lib/qset-acl.c

   1 /* qset-acl.c - set access control list equivalent to a mode
   2
   3    Copyright (C) 2002-2003, 2005-2013 Free Software Foundation, Inc.
   4
   5    This program is free software: you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17
  18    Written by Paul Eggert and Andreas Gruenbacher, and Bruno Haible.  */
  19
  20 #include <config.h>
  21
  22 #define ACL_INTERNAL_INLINE _GL_EXTERN_INLINE
  23
  24 #include "acl.h"
  25
  26 #include "acl-internal.h"
  27
  28
  29 /* If DESC is a valid file descriptor use fchmod to change the
  30    file's mode to MODE on systems that have fchmod. On systems
  31    that don't have fchmod and if DESC is invalid, use chmod on
  32    NAME instead.
  33    Return 0 if successful.  Return -1 and set errno upon failure.  */
  34
  35 int
  36 chmod_or_fchmod (const char *name, int desc, mode_t mode)
  37 {
  38   if (HAVE_FCHMOD && desc != -1)
  39     return fchmod (desc, mode);
  40   else
  41     return chmod (name, mode);
  42 }
  43
  44 /* Set the access control lists of a file. If DESC is a valid file
  45    descriptor, use file descriptor operations where available, else use
  46    filename based operations on NAME.  If access control lists are not
  47    available, fchmod the target file to MODE.  Also sets the
  48    non-permission bits of the destination file (S_ISUID, S_ISGID, S_ISVTX)
  49    to those from MODE if any are set.
  50    Return 0 if successful.  Return -1 and set errno upon failure.  */
  51
  52 int
  53 qset_acl (char const *name, int desc, mode_t mode)
  54 {
  55 #if USE_ACL
  56 # if HAVE_ACL_GET_FILE
  57   /* POSIX 1003.1e draft 17 (abandoned) specific version.  */
  58   /* Linux, FreeBSD, Mac OS X, IRIX, Tru64 */
  59 #  if !HAVE_ACL_TYPE_EXTENDED
  60   /* Linux, FreeBSD, IRIX, Tru64 */
  61
  62   /* We must also have acl_from_text and acl_delete_def_file.
  63      (acl_delete_def_file could be emulated with acl_init followed
  64       by acl_set_file, but acl_set_file with an empty acl is
  65       unspecified.)  */
  66
  67 #   ifndef HAVE_ACL_FROM_TEXT
  68 #    error Must have acl_from_text (see POSIX 1003.1e draft 17).
  69 #   endif
  70 #   ifndef HAVE_ACL_DELETE_DEF_FILE
  71 #    error Must have acl_delete_def_file (see POSIX 1003.1e draft 17).
  72 #   endif
  73
  74   acl_t acl;
  75   int ret;
  76
  77   if (HAVE_ACL_FROM_MODE) /* Linux */
  78     {
  79       acl = acl_from_mode (mode);
  80       if (!acl)
  81         return -1;
  82     }
  83   else /* FreeBSD, IRIX, Tru64 */
  84     {
  85       /* If we were to create the ACL using the functions acl_init(),
  86          acl_create_entry(), acl_set_tag_type(), acl_set_qualifier(),
  87          acl_get_permset(), acl_clear_perm[s](), acl_add_perm(), we
  88          would need to create a qualifier.  I don't know how to do this.
