1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */ 28*0Sstevel@tonic-gate /* All Rights Reserved */ 29*0Sstevel@tonic-gate 30*0Sstevel@tonic-gate /* 31*0Sstevel@tonic-gate * Portions of this source code were derived from Berkeley 4.3 BSD 32*0Sstevel@tonic-gate * under license from the Regents of the University of California. 33*0Sstevel@tonic-gate */ 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate /* 38*0Sstevel@tonic-gate * Use of this object by a utility (so far chmod, mkdir and mkfifo use 39*0Sstevel@tonic-gate * it) requires that the utility implement an error-processing routine 40*0Sstevel@tonic-gate * named errmsg(), with a prototype as specified below. 41*0Sstevel@tonic-gate * 42*0Sstevel@tonic-gate * This is necessary because the mode-parsing code here makes use of such 43*0Sstevel@tonic-gate * a routine, located in chmod.c. The error-reporting style of the 44*0Sstevel@tonic-gate * utilities sharing this code differs enough that it is difficult to 45*0Sstevel@tonic-gate * implement a common version of this routine to be used by all. 46*0Sstevel@tonic-gate */ 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gate /* 49*0Sstevel@tonic-gate * Note that many convolutions are necessary 50*0Sstevel@tonic-gate * due to the re-use of bits between locking 51*0Sstevel@tonic-gate * and setgid 52*0Sstevel@tonic-gate */ 53*0Sstevel@tonic-gate 54*0Sstevel@tonic-gate #include <ctype.h> 55*0Sstevel@tonic-gate #include <stdio.h> 56*0Sstevel@tonic-gate #include <sys/types.h> 57*0Sstevel@tonic-gate #include <sys/stat.h> 58*0Sstevel@tonic-gate #include <dirent.h> 59*0Sstevel@tonic-gate #include <locale.h> 60*0Sstevel@tonic-gate #include <string.h> /* strerror() */ 61*0Sstevel@tonic-gate #include <stdarg.h> 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate #define USER 05700 /* user's bits */ 64*0Sstevel@tonic-gate #define GROUP 02070 /* group's bits */ 65*0Sstevel@tonic-gate #define OTHER 00007 /* other's bits */ 66*0Sstevel@tonic-gate #define ALL 07777 /* all */ 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate #define READ 00444 /* read permit */ 69*0Sstevel@tonic-gate #define WRITE 00222 /* write permit */ 70*0Sstevel@tonic-gate #define EXEC 00111 /* exec permit */ 71*0Sstevel@tonic-gate #define SETID 06000 /* set[ug]id */ 72*0Sstevel@tonic-gate #define LOCK 02000 /* lock permit */ 73*0Sstevel@tonic-gate #define STICKY 01000 /* sticky bit */ 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate #define GROUP_RWX (GROUP & (READ | WRITE | EXEC)) 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate #define WHO_EMPTY 0 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate static char *msp; 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate extern void 82*0Sstevel@tonic-gate errmsg(int severity, int code, char *format, ...); 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate static int 85*0Sstevel@tonic-gate what(void); 86*0Sstevel@tonic-gate 87*0Sstevel@tonic-gate static mode_t 88*0Sstevel@tonic-gate abs(mode_t mode, o_mode_t *group_clear_bits, o_mode_t *group_set_bits), 89*0Sstevel@tonic-gate who(void); 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate mode_t 92*0Sstevel@tonic-gate newmode_common(char *ms, mode_t new_mode, mode_t umsk, char *file, char *path, 93*0Sstevel@tonic-gate o_mode_t *group_clear_bits, o_mode_t *group_set_bits); 94*0Sstevel@tonic-gate 95*0Sstevel@tonic-gate /* 96*0Sstevel@tonic-gate * Wrapper for newmode_common. This function is called by mkdir and 97*0Sstevel@tonic-gate * mkfifo. 