Merge pull request #156 from irconan/default-acls

Support ACLs without a specific user/group

4 files changed, 97 insertions, 46 deletions

diff --git a/doc/server/plugins/generators/rules.txt b/doc/server/plugins/generators/rules.txt
index a21dd217f..77ce63e51 100644
--- a/doc/server/plugins/generators/rules.txt
+++ b/doc/server/plugins/generators/rules.txt
@@ -295,6 +295,7 @@ child ``<ACL>`` tags.  For instance:
           mode="0775">
       <ACL type="default" scope="user" user="foouser" perms="rw"/>
       <ACL type="default" scope="group" group="users" perms="rx"/>
+      <ACL type="default" scope="other" perms="r"/>
     </Path>
 
 .. xml:element:: ACL
@@ -303,6 +304,9 @@ It is not currently possible to manually set an effective rights mask;
 the mask will be automatically calculated from the given ACLs when
 they are applied.
 
+For directories either no default ACL entries or at least an entry for
+the owner, owning group and other must be defined.
+
 Note that it is possible to set ACLs that demand different permissions
 on a file than those specified in the ``perms`` attribute on the
 ``Path`` tag.  For instance:
diff --git a/schemas/types.xsd b/schemas/types.xsd
index 836cfa38e..52c9d59c8 100644
--- a/schemas/types.xsd
+++ b/schemas/types.xsd
@@ -200,6 +200,7 @@
     <xsd:restriction base="xsd:string">
       <xsd:enumeration value="user"/>
       <xsd:enumeration value="group"/>
+      <xsd:enumeration value="other"/>
     </xsd:restriction>
   </xsd:simpleType>
 
diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/base.py b/src/lib/Bcfg2/Client/Tools/POSIX/base.py
index 3243bbf50..e593e0a0a 100644
--- a/src/lib/Bcfg2/Client/Tools/POSIX/base.py
+++ b/src/lib/Bcfg2/Client/Tools/POSIX/base.py
@@ -217,18 +217,13 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
                 acl.delete_entry(aclentry)
         if os.path.isdir(path):
             defacl = posix1e.ACL(filedef=path)
-            if not defacl.valid():
-                # when a default ACL is queried on a directory that
-                # has no default ACL entries at all, you get an empty
-                # ACL, which is not valid.  in this circumstance, we
-                # just copy the access ACL to get a base valid ACL
-                # that we can add things to.
-                defacl = posix1e.ACL(acl=acl)
-            else:
-                for aclentry in defacl:
-                    if aclentry.tag_type in [posix1e.ACL_USER,
-                                             posix1e.ACL_GROUP]:
-                        defacl.delete_entry(aclentry)
+            for aclentry in defacl:
+                if aclentry.tag_type in [posix1e.ACL_USER,
+                                         posix1e.ACL_USER_OBJ,
+                                         posix1e.ACL_GROUP,
+                                         posix1e.ACL_GROUP_OBJ,
+                                         posix1e.ACL_OTHER]:
+                    defacl.delete_entry(aclentry)
         else:
             defacl = None
 