  89          So create it using acl_from_text().  */
  90
  91 #   if HAVE_ACL_FREE_TEXT /* Tru64 */
  92       char acl_text[] = "u::---,g::---,o::---,";
  93 #   else /* FreeBSD, IRIX */
  94       char acl_text[] = "u::---,g::---,o::---";
  95 #   endif
  96
  97       if (mode & S_IRUSR) acl_text[ 3] = 'r';
  98       if (mode & S_IWUSR) acl_text[ 4] = 'w';
  99       if (mode & S_IXUSR) acl_text[ 5] = 'x';
 100       if (mode & S_IRGRP) acl_text[10] = 'r';
 101       if (mode & S_IWGRP) acl_text[11] = 'w';
 102       if (mode & S_IXGRP) acl_text[12] = 'x';
 103       if (mode & S_IROTH) acl_text[17] = 'r';
 104       if (mode & S_IWOTH) acl_text[18] = 'w';
 105       if (mode & S_IXOTH) acl_text[19] = 'x';
 106
 107       acl = acl_from_text (acl_text);
 108       if (!acl)
 109         return -1;
 110     }
 111   if (HAVE_ACL_SET_FD && desc != -1)
 112     ret = acl_set_fd (desc, acl);
 113   else
 114     ret = acl_set_file (name, ACL_TYPE_ACCESS, acl);
 115   if (ret != 0)
 116     {
 117       int saved_errno = errno;
 118       acl_free (acl);
 119       if (! acl_errno_valid (errno))
 120         return chmod_or_fchmod (name, desc, mode);
 121       errno = saved_errno;
 122       return -1;
 123     }
 124   else
 125     acl_free (acl);
 126
 127   if (S_ISDIR (mode) && acl_delete_def_file (name))
 128     return -1;
 129
 130   if (!MODE_INSIDE_ACL || (mode & (S_ISUID | S_ISGID | S_ISVTX)))
 131     {
 132       /* We did not call chmod so far, and either the mode and the ACL are
 133          separate or special bits are to be set which don't fit into ACLs.  */
 134       return chmod_or_fchmod (name, desc, mode);
 135     }
 136   return 0;
 137
 138 #  else /* HAVE_ACL_TYPE_EXTENDED */
 139   /* Mac OS X */
 140
 141   /* On Mac OS X,  acl_get_file (name, ACL_TYPE_ACCESS)
 142      and           acl_get_file (name, ACL_TYPE_DEFAULT)
 143      always return NULL / EINVAL.  You have to use
 144                    acl_get_file (name, ACL_TYPE_EXTENDED)
 145      or            acl_get_fd (open (name, ...))
 146      to retrieve an ACL.
 147      On the other hand,
 148                    acl_set_file (name, ACL_TYPE_ACCESS, acl)
 149      and           acl_set_file (name, ACL_TYPE_DEFAULT, acl)
 150      have the same effect as
 151                    acl_set_file (name, ACL_TYPE_EXTENDED, acl):
 152      Each of these calls sets the file's ACL.  */
 153
 154   acl_t acl;
 155   int ret;
 156
 157   /* Remove the ACL if the file has ACLs.  */
 158   if (HAVE_ACL_GET_FD && desc != -1)
 159     acl = acl_get_fd (desc);
 160   else
 161     acl = acl_get_file (name, ACL_TYPE_EXTENDED);
 162   if (acl)
 163     {
 164       acl_free (acl);
 165
 166       acl = acl_init (0);
 167       if (acl)
 168         {
 169           if (HAVE_ACL_SET_FD && desc != -1)
 170             ret = acl_set_fd (desc, acl);
 171           else
 172             ret = acl_set_file (name, ACL_TYPE_EXTENDED, acl);
 173           if (ret != 0)
 174             {
 175               int saved_errno = errno;
 176               acl_free (acl);
 177               if (! acl_errno_valid (saved_errno))
 178                 return chmod_or_fchmod (name, desc, mode);
 179               errno = saved_errno;
 180               return -1;
 181             }
 182           acl_free (acl);
 183         }
 184     }
 185
 186   /* Since !MODE_INSIDE_ACL, we have to call chmod explicitly.  */
 187   return chmod_or_fchmod (name, desc, mode);
 188 #  endif
 189
 190 # elif HAVE_FACL && defined GETACL /* Solaris, Cygwin, not HP-UX */
 191
 192   int done_setacl = 0;
 193
 194 #  ifdef ACE_GETACL
 195   /* Solaris also has a different variant of ACLs, used in ZFS and NFSv4
 196      file systems (whereas the other ones are used in UFS file systems).  */
 197
 198   /* The flags in the ace_t structure changed in a binary incompatible way
 199      when ACL_NO_TRIVIAL etc. were introduced in <sys/acl.h> version 1.15.
 200      How to distinguish the two conventions at runtime?
 201      We fetch the existing ACL.  In the old convention, usually three ACEs have
 202      a_flags = ACE_OWNER / ACE_GROUP / ACE_OTHER, in the range 0x0100..0x0400.
