xref: /illumos-gate/usr/src/lib/libsec/common/acl.y (revision 53312454)

%{
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2022 RackTop Systems, Inc.
 */

#include <acl_common.h>
#include <aclutils.h>

extern int yyinteractive;
extern acl_t *yyacl;
%}

%union {
	char *str;
	int val;
	struct acl_perm_type acl_perm;
	ace_t ace;
	aclent_t aclent;
	acl_t *acl;
}

%token BARE_SID_TOK
%token USER_TOK USER_SID_TOK GROUP_TOK GROUP_SID_TOK MASK_TOK OTHER_TOK
%token OWNERAT_TOK GROUPAT_TOK EVERYONEAT_TOK DEFAULT_USER_TOK
%token DEFAULT_GROUP_TOK DEFAULT_MASK_TOK DEFAULT_OTHER_TOK
%token COLON COMMA NL SLASH
%token <str> ID IDNAME PERM_TOK INHERIT_TOK SID
%token <val> ERROR ACE_PERM ACE_INHERIT ENTRY_TYPE ACCESS_TYPE

%type <str> idname id
%type <acl_perm> perms perm aclent_perm ace_perms
%type <acl> acl_entry
%type <ace> ace
%type <aclent> aclent
%type <val> iflags verbose_iflag compact_iflag access_type entry_type

%left ERROR COLON

%%

acl:	acl_entry NL
	{
		yyacl = $1;
		return (0);
	}

	/* This seems illegal, but the old aclfromtext() allows it */
	| acl_entry COMMA NL
	{
		yyacl = $1;
		return (0);
	}
	| acl_entry COMMA acl
	{
		yyacl = $1;
		return (0);
	}

acl_entry: ace
	{
		ace_t *acep;

		if (yyacl == NULL) {
			yyacl = acl_alloc(ACE_T);
			if (yyacl == NULL) {
				yycleanup();
				return (EACL_MEM_ERROR);
			}
		}

		$$ = yyacl;
		if ($$->acl_type == ACLENT_T) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Cannot have POSIX draft ACL entries"
			    " with NFSv4/ZFS ACL entries.\n"));
			acl_free(yyacl);
			yyacl = NULL;
			yycleanup();
			return (EACL_DIFF_TYPE);
		}

		$$->acl_aclp = realloc($$->acl_aclp,
		    ($$->acl_entry_size * ($$->acl_cnt + 1)));
		if ($$->acl_aclp == NULL) {
			free (yyacl);
			yycleanup();
			return (EACL_MEM_ERROR);
		}
		acep = $$->acl_aclp;
		acep[$$->acl_cnt] = $1;
		$$->acl_cnt++;
		yycleanup();
	}
	| aclent
	{
		aclent_t *aclent;

		if (yyacl == NULL) {
			yyacl = acl_alloc(ACLENT_T);
			if (yyacl == NULL) {
				yycleanup();
				return (EACL_MEM_ERROR);
			}
		}

		$$ = yyacl;
		if ($$->acl_type == ACE_T) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Cannot have NFSv4/ZFS ACL entries"
			    " with POSIX draft ACL entries.\n"));
			acl_free(yyacl);
			yyacl = NULL;
			yycleanup();
			return (EACL_DIFF_TYPE);
		}

		$$->acl_aclp = realloc($$->acl_aclp,
		    ($$->acl_entry_size  * ($$->acl_cnt +1)));
		if ($$->acl_aclp == NULL) {
			free (yyacl);
			yycleanup();
			return (EACL_MEM_ERROR);
		}
		aclent = $$->acl_aclp;
		aclent[$$->acl_cnt] = $1;
		$$->acl_cnt++;
		yycleanup();
	}

ace:	entry_type idname ace_perms access_type
	{
		int error;
		uid_t id;
		int mask;

		error = get_id($1, $2, &id);
		if (error) {
			bad_entry_type($1, $2);
			yycleanup();
			return (EACL_INVALID_USER_GROUP);
		}

		$$.a_who = id;
		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$3, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}
		$$.a_type = $4;

	}
	| entry_type idname ace_perms access_type COLON id
	{
		int error;
		uid_t id;

		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of "
			    "ACL specification.\n"));
			yycleanup();
			return (EACL_UNKNOWN_DATA);
		}
		error = get_id($1, $2, &id);
		if (error) {
			$$.a_who = get_id_nofail($1, $6);
		} else {
			$$.a_who = id;
		}
		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$3, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}
		$$.a_type = $4;
	}
	| entry_type idname ace_perms iflags access_type
	{
		int error;
		uid_t id;

		error = get_id($1, $2, &id);
		if (error) {
			bad_entry_type($1, $2);
			yycleanup();
			return (EACL_INVALID_USER_GROUP);
		}

		$$.a_who = id;
		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$3, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}
		$$.a_type = $5;
		$$.a_flags |= $4;
	}
	| entry_type idname ace_perms iflags access_type COLON id
	{
		int error;
		uid_t  id;