@@ -254,10 +249,16 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
             try:
                 if scope == posix1e.ACL_USER:
                     scopename = "user"
-                    aclentry.qualifier = self._norm_uid(qualifier)
+                    if qualifier:
+                        aclentry.qualifier = self._norm_uid(qualifier)
+                    else:
+                        aclentry.tag_type = posix1e.ACL_USER_OBJ
                 elif scope == posix1e.ACL_GROUP:
                     scopename = "group"
-                    aclentry.qualifier = self._norm_gid(qualifier)
+                    if qualifier:
+                        aclentry.qualifier = self._norm_gid(qualifier)
+                    else:
+                        aclentry.tag_type = posix1e.ACL_GROUP_OBJ
             except (OSError, KeyError):
                 err = sys.exc_info()[1]
                 self.logger.error("POSIX: Could not resolve %s %s: %s" %
@@ -358,7 +359,7 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
         try:
             # single octal digit
             rv = int(perms)
-            if rv > 0 and rv < 8:
+            if rv >= 0 and rv < 8:
                 return rv
             else:
                 self.logger.error("POSIX: Permissions digit out of range in "
@@ -388,17 +389,18 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
         """ Get a string representation of the given ACL.  aclkey must
         be a tuple of (<acl type>, <acl scope>, <qualifier>) """
         atype, scope, qualifier = aclkey
+        if not qualifier:
+            qualifier = ''
         acl_str = []
         if atype == 'default':
             acl_str.append(atype)
-        if scope == posix1e.ACL_USER:
+        if scope == posix1e.ACL_USER or scope == posix1e.ACL_USER_OBJ:
             acl_str.append("user")
-        elif scope == posix1e.ACL_GROUP:
+        elif scope == posix1e.ACL_GROUP or scope == posix1e.ACL_GROUP_OBJ:
             acl_str.append("group")
-        if qualifier is None:
-            acl_str.append('')
-        else:
-            acl_str.append(qualifier)
+        elif scope == posix1e.ACL_OTHER:
+            acl_str.append("other")
+        acl_str.append(qualifier)
         acl_str.append(self._acl_perm2string(perms))
         return ":".join(acl_str)
 
@@ -564,9 +566,17 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
         wanted = dict()
         for acl in entry.findall("ACL"):
             if acl.get("scope") == "user":
-                scope = posix1e.ACL_USER
+                if acl.get("user"):
+                    scope = posix1e.ACL_USER
+                else:
+                    scope = posix1e.ACL_USER_OBJ
             elif acl.get("scope") == "group":
-                scope = posix1e.ACL_GROUP
+                if acl.get("group"):
+                    scope = posix1e.ACL_GROUP
+                else:
+                    scope = posix1e.ACL_GROUP_OBJ
+            elif acl.get("scope") == "other":
+                scope = posix1e.ACL_OTHER
             else:
                 self.logger.error("POSIX: Unknown ACL scope %s" %
                                   acl.get("scope"))
@@ -575,7 +585,10 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
                 self.logger.error("POSIX: No permissions set for ACL: %s" %
                                   Bcfg2.Client.XML.tostring(acl))
                 continue
-            wanted[(acl.get("type"), scope, acl.get(acl.get("scope")))] = \
+            qual = acl.get(acl.get("scope"))
+            if not qual:
+                qual = ''
+            wanted[(acl.get("type"), scope, qual)] = \
                 self._norm_acl_perms(acl.get('perms'))
         return wanted
 
@@ -589,11 +602,12 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
             """ Given an ACL object, process it appropriately and add
             it to the return value """
             try:
+                qual = ''
                 if acl.tag_type == posix1e.ACL_USER:
                     qual = pwd.getpwuid(acl.qualifier)[0]
                 elif acl.tag_type == posix1e.ACL_GROUP:
                     qual = grp.getgrgid(acl.qualifier)[0]
-                else:
+                elif atype == "access" or acl.tag_type == posix1e.ACL_MASK:
                     return
             except (OSError, KeyError):
                 err = sys.exc_info()[1]
@@ -623,9 +637,38 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
                 _process_acl(acl, "default")
         return existing
 
-    def _verify_acls(self, entry, path=None):
+    def _verify_acls(self, entry, path=None):  # pylint: disable=R0912
         """ verify POSIX ACLs on the given entry.  return True if all
         ACLS are correct, false otherwise """
+        def _verify_acl(aclkey, perms):
+            """ Given ACL data, process it appropriately and add it to
+            missing or wrong lists if appropriate """
+            if aclkey not in existing:
+                missing.append(self._acl2string(aclkey, perms))
+            elif existing[aclkey] != perms:
+                wrong.append((self._acl2string(aclkey, perms),
+                              self._acl2string(aclkey, existing[aclkey])))
+            if path == entry.get("name"):
+                atype, scope, qual = aclkey
+