 203      In the new convention, these values are not used.  */
 204   int convention;
 205
 206   {
 207     /* Initially, try to read the entries into a stack-allocated buffer.
 208        Use malloc if it does not fit.  */
 209     enum
 210       {
 211         alloc_init = 4000 / sizeof (ace_t), /* >= 3 */
 212         alloc_max = MIN (INT_MAX, SIZE_MAX / sizeof (ace_t))
 213       };
 214     ace_t buf[alloc_init];
 215     size_t alloc = alloc_init;
 216     ace_t *entries = buf;
 217     ace_t *malloced = NULL;
 218     int count;
 219
 220     for (;;)
 221       {
 222         count = (desc != -1
 223                  ? facl (desc, ACE_GETACL, alloc, entries)
 224                  : acl (name, ACE_GETACL, alloc, entries));
 225         if (count < 0 && errno == ENOSPC)
 226           {
 227             /* Increase the size of the buffer.  */
 228             free (malloced);
 229             if (alloc > alloc_max / 2)
 230               {
 231                 errno = ENOMEM;
 232                 return -1;
 233               }
 234             alloc = 2 * alloc; /* <= alloc_max */
 235             entries = malloced = (ace_t *) malloc (alloc * sizeof (ace_t));
 236             if (entries == NULL)
 237               {
 238                 errno = ENOMEM;
 239                 return -1;
 240               }
 241             continue;
 242           }
 243         break;
 244       }
 245
 246     if (count <= 0)
 247       convention = -1;
 248     else
 249       {
 250         int i;
 251
 252         convention = 0;
 253         for (i = 0; i < count; i++)
 254           if (entries[i].a_flags & (OLD_ACE_OWNER | OLD_ACE_GROUP | OLD_ACE_OTHER))
 255             {
 256               convention = 1;
 257               break;
 258             }
 259       }
 260     free (malloced);
 261   }
 262
 263   if (convention >= 0)
 264     {
 265       ace_t entries[6];
 266       int count;
 267       int ret;
 268
 269       if (convention)
 270         {
 271           /* Running on Solaris 10.  */
 272           entries[0].a_type = OLD_ALLOW;
 273           entries[0].a_flags = OLD_ACE_OWNER;
 274           entries[0].a_who = 0; /* irrelevant */
 275           entries[0].a_access_mask = (mode >> 6) & 7;
 276           entries[1].a_type = OLD_ALLOW;
 277           entries[1].a_flags = OLD_ACE_GROUP;
 278           entries[1].a_who = 0; /* irrelevant */
 279           entries[1].a_access_mask = (mode >> 3) & 7;
 280           entries[2].a_type = OLD_ALLOW;
 281           entries[2].a_flags = OLD_ACE_OTHER;
 282           entries[2].a_who = 0;
 283           entries[2].a_access_mask = mode & 7;
 284           count = 3;
 285         }
 286       else
 287         {
 288           /* Running on Solaris 10 (newer version) or Solaris 11.