		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of "
			    "ACL specification.\n"));
			yycleanup();
			return (EACL_UNKNOWN_DATA);
		}
		error = get_id($1, $2, &id);
		if (error) {
			$$.a_who = get_id_nofail($1, $7);
		} else {
			$$.a_who = id;
		}

		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$3, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}

		$$.a_type = $5;
		$$.a_flags |= $4;
	}
	| entry_type ace_perms access_type
	{
		int error;

		$$.a_who = -1;
		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$2, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}
		$$.a_type = $3;
	}
	| entry_type ace_perms access_type COLON id
	{
		yycleanup();
		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of "
			    "ACL specification.\n"));
			return (EACL_UNKNOWN_DATA);
		}

		return (EACL_ENTRY_ERROR);
	}
	| entry_type ace_perms iflags access_type
	{
		int error;

		$$.a_who = -1;
		$$.a_flags = ace_entry_type($1);
		error = ace_perm_mask(&$2, &$$.a_access_mask);
		if (error) {
			yycleanup();
			return (error);
		}
		$$.a_type = $4;
		$$.a_flags |= $3;

	}
	| entry_type ace_perms iflags access_type COLON id
	{
		yycleanup();
		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of "
			    "ACL specification.\n"));
			return (EACL_UNKNOWN_DATA);
		}
		return (EACL_ENTRY_ERROR);
	}

aclent: entry_type idname aclent_perm	/* user or group */
	{
		int error;
		uid_t id;

		error = get_id($1, $2, &id);
		if (error) {
			bad_entry_type($1, $2);
			yycleanup();
			return (EACL_INVALID_USER_GROUP);
		}

		error = compute_aclent_perms($3.perm_str, &$$.a_perm);
		if (error) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Invalid permission(s) '%s' specified.\n"),
			    $3.perm_str);
			yycleanup();
			return (error);
		}
		$$.a_id = id;
		error = aclent_entry_type($1, 0, &$$.a_type);
		if (error) {
			acl_error(
			    dgettext(TEXT_DOMAIN,
			    "Invalid ACL entry type '%s' specified.\n"), $1);
			yycleanup();
			return (error);
		}
	}
	| entry_type COLON aclent_perm		/* owner group other */
	{
		int error;

		error = compute_aclent_perms($3.perm_str, &$$.a_perm);
		if (error) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Invalid permission(s) '%s' specified.\n"),
			    $3.perm_str);
			yycleanup();
			return (error);
		}
		$$.a_id = -1;
		error = aclent_entry_type($1, 1, &$$.a_type);
		if (error) {
			acl_error(
			    dgettext(TEXT_DOMAIN,
			    "Invalid ACL entry type '%s' specified.\n"), $1);
			yycleanup();
			return (error);
		}
	}
	| entry_type COLON aclent_perm COLON id
	{
		yycleanup();
		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of ACL specification.\n"));
			return (EACL_UNKNOWN_DATA);
		}
		return (EACL_ENTRY_ERROR);
	}
	| entry_type idname aclent_perm COLON id	/* user or group */
	{
		int error;
		uid_t id;

		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of ACL specification.\n"));
			yycleanup();
			return (EACL_UNKNOWN_DATA);
		}
		error = compute_aclent_perms($3.perm_str, &$$.a_perm);
		if (error) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Invalid permission(s) '%s' specified.\n"),
			    $3.perm_str);
			yycleanup();
			return (error);
		}
		error = get_id($1, $2, &id);
		if (error) {
			$$.a_id = get_id_nofail($1, $5);
		} else
			$$.a_id = id;

		error = aclent_entry_type($1, 0, &$$.a_type);
		if (error) {
			acl_error(
			    dgettext(TEXT_DOMAIN,
			    "Invalid ACL entry type '%s' specified.\n"), $1);
			yycleanup();
			return (error);
		}
	}
	| entry_type aclent_perm  /* mask entry */
	{
		int error;

		error = compute_aclent_perms($2.perm_str, &$$.a_perm);
		if (error) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Invalid permission(s) '%s' specified.\n"),
			    $2.perm_str);
			yycleanup();
			return (error);
		}
		$$.a_id = -1;
		error = aclent_entry_type($1, 0, &$$.a_type);
		if (error) {
			acl_error(
			    dgettext(TEXT_DOMAIN,
			    "Invalid ACL entry type specified %d.\n"),
			    error);
			yycleanup();
			return (error);
		}
	}
	| entry_type aclent_perm COLON id
	{
		yycleanup();
		if (yyinteractive) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Extra fields on the end of ACL specification.\n"));
			return (EACL_UNKNOWN_DATA);
		}
		return (EACL_ENTRY_ERROR);
	}

