(JCR *jcr, int stream)
1798 #if defined(HAVE_ACL)
1799 case STREAM_UNIX_ACCESS_ACL:
1800 case STREAM_UNIX_DEFAULT_ACL:
1802 * Handle legacy ACL streams.
1804 if (os_parse_acl_streams) {
1805 return (*os_parse_acl_streams)(jcr, stream);
1809 if (os_parse_acl_streams) {
1811 * Walk the os_access_acl_streams array with the supported Access ACL streams for this OS.
1813 for (cnt = 0; cnt < sizeof(os_access_acl_streams) / sizeof(int); cnt++) {
1814 if (os_access_acl_streams[cnt] == stream) {
1815 return (*os_parse_acl_streams)(jcr, stream);
1819 * Walk the os_default_acl_streams array with the supported Default ACL streams for this OS.
1821 for (cnt = 0; cnt < sizeof(os_default_acl_streams) / sizeof(int); cnt++) {
1822 if (os_default_acl_streams[cnt] == stream) {
1823 return (*os_parse_acl_streams)(jcr, stream);
1833 Qmsg2(jcr, M_WARNING, 0,
1834 _("Can't restore ACLs of %s - incompatible acl stream encountered - %d\n"),
1835 jcr->last_fname, stream);
1836 return bacl_exit_error;