 289              The details here were found through "/bin/ls -lvd somefiles".  */
 290           entries[0].a_type = NEW_ACE_ACCESS_DENIED_ACE_TYPE;
 291           entries[0].a_flags = NEW_ACE_OWNER;
 292           entries[0].a_who = 0; /* irrelevant */
 293           entries[0].a_access_mask = 0;
 294           entries[1].a_type = NEW_ACE_ACCESS_ALLOWED_ACE_TYPE;
 295           entries[1].a_flags = NEW_ACE_OWNER;
 296           entries[1].a_who = 0; /* irrelevant */
 297           entries[1].a_access_mask = NEW_ACE_WRITE_NAMED_ATTRS
 298                                      | NEW_ACE_WRITE_ATTRIBUTES
 299                                      | NEW_ACE_WRITE_ACL
 300                                      | NEW_ACE_WRITE_OWNER;
 301           if (mode & 0400)
 302             entries[1].a_access_mask |= NEW_ACE_READ_DATA;
 303           else
 304             entries[0].a_access_mask |= NEW_ACE_READ_DATA;
 305           if (mode & 0200)
 306             entries[1].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 307           else
 308             entries[0].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 309           if (mode & 0100)
 310             entries[1].a_access_mask |= NEW_ACE_EXECUTE;
 311           else
 312             entries[0].a_access_mask |= NEW_ACE_EXECUTE;
 313           entries[2].a_type = NEW_ACE_ACCESS_DENIED_ACE_TYPE;
 314           entries[2].a_flags = NEW_ACE_GROUP | NEW_ACE_IDENTIFIER_GROUP;
 315           entries[2].a_who = 0; /* irrelevant */
 316           entries[2].a_access_mask = 0;
 317           entries[3].a_type = NEW_ACE_ACCESS_ALLOWED_ACE_TYPE;
 318           entries[3].a_flags = NEW_ACE_GROUP | NEW_ACE_IDENTIFIER_GROUP;
 319           entries[3].a_who = 0; /* irrelevant */
 320           entries[3].a_access_mask = 0;
 321           if (mode & 0040)
 322             entries[3].a_access_mask |= NEW_ACE_READ_DATA;
 323           else
 324             entries[2].a_access_mask |= NEW_ACE_READ_DATA;
 325           if (mode & 0020)
 326             entries[3].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 327           else
 328             entries[2].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 329           if (mode & 0010)
 330             entries[3].a_access_mask |= NEW_ACE_EXECUTE;
 331           else
 332             entries[2].a_access_mask |= NEW_ACE_EXECUTE;
 333           entries[4].a_type = NEW_ACE_ACCESS_DENIED_ACE_TYPE;
 334           entries[4].a_flags = NEW_ACE_EVERYONE;
 335           entries[4].a_who = 0;
 336           entries[4].a_access_mask = NEW_ACE_WRITE_NAMED_ATTRS
 337                                      | NEW_ACE_WRITE_ATTRIBUTES
 338                                      | NEW_ACE_WRITE_ACL
 339                                      | NEW_ACE_WRITE_OWNER;
 340           entries[5].a_type = NEW_ACE_ACCESS_ALLOWED_ACE_TYPE;
 341           entries[5].a_flags = NEW_ACE_EVERYONE;
 342           entries[5].a_who = 0;
 343           entries[5].a_access_mask = NEW_ACE_READ_NAMED_ATTRS
 344                                      | NEW_ACE_READ_ATTRIBUTES
 345                                      | NEW_ACE_READ_ACL
 346                                      | NEW_ACE_SYNCHRONIZE;
 347           if (mode & 0004)
 348             entries[5].a_access_mask |= NEW_ACE_READ_DATA;
 349           else
 350             entries[4].a_access_mask |= NEW_ACE_READ_DATA;
 351           if (mode & 0002)
 352             entries[5].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 353           else
 354             entries[4].a_access_mask |= NEW_ACE_WRITE_DATA | NEW_ACE_APPEND_DATA;
 355           if (mode & 0001)