iflags: compact_iflag COLON {$$ = $1;}
	| verbose_iflag COLON {$$ = $1;}
	| COLON {$$ = 0;}

compact_iflag : INHERIT_TOK
	{
		int error;
		uint32_t iflags;

		error = compute_ace_inherit($1, &iflags);
		if (error) {
			acl_error(dgettext(TEXT_DOMAIN,
			    "Invalid inheritance flags '%s' specified.\n"), $1);
			yycleanup();
			return (error);
		}
		$$ = iflags;
	}
	| INHERIT_TOK SLASH verbose_iflag
	{
		acl_error(dgettext(TEXT_DOMAIN,
		    "Can't mix compact inherit flags with"
		    " verbose inheritance flags.\n"));
		yycleanup();
		return (EACL_INHERIT_ERROR);
	}

verbose_iflag: ACE_INHERIT	{$$ |= $1;}
	| ACE_INHERIT SLASH verbose_iflag {$$ = $1 | $3;}
	| ACE_INHERIT SLASH compact_iflag
	{
		acl_error(dgettext(TEXT_DOMAIN,
		    "Can't mix verbose inherit flags with"
		    " compact inheritance flags.\n"));
		yycleanup();
		return (EACL_INHERIT_ERROR);
	}
	| ACE_INHERIT SLASH ACCESS_TYPE
	{
		acl_error(dgettext(TEXT_DOMAIN,
		    "Inheritance flags can't be mixed with access type.\n"));
		yycleanup();
		return (EACL_INHERIT_ERROR);
	}
	| ACE_INHERIT SLASH ERROR
	{
		yycleanup();
		return ($3);
	}

aclent_perm: PERM_TOK
	{
		$$.perm_style = PERM_TYPE_UNKNOWN;
		$$.perm_str = $1;
		$$.perm_val = 0;
	}
	| PERM_TOK ERROR
	{
		acl_error(dgettext(TEXT_DOMAIN,
		    "ACL entry permissions are incorrectly specified.\n"));
		yycleanup();
		return ($2);
	}

access_type: ACCESS_TYPE {$$ = $1;}
	| ERROR
	{
		yycleanup();
		return ($1);
	}

id: ID {$$ = $1;}
	| SID {$$ = $1;}
	| COLON
	{
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid uid/gid specified.\nThe field"
		    " should be a numeric value.\n"));
		yycleanup();
		return (EACL_UNKNOWN_DATA);
	}
	| ERROR
	{
		yycleanup();
		return ($1);
	}

ace_perms: perm {$$ = $1;}
	| aclent_perm COLON {$$ = $1;}
	| ERROR
	{
		yycleanup();
		return ($1);
	}

perm: perms COLON {$$ = $1;}
	| COLON {$$.perm_style = PERM_TYPE_EMPTY;}

perms: ACE_PERM
	{
		$$.perm_style = PERM_TYPE_ACE;
		$$.perm_val |= $1;
	}
	| ACE_PERM SLASH perms
	{
		$$.perm_style = PERM_TYPE_ACE;
		$$.perm_val = $1 | $3.perm_val;
	}
	| ACE_PERM SLASH aclent_perm
	{

		acl_error(dgettext(TEXT_DOMAIN,
		   "Can't mix verbose permissions with"
		    " compact permission.\n"));
		yycleanup();
		return (EACL_PERM_MASK_ERROR);

	}
	| ACE_PERM SLASH ERROR
	{
		yycleanup();
		return ($3);
	}


idname: IDNAME {$$ = $1;}

entry_type: ENTRY_TYPE {$$ = $1;}
	| ERROR
	{
		yycleanup();
		return ($1);
	}

%%
static void
bad_entry_type(int toketype, char *str)
{
	switch(toketype) {
	case USER_TOK:
	case DEFAULT_USER_TOK:
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid user %s specified.\n"), str);
		break;

	case GROUP_TOK:
	case DEFAULT_GROUP_TOK:
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid group %s specified.\n"), str);
		break;

	case USER_SID_TOK:
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid user SID %s specified.\n"), str);
		break;

	case GROUP_SID_TOK:
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid group SID %s specified.\n"), str);
		break;

	case BARE_SID_TOK:
		acl_error(dgettext(TEXT_DOMAIN,
		    "Invalid SID %s specified.\n"), str);
		break;
	}
}