98*0Sstevel@tonic-gate */ 99*0Sstevel@tonic-gate mode_t 100*0Sstevel@tonic-gate newmode(char *ms, mode_t new_mode, mode_t umsk, char *file, char *path) 101*0Sstevel@tonic-gate { 102*0Sstevel@tonic-gate o_mode_t tmp1, tmp2; 103*0Sstevel@tonic-gate 104*0Sstevel@tonic-gate return (newmode_common(ms, new_mode, umsk, file, path, &tmp1, &tmp2)); 105*0Sstevel@tonic-gate } 106*0Sstevel@tonic-gate 107*0Sstevel@tonic-gate /* 108*0Sstevel@tonic-gate * We are parsing a comma-separated list of mode expressions of the form: 109*0Sstevel@tonic-gate * 110*0Sstevel@tonic-gate * [<who>] <op> [<perms>] 111*0Sstevel@tonic-gate */ 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate /* ARGSUSED */ 114*0Sstevel@tonic-gate mode_t 115*0Sstevel@tonic-gate newmode_common(char *ms, mode_t new_mode, mode_t umsk, char *file, char *path, 116*0Sstevel@tonic-gate o_mode_t *group_clear_bits, o_mode_t *group_set_bits) 117*0Sstevel@tonic-gate { 118*0Sstevel@tonic-gate /* 119*0Sstevel@tonic-gate * new_mode contains the mode value constructed by parsing the 120*0Sstevel@tonic-gate * expression pointed to by ms 121*0Sstevel@tonic-gate * old_mode contains the mode provided by the caller 122*0Sstevel@tonic-gate * oper contains +|-|= information 123*0Sstevel@tonic-gate * perms_msk contains rwx(slt) information 124*0Sstevel@tonic-gate * umsk contains the umask value to be assumed. 125*0Sstevel@tonic-gate * who_empty is non-zero if the <who> clause did not appear. 126*0Sstevel@tonic-gate * who_msk contains USER|GROUP|OTHER information 127*0Sstevel@tonic-gate */ 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate int oper; /* <op> */ 130*0Sstevel@tonic-gate int lcheck; 131*0Sstevel@tonic-gate int scheck; 132*0Sstevel@tonic-gate int xcheck; 133*0Sstevel@tonic-gate int goon; 134*0Sstevel@tonic-gate 135*0Sstevel@tonic-gate int operand_empty = 0; 136*0Sstevel@tonic-gate int who_empty; 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate mode_t who_msk; 139*0Sstevel@tonic-gate mode_t perms_msk; 140*0Sstevel@tonic-gate mode_t old_mode = new_mode; /* save original mode */ 141*0Sstevel@tonic-gate mode_t grp_change; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate msp = ms; 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate *group_clear_bits = 0; 146*0Sstevel@tonic-gate *group_set_bits = 0; 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate if (isdigit(*msp)) 149*0Sstevel@tonic-gate return (abs(old_mode, group_clear_bits, group_set_bits)); 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate do { 152*0Sstevel@tonic-gate /* 153*0Sstevel@tonic-gate * When <who> is empty, and <oper> == `=`, the umask is 154*0Sstevel@tonic-gate * obeyed. So we need to make note of it here, for use 155*0Sstevel@tonic-gate * later. 