 356             entries[5].a_access_mask |= NEW_ACE_EXECUTE;
 357           else
 358             entries[4].a_access_mask |= NEW_ACE_EXECUTE;
 359           count = 6;
 360         }
 361       if (desc != -1)
 362         ret = facl (desc, ACE_SETACL, count, entries);
 363       else
 364         ret = acl (name, ACE_SETACL, count, entries);
 365       if (ret < 0 && errno != EINVAL && errno != ENOTSUP)
 366         {
 367           if (errno == ENOSYS)
 368             return chmod_or_fchmod (name, desc, mode);
 369           return -1;
 370         }
 371       if (ret == 0)
 372         done_setacl = 1;
 373     }
 374 #  endif
 375
 376   if (!done_setacl)
 377     {
 378       aclent_t entries[3];
 379       int ret;
 380
 381       entries[0].a_type = USER_OBJ;
 382       entries[0].a_id = 0; /* irrelevant */
 383       entries[0].a_perm = (mode >> 6) & 7;
 384       entries[1].a_type = GROUP_OBJ;
 385       entries[1].a_id = 0; /* irrelevant */
 386       entries[1].a_perm = (mode >> 3) & 7;
 387       entries[2].a_type = OTHER_OBJ;
 388       entries[2].a_id = 0;
 389       entries[2].a_perm = mode & 7;
 390
 391       if (desc != -1)
 392         ret = facl (desc, SETACL,
 393                     sizeof (entries) / sizeof (aclent_t), entries);
 394       else
 395         ret = acl (name, SETACL,
 396                    sizeof (entries) / sizeof (aclent_t), entries);
 397       if (ret < 0)
 398         {
 399           if (errno == ENOSYS || errno == EOPNOTSUPP)
 400             return chmod_or_fchmod (name, desc, mode);
 401           return -1;
 402         }
 403     }
 404
 405   if (!MODE_INSIDE_ACL || (mode & (S_ISUID | S_ISGID | S_ISVTX)))
 406     {
 407       /* We did not call chmod so far, so the special bits have not yet
 408          been set.  */
 409       return chmod_or_fchmod (name, desc, mode);
 410     }
 411   return 0;
 412
 413 # elif HAVE_GETACL /* HP-UX */
 414
 415   struct stat statbuf;
 416   int ret;
 417
 418   if (desc != -1)
 419     ret = fstat (desc, &statbuf);
 420   else
 421     ret = stat (name, &statbuf);
 422   if (ret < 0)
 423     return -1;
 424
 425   {
 426     struct acl_entry entries[3];
 427
 428     entries[0].uid = statbuf.st_uid;
 429     entries[0].gid = ACL_NSGROUP;
 430     entries[0].mode = (mode >> 6) & 7;
 431     entries[1].uid = ACL_NSUSER;
 432     entries[1].gid = statbuf.st_gid;
 433     entries[1].mode = (mode >> 3) & 7;
 434     entries[2].uid = ACL_NSUSER;
 435     entries[2].gid = ACL_NSGROUP;
 436     entries[2].mode = mode & 7;
 437
 438     if (desc != -1)
 439       ret = fsetacl (desc, sizeof (entries) / sizeof (struct acl_entry), entries);
 440     else
 441       ret = setacl (name, sizeof (entries) / sizeof (struct acl_entry), entries);
 442   }
 443   if (ret < 0)
 444     {
 445       if (!(errno == ENOSYS || errno == EOPNOTSUPP || errno == ENOTSUP))
 446         return -1;
 447
 448 #  if HAVE_ACLV_H /* HP-UX >= 11.11 */
 449       {
 450         struct acl entries[4];
 451
 452         entries[0].a_type = USER_OBJ;
 453         entries[0].a_id = 0; /* irrelevant */
 454         entries[0].a_perm = (mode >> 6) & 7;
 455         entries[1].a_type = GROUP_OBJ;
 456         entries[1].a_id = 0; /* irrelevant */
 457         entries[1].a_perm = (mode >> 3) & 7;
 458         entries[2].a_type = CLASS_OBJ;
 459         entries[2].a_id = 0;
 460         entries[2].a_perm = (mode >> 3) & 7;
 461         entries[3].a_type = OTHER_OBJ;
 462         entries[3].a_id = 0;
 463         entries[3].a_perm = mode & 7;
 464
 465         ret = aclsort (sizeof (entries) / sizeof (struct acl), 1, entries);
 466         if (ret > 0)
 467           abort ();
 468         if (ret < 0)
 469           {
 470             if (0)
 471               return chmod_or_fchmod (name, desc, mode);
 472             return -1;
 473           }
 474
 475         ret = acl ((char *) name, ACL_SET,
 476                    sizeof (entries) / sizeof (struct acl), entries);
 477         if (ret < 0)
 478           {
 479             if (errno == ENOSYS || errno == EOPNOTSUPP || errno == EINVAL)
 480               return chmod_or_fchmod (name, desc, mode);
 481             return -1;
 482           }
 483       }
 484 #  else
 485       return chmod_or_fchmod (name, desc, mode);
 486 #  endif
 487     }
 488
 489   if (mode & (S_ISUID | S_ISGID | S_ISVTX))
 490     {
 491       /* We did not call chmod so far, so the special bits have not yet
 492          been set.  */
 493       return chmod_or_fchmod (name, desc, mode);
 494     }
 495   return 0;
 496
 497 # elif HAVE_ACLX_GET && defined ACL_AIX_WIP /* AIX */
 498
 499   acl_type_list_t types;
 500   size_t types_size = sizeof (types);
 501   acl_type_t type;
 502
 503   if (aclx_gettypes (name, &types, &types_size) < 0
 504       || types.num_entries == 0)
 505     return chmod_or_fchmod (name, desc, mode);
 506
 507   /* XXX Do we need to clear all types of ACLs for the given file, or is it
 508      sufficient to clear the first one?  */
 509   type = types.entries[0];
 510   if (type.u64 == ACL_AIXC)
 511     {
 512       union { struct acl a; char room[128]; } u;
 513       int ret;
 514
 515       u.a.acl_len = (char *) &u.a.acl_ext[0] - (char *) &u.a; /* no entries */
 516       u.a.acl_mode = mode & ~(S_IXACL | 0777);
 517       u.a.u_access = (mode >> 6) & 7;
 518       u.a.g_access = (mode >> 3) & 7;
 519       u.a.o_access = mode & 7;
 520
 521       if (desc != -1)
 522         ret = aclx_fput (desc, SET_ACL | SET_MODE_S_BITS,
 523                          type, &u.a, u.a.acl_len, mode);
 524       else
 525         ret = aclx_put (name, SET_ACL | SET_MODE_S_BITS,
 526                         type, &u.a, u.a.acl_len, mode);
 527       if (!(ret < 0 && errno == ENOSYS))
 528         return ret;
 529     }
 530   else if (type.u64 == ACL_NFS4)
 531     {
 532       union { nfs4_acl_int_t a; char room[128]; } u;
 533       nfs4_ace_int_t *ace;
 534       int ret;
 535
 536       u.a.aclVersion = NFS4_ACL_INT_STRUCT_VERSION;
 537       u.a.aclEntryN = 0;
 538       ace = &u.a.aclEntry[0];
 539       {
 540         ace->flags = ACE4_ID_SPECIAL;
 541         ace->aceWho.special_whoid = ACE4_WHO_OWNER;
 542         ace->aceType = ACE4_ACCESS_ALLOWED_ACE_TYPE;
 543         ace->aceFlags = 0;
 544         ace->aceMask =
 545           (mode & 0400 ? ACE4_READ_DATA | ACE4_LIST_DIRECTORY : 0)
 546           | (mode & 0200
 547              ? ACE4_WRITE_DATA | ACE4_ADD_FILE | ACE4_APPEND_DATA
 548                | ACE4_ADD_SUBDIRECTORY
 549              : 0)
 550           | (mode & 0100 ? ACE4_EXECUTE : 0);
 551         ace->aceWhoString[0] = '\0';
 552         ace->entryLen = (char *) &ace->aceWhoString[4] - (char *) ace;
 553         ace = (nfs4_ace_int_t *) (char *) &ace->aceWhoString[4];
 554         u.a.aclEntryN++;
 555       }
 556       {
 557         ace->flags = ACE4_ID_SPECIAL;
 558         ace->aceWho.special_whoid = ACE4_WHO_GROUP;
 559         ace->aceType = ACE4_ACCESS_ALLOWED_ACE_TYPE;
 560         ace->aceFlags = 0;
 561         ace->aceMask =
 562           (mode & 0040 ? ACE4_READ_DATA | ACE4_LIST_DIRECTORY : 0)
 563           | (mode & 0020
 564              ? ACE4_WRITE_DATA | ACE4_ADD_FILE | ACE4_APPEND_DATA
 565                | ACE4_ADD_SUBDIRECTORY
 566              : 0)