156*0Sstevel@tonic-gate */ 157*0Sstevel@tonic-gate 158*0Sstevel@tonic-gate if ((who_msk = who()) == WHO_EMPTY) { 159*0Sstevel@tonic-gate who_empty = 1; 160*0Sstevel@tonic-gate who_msk = ALL; 161*0Sstevel@tonic-gate } else { 162*0Sstevel@tonic-gate who_empty = 0; 163*0Sstevel@tonic-gate } 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate while (oper = what()) { 166*0Sstevel@tonic-gate /* 167*0Sstevel@tonic-gate * this section processes permissions 168*0Sstevel@tonic-gate */ 169*0Sstevel@tonic-gate 170*0Sstevel@tonic-gate operand_empty++; 171*0Sstevel@tonic-gate perms_msk = 0; 172*0Sstevel@tonic-gate goon = 0; 173*0Sstevel@tonic-gate lcheck = scheck = xcheck = 0; 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate switch (*msp) { 176*0Sstevel@tonic-gate case 'u': 177*0Sstevel@tonic-gate perms_msk = (new_mode & USER) >> 6; 178*0Sstevel@tonic-gate goto dup; 179*0Sstevel@tonic-gate case 'g': 180*0Sstevel@tonic-gate perms_msk = (new_mode & GROUP) >> 3; 181*0Sstevel@tonic-gate goto dup; 182*0Sstevel@tonic-gate case 'o': 183*0Sstevel@tonic-gate perms_msk = (new_mode & OTHER); 184*0Sstevel@tonic-gate dup: 185*0Sstevel@tonic-gate perms_msk &= (READ|WRITE|EXEC); 186*0Sstevel@tonic-gate perms_msk |= (perms_msk << 3) | 187*0Sstevel@tonic-gate (perms_msk << 6); 188*0Sstevel@tonic-gate msp++; 189*0Sstevel@tonic-gate goon = 1; 190*0Sstevel@tonic-gate } 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate while (goon == 0) { 193*0Sstevel@tonic-gate switch (*msp++) { 194*0Sstevel@tonic-gate case 'r': 195*0Sstevel@tonic-gate perms_msk |= READ; 196*0Sstevel@tonic-gate continue; 197*0Sstevel@tonic-gate case 'w': 198*0Sstevel@tonic-gate perms_msk |= WRITE; 199*0Sstevel@tonic-gate continue; 200*0Sstevel@tonic-gate case 'x': 201*0Sstevel@tonic-gate perms_msk |= EXEC; 202*0Sstevel@tonic-gate xcheck = 1; 203*0Sstevel@tonic-gate continue; 204*0Sstevel@tonic-gate case 'X': 205*0Sstevel@tonic-gate if (((old_mode & S_IFMT) == S_IFDIR) || 206*0Sstevel@tonic-gate (old_mode & EXEC)) { 207*0Sstevel@tonic-gate perms_msk |= EXEC; 208*0Sstevel@tonic-gate xcheck = 1; 209*0Sstevel@tonic-gate } 210*0Sstevel@tonic-gate continue; 211*0Sstevel@tonic-gate case 'l': 212*0Sstevel@tonic-gate perms_msk |= LOCK; 213*0Sstevel@tonic-gate who_msk |= LOCK; 214*0Sstevel@tonic-gate lcheck = 1; 215*0Sstevel@tonic-gate continue; 216*0Sstevel@tonic-gate case 's': 217*0Sstevel@tonic-gate perms_msk |= SETID; 218*0Sstevel@tonic-gate scheck = 1; 219*0Sstevel@tonic-gate continue; 220*0Sstevel@tonic-gate case 't': 221*0Sstevel@tonic-gate perms_msk |= STICKY; 222*0Sstevel@tonic-gate continue; 223*0Sstevel@tonic-gate default: 224*0Sstevel@tonic-gate msp--; 225*0Sstevel@tonic-gate goon = 1; 226*0Sstevel@tonic-gate } 227*0Sstevel@tonic-gate } 228*0Sstevel@tonic-gate 229*0Sstevel@tonic-gate perms_msk &= who_msk; 230*0Sstevel@tonic-gate 231*0Sstevel@tonic-gate switch (oper) { 232*0Sstevel@tonic-gate case '+': 233*0Sstevel@tonic-gate if (who_empty) { 234*0Sstevel@tonic-gate perms_msk &= ~umsk; 235*0Sstevel@tonic-gate } 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate /* is group execution requested? */ 239*0Sstevel@tonic-gate if (xcheck == 1 && 240*0Sstevel@tonic-gate (perms_msk & GROUP & EXEC) == 241*0Sstevel@tonic-gate (GROUP & EXEC)) { 242*0Sstevel@tonic-gate /* not locking, too! */ 243*0Sstevel@tonic-gate if (lcheck == 1 && !S_ISDIR(new_mode)) { 244*0Sstevel@tonic-gate errmsg(1, 3, 245*0Sstevel@tonic-gate gettext("Group execution " 246*0Sstevel@tonic-gate "and locking not permitted " 247*0Sstevel@tonic-gate "together\n")); 248*0Sstevel@tonic-gate } 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate /* 251*0Sstevel@tonic-gate * not if the file is already 252*0Sstevel@tonic-gate * lockable. 253*0Sstevel@tonic-gate */ 254*0Sstevel@tonic-gate if (((new_mode & GROUP & 255*0Sstevel@tonic-gate (LOCK | EXEC)) == LOCK) && 256*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 257*0Sstevel@tonic-gate errmsg(2, 0, 258*0Sstevel@tonic-gate gettext("%s: Group " 259*0Sstevel@tonic-gate "execution not permitted " 260*0Sstevel@tonic-gate "on a lockable file\n"), 261*0Sstevel@tonic-gate path); 262*0Sstevel@tonic-gate return (old_mode); 263*0Sstevel@tonic-gate } 264*0Sstevel@tonic-gate } 265*0Sstevel@tonic-gate 266*0Sstevel@tonic-gate /* is setgid on execution requested? */ 267*0Sstevel@tonic-gate if (scheck == 1 && (perms_msk & GROUP & SETID) 268*0Sstevel@tonic-gate == (GROUP & SETID)) { 269*0Sstevel@tonic-gate /* not locking, too! */ 270*0Sstevel@tonic-gate if (lcheck == 1 && 271*0Sstevel@tonic-gate ((perms_msk & GROUP & EXEC) == 272*0Sstevel@tonic-gate (GROUP & EXEC)) && 273*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 274*0Sstevel@tonic-gate errmsg(1, 4, 275*0Sstevel@tonic-gate gettext("Set-group-ID and " 276*0Sstevel@tonic-gate "locking not permitted " 277*0Sstevel@tonic-gate "together\n")); 278*0Sstevel@tonic-gate } 279*0Sstevel@tonic-gate 280*0Sstevel@tonic-gate /* 281*0Sstevel@tonic-gate * not if the file is already 282*0Sstevel@tonic-gate * lockable 283*0Sstevel@tonic-gate */ 284*0Sstevel@tonic-gate 285*0Sstevel@tonic-gate if (((new_mode & GROUP & 286*0Sstevel@tonic-gate (LOCK | EXEC)) == LOCK) && 287*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 288*0Sstevel@tonic-gate errmsg(2, 0, 289*0Sstevel@tonic-gate gettext("%s: Set-group-ID " 290*0Sstevel@tonic-gate "not permitted on a " 291*0Sstevel@tonic-gate "lockable file\n"), path); 292*0Sstevel@tonic-gate return (old_mode); 293*0Sstevel@tonic-gate } 294*0Sstevel@tonic-gate } 295*0Sstevel@tonic-gate 296*0Sstevel@tonic-gate /* is setid on execution requested? */ 297*0Sstevel@tonic-gate if ((scheck == 1) && 298*0Sstevel@tonic-gate ((new_mode & S_IFMT) != S_IFDIR)) { 299*0Sstevel@tonic-gate /* 300*0Sstevel@tonic-gate * the corresponding execution must 301*0Sstevel@tonic-gate * be requested or already set 302*0Sstevel@tonic-gate */ 303*0Sstevel@tonic-gate if (((new_mode | perms_msk) & 304*0Sstevel@tonic-gate who_msk & EXEC & (USER | GROUP)) != 305*0Sstevel@tonic-gate (who_msk & EXEC & (USER | GROUP))) { 306*0Sstevel@tonic-gate errmsg(2, 0, 307*0Sstevel@tonic-gate gettext("%s: Execute " 308*0Sstevel@tonic-gate "permission required " 309*0Sstevel@tonic-gate "for set-ID on " 310*0Sstevel@tonic-gate "execution \n"), 311*0Sstevel@tonic-gate path); 312*0Sstevel@tonic-gate return (old_mode); 313*0Sstevel@tonic-gate } 314*0Sstevel@tonic-gate } 315*0Sstevel@tonic-gate 316*0Sstevel@tonic-gate /* is locking requested? */ 317*0Sstevel@tonic-gate if (lcheck == 1) { 318*0Sstevel@tonic-gate /* 319*0Sstevel@tonic-gate * not if the file has group execution 320*0Sstevel@tonic-gate * set. 321*0Sstevel@tonic-gate * NOTE: this also covers files with 322*0Sstevel@tonic-gate * setgid 323*0Sstevel@tonic-gate */ 324*0Sstevel@tonic-gate if ((new_mode & GROUP & EXEC) == 325*0Sstevel@tonic-gate (GROUP & EXEC) && 326*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 327*0Sstevel@tonic-gate errmsg(2, 0, 328*0Sstevel@tonic-gate gettext("%s: Locking not " 329*0Sstevel@tonic-gate "permitted on " 330*0Sstevel@tonic-gate "a group executable " 331*0Sstevel@tonic-gate "file\n"), 332*0Sstevel@tonic-gate path); 333*0Sstevel@tonic-gate return (old_mode); 334*0Sstevel@tonic-gate } 335*0Sstevel@tonic-gate } 336*0Sstevel@tonic-gate 337*0Sstevel@tonic-gate if ((grp_change = (perms_msk & GROUP_RWX) >> 3) 338*0Sstevel@tonic-gate != 0) { 339*0Sstevel@tonic-gate *group_clear_bits &= ~grp_change; 340*0Sstevel@tonic-gate *group_set_bits |= grp_change; 341*0Sstevel@tonic-gate } 342*0Sstevel@tonic-gate 343*0Sstevel@tonic-gate /* create new mode */ 344*0Sstevel@tonic-gate new_mode |= perms_msk; 345*0Sstevel@tonic-gate break; 346*0Sstevel@tonic-gate 347*0Sstevel@tonic-gate case '-': 348*0Sstevel@tonic-gate if (who_empty) { 349*0Sstevel@tonic-gate perms_msk &= ~umsk; 350*0Sstevel@tonic-gate } 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate /* don't turn off locking, unless it's on */ 353*0Sstevel@tonic-gate if (lcheck == 1 && scheck == 0 && 354*0Sstevel@tonic-gate (new_mode & GROUP & (LOCK | EXEC)) != 355*0Sstevel@tonic-gate LOCK) { 356*0Sstevel@tonic-gate perms_msk &= ~LOCK; 357*0Sstevel@tonic-gate } 358*0Sstevel@tonic-gate 359*0Sstevel@tonic-gate /* don't turn off setgid, unless it's on */ 360*0Sstevel@tonic-gate if (scheck == 1 && 361*0Sstevel@tonic-gate ((new_mode & S_IFMT) != S_IFDIR) && 362*0Sstevel@tonic-gate lcheck == 0 && 363*0Sstevel@tonic-gate (new_mode & GROUP & (LOCK | EXEC)) == 364*0Sstevel@tonic-gate LOCK) { 365*0Sstevel@tonic-gate perms_msk &= ~(GROUP & SETID); 366*0Sstevel@tonic-gate } 367*0Sstevel@tonic-gate 368*0Sstevel@tonic-gate /* 369*0Sstevel@tonic-gate * if execution is being turned off and the 370*0Sstevel@tonic-gate * corresponding setid is not, turn setid off, 371*0Sstevel@tonic-gate * too & warn the user 372*0Sstevel@tonic-gate */ 373*0Sstevel@tonic-gate if (xcheck == 1 && scheck == 0 && 374*0Sstevel@tonic-gate ((who_msk & GROUP) == GROUP || 375*0Sstevel@tonic-gate (who_msk & USER) == USER) && 376*0Sstevel@tonic-gate (new_mode & who_msk & (SETID | EXEC)) == 377*0Sstevel@tonic-gate (who_msk & (SETID | EXEC)) && 378*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 379*0Sstevel@tonic-gate errmsg(2, 0, 380*0Sstevel@tonic-gate gettext("%s: Corresponding set-ID " 381*0Sstevel@tonic-gate "also disabled on file since " 382*0Sstevel@tonic-gate "set-ID requires execute " 383*0Sstevel@tonic-gate "permission\n"), 384*0Sstevel@tonic-gate path); 385*0Sstevel@tonic-gate 386*0Sstevel@tonic-gate if ((perms_msk & USER & SETID) != 387*0Sstevel@tonic-gate (USER & SETID) && (new_mode & 388*0Sstevel@tonic-gate USER & (SETID | EXEC)) == 389*0Sstevel@tonic-gate (who_msk & USER & 390*0Sstevel@tonic-gate (SETID | EXEC))) { 391*0Sstevel@tonic-gate perms_msk |= USER & SETID; 392*0Sstevel@tonic-gate } 393*0Sstevel@tonic-gate if ((perms_msk & GROUP & SETID) != 394*0Sstevel@tonic-gate (GROUP & SETID) && 395*0Sstevel@tonic-gate (new_mode & GROUP & 396*0Sstevel@tonic-gate (SETID | EXEC)) == 397*0Sstevel@tonic-gate (who_msk & GROUP & 398*0Sstevel@tonic-gate (SETID | EXEC))) { 399*0Sstevel@tonic-gate perms_msk |= GROUP & SETID; 400*0Sstevel@tonic-gate } 401*0Sstevel@tonic-gate } 402*0Sstevel@tonic-gate 403*0Sstevel@tonic-gate if ((grp_change = (perms_msk & GROUP_RWX) >> 3) 404*0Sstevel@tonic-gate != 0) { 405*0Sstevel@tonic-gate *group_clear_bits |= grp_change; 406*0Sstevel@tonic-gate *group_set_bits &= ~grp_change; 407*0Sstevel@tonic-gate } 408*0Sstevel@tonic-gate 409*0Sstevel@tonic-gate /* create new mode */ 410*0Sstevel@tonic-gate new_mode &= ~perms_msk; 411*0Sstevel@tonic-gate break; 412*0Sstevel@tonic-gate 413*0Sstevel@tonic-gate case '=': 414*0Sstevel@tonic-gate if (who_empty) { 415*0Sstevel@tonic-gate perms_msk &= ~umsk; 416*0Sstevel@tonic-gate } 417*0Sstevel@tonic-gate /* is locking requested? */ 418*0Sstevel@tonic-gate if (lcheck == 1) { 419*0Sstevel@tonic-gate /* not group execution, too! */ 420*0Sstevel@tonic-gate if ((perms_msk & GROUP & EXEC) == 421*0Sstevel@tonic-gate (GROUP & EXEC) && 422*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 423*0Sstevel@tonic-gate errmsg(1, 3, 424*0Sstevel@tonic-gate gettext("Group execution " 425*0Sstevel@tonic-gate "and locking not " 426*0Sstevel@tonic-gate "permitted together\n")); 427*0Sstevel@tonic-gate } 428*0Sstevel@tonic-gate 429*0Sstevel@tonic-gate /* 430*0Sstevel@tonic-gate * if the file has group execution set, 431*0Sstevel@tonic-gate * turn it off! 432*0Sstevel@tonic-gate */ 433*0Sstevel@tonic-gate if ((who_msk & GROUP) != GROUP) { 434*0Sstevel@tonic-gate new_mode &= ~(GROUP & EXEC); 435*0Sstevel@tonic-gate } 436*0Sstevel@tonic-gate } 437*0Sstevel@tonic-gate 438*0Sstevel@tonic-gate /* 439*0Sstevel@tonic-gate * is setid on execution requested? the 440*0Sstevel@tonic-gate * corresponding execution must be requested, 441*0Sstevel@tonic-gate * too! 442*0Sstevel@tonic-gate */ 443*0Sstevel@tonic-gate if (scheck == 1 && 444*0Sstevel@tonic-gate (perms_msk & EXEC & (USER | GROUP)) != 445*0Sstevel@tonic-gate (who_msk & EXEC & (USER | GROUP)) && 446*0Sstevel@tonic-gate !S_ISDIR(new_mode)) { 447*0Sstevel@tonic-gate errmsg(1, 2, 448*0Sstevel@tonic-gate gettext("Execute permission " 449*0Sstevel@tonic-gate "required for set-ID on " 450*0Sstevel@tonic-gate "execution\n")); 451*0Sstevel@tonic-gate } 452*0Sstevel@tonic-gate 453*0Sstevel@tonic-gate /* 454*0Sstevel@tonic-gate * The ISGID bit on directories will not be 455*0Sstevel@tonic-gate * changed when the mode argument is a string 456*0Sstevel@tonic-gate * with "=". 457*0Sstevel@tonic-gate */ 458*0Sstevel@tonic-gate if ((old_mode & S_IFMT) == S_IFDIR) 459*0Sstevel@tonic-gate perms_msk = (perms_msk & 460*0Sstevel@tonic-gate ~S_ISGID) | (old_mode & S_ISGID); 461*0Sstevel@tonic-gate 462*0Sstevel@tonic-gate /* 463*0Sstevel@tonic-gate * create new mode: 464*0Sstevel@tonic-gate * clear the who_msk bits 465*0Sstevel@tonic-gate * set the perms_mks bits (which have 466*0Sstevel@tonic-gate * been trimmed to fit the who_msk. 467*0Sstevel@tonic-gate */ 468*0Sstevel@tonic-gate 469*0Sstevel@tonic-gate if ((grp_change = (perms_msk & GROUP_RWX) >> 3) 470*0Sstevel@tonic-gate != 0) { 471*0Sstevel@tonic-gate *group_clear_bits = GROUP_RWX >> 3; 472*0Sstevel@tonic-gate *group_set_bits = grp_change; 473*0Sstevel@tonic-gate } 474*0Sstevel@tonic-gate 475*0Sstevel@tonic-gate new_mode &= ~who_msk; 476*0Sstevel@tonic-gate new_mode |= perms_msk; 477*0Sstevel@tonic-gate break; 478*0Sstevel@tonic-gate } 479*0Sstevel@tonic-gate } 480*0Sstevel@tonic-gate } while (*msp++ == ','); 481*0Sstevel@tonic-gate 482*0Sstevel@tonic-gate if (*--msp || operand_empty == 0) { 483*0Sstevel@tonic-gate errmsg(1, 5, gettext("invalid mode\n")); 484*0Sstevel@tonic-gate } 485*0Sstevel@tonic-gate 486*0Sstevel@tonic-gate return (new_mode); 487*0Sstevel@tonic-gate } 488*0Sstevel@tonic-gate 489*0Sstevel@tonic-gate mode_t 490*0Sstevel@tonic-gate abs(mode_t mode, o_mode_t *group_clear_bits, o_mode_t *group_set_bits) 491*0Sstevel@tonic-gate { 492*0Sstevel@tonic-gate int c; 493*0Sstevel@tonic-gate mode_t i; 494*0Sstevel@tonic-gate 495*0Sstevel@tonic-gate for (i = 0; (c = *msp) >= '0' && c <= '7'; msp++) 496*0Sstevel@tonic-gate i = (mode_t)((i << 3) + (c - '0')); 497*0Sstevel@tonic-gate if (*msp) 498*0Sstevel@tonic-gate errmsg(1, 6, gettext("invalid mode\n")); 499*0Sstevel@tonic-gate 500*0Sstevel@tonic-gate /* 501*0Sstevel@tonic-gate * The ISGID bit on directories will not be changed when the mode argument is 502*0Sstevel@tonic-gate * octal numeric. Only "g+s" and "g-s" arguments can change ISGID bit when 503*0Sstevel@tonic-gate * applied to directories. 504*0Sstevel@tonic-gate */ 505*0Sstevel@tonic-gate *group_clear_bits = GROUP_RWX >> 3; 506*0Sstevel@tonic-gate *group_set_bits = (i & GROUP_RWX) >> 3; 507*0Sstevel@tonic-gate if ((mode & S_IFMT) == S_IFDIR) 508*0Sstevel@tonic-gate return ((i & ~S_ISGID) | (mode & S_ISGID)); 509*0Sstevel@tonic-gate return (i); 510*0Sstevel@tonic-gate } 511*0Sstevel@tonic-gate 512*0Sstevel@tonic-gate static mode_t 513*0Sstevel@tonic-gate who(void) 514*0Sstevel@tonic-gate { 515*0Sstevel@tonic-gate mode_t m; 516*0Sstevel@tonic-gate 517*0Sstevel@tonic-gate m = WHO_EMPTY; 518*0Sstevel@tonic-gate 519*0Sstevel@tonic-gate for (; ; msp++) { 520*0Sstevel@tonic-gate switch (*msp) { 521*0Sstevel@tonic-gate case 'u': 522*0Sstevel@tonic-gate m |= USER; 523*0Sstevel@tonic-gate continue; 524*0Sstevel@tonic-gate case 'g': 525*0Sstevel@tonic-gate m |= GROUP; 526*0Sstevel@tonic-gate continue; 527*0Sstevel@tonic-gate case 'o': 528*0Sstevel@tonic-gate m |= OTHER; 529*0Sstevel@tonic-gate continue; 530*0Sstevel@tonic-gate case 'a': 531*0Sstevel@tonic-gate m |= ALL; 532*0Sstevel@tonic-gate continue; 533*0Sstevel@tonic-gate default: 534*0Sstevel@tonic-gate return (m); 535*0Sstevel@tonic-gate } 536*0Sstevel@tonic-gate } 537*0Sstevel@tonic-gate } 538*0Sstevel@tonic-gate 539*0Sstevel@tonic-gate static int 540*0Sstevel@tonic-gate what(void) 541*0Sstevel@tonic-gate { 542*0Sstevel@tonic-gate switch (*msp) { 543*0Sstevel@tonic-gate case '+': 544*0Sstevel@tonic-gate case '-': 545*0Sstevel@tonic-gate case '=': 546*0Sstevel@tonic-gate return (*msp++); 547*0Sstevel@tonic-gate } 548*0Sstevel@tonic-gate return (0); 549*0Sstevel@tonic-gate } 550