 567           | (mode & 0010 ? ACE4_EXECUTE : 0);
 568         ace->aceWhoString[0] = '\0';
 569         ace->entryLen = (char *) &ace->aceWhoString[4] - (char *) ace;
 570         ace = (nfs4_ace_int_t *) (char *) &ace->aceWhoString[4];
 571         u.a.aclEntryN++;
 572       }
 573       {
 574         ace->flags = ACE4_ID_SPECIAL;
 575         ace->aceWho.special_whoid = ACE4_WHO_EVERYONE;
 576         ace->aceType = ACE4_ACCESS_ALLOWED_ACE_TYPE;
 577         ace->aceFlags = 0;
 578         ace->aceMask =
 579           (mode & 0004 ? ACE4_READ_DATA | ACE4_LIST_DIRECTORY : 0)
 580           | (mode & 0002
 581              ? ACE4_WRITE_DATA | ACE4_ADD_FILE | ACE4_APPEND_DATA
 582                | ACE4_ADD_SUBDIRECTORY
 583              : 0)
 584           | (mode & 0001 ? ACE4_EXECUTE : 0);
 585         ace->aceWhoString[0] = '\0';
 586         ace->entryLen = (char *) &ace->aceWhoString[4] - (char *) ace;
 587         ace = (nfs4_ace_int_t *) (char *) &ace->aceWhoString[4];
 588         u.a.aclEntryN++;
 589       }
 590       u.a.aclLength = (char *) ace - (char *) &u.a;
 591
 592       if (desc != -1)
 593         ret = aclx_fput (desc, SET_ACL | SET_MODE_S_BITS,
 594                          type, &u.a, u.a.aclLength, mode);
 595       else
 596         ret = aclx_put (name, SET_ACL | SET_MODE_S_BITS,
 597                         type, &u.a, u.a.aclLength, mode);
 598       if (!(ret < 0 && errno == ENOSYS))
 599         return ret;
 600     }
 601
 602   return chmod_or_fchmod (name, desc, mode);
 603
 604 # elif HAVE_STATACL /* older AIX */
 605
 606   union { struct acl a; char room[128]; } u;
 607   int ret;
 608
 609   u.a.acl_len = (char *) &u.a.acl_ext[0] - (char *) &u.a; /* no entries */
 610   u.a.acl_mode = mode & ~(S_IXACL | 0777);
 611   u.a.u_access = (mode >> 6) & 7;
 612   u.a.g_access = (mode >> 3) & 7;
 613   u.a.o_access = mode & 7;
 614
 615   if (desc != -1)
 616     ret = fchacl (desc, &u.a, u.a.acl_len);
 617   else
 618     ret = chacl (name, &u.a, u.a.acl_len);
 619
 620   if (ret < 0 && errno == ENOSYS)
 621     return chmod_or_fchmod (name, desc, mode);
 622
 623   return ret;
 624
 625 # elif HAVE_ACLSORT /* NonStop Kernel */
 626
 627   struct acl entries[4];
 628   int ret;
 629
 630   entries[0].a_type = USER_OBJ;
 631   entries[0].a_id = 0; /* irrelevant */
 632   entries[0].a_perm = (mode >> 6) & 7;
 633   entries[1].a_type = GROUP_OBJ;
 634   entries[1].a_id = 0; /* irrelevant */
 635   entries[1].a_perm = (mode >> 3) & 7;
 636   entries[2].a_type = CLASS_OBJ;
 637   entries[2].a_id = 0;
 638   entries[2].a_perm = (mode >> 3) & 7;
 639   entries[3].a_type = OTHER_OBJ;
 640   entries[3].a_id = 0;
 641   entries[3].a_perm = mode & 7;
 642
 643   ret = aclsort (sizeof (entries) / sizeof (struct acl), 1, entries);
 644   if (ret > 0)
 645     abort ();
 646   if (ret < 0)
 647     {
 648       if (0)
 649         return chmod_or_fchmod (name, desc, mode);
 650       return -1;
 651     }
 652
 653   ret = acl ((char *) name, ACL_SET,
 654              sizeof (entries) / sizeof (struct acl), entries);
 655   if (ret < 0)
 656     {
 657       if (0)
 658         return chmod_or_fchmod (name, desc, mode);
 659       return -1;
 660     }
 661
 662   if (mode & (S_ISUID | S_ISGID | S_ISVTX))
 663     {
 664       /* We did not call chmod so far, so the special bits have not yet
 665          been set.  */
 666       return chmod_or_fchmod (name, desc, mode);
 667     }
 668   return 0;
 669
 670 # else /* Unknown flavor of ACLs */
 671   return chmod_or_fchmod (name, desc, mode);
 672 # endif
 673 #else /* !USE_ACL */
 674   return chmod_or_fchmod (name, desc, mode);
 675 #endif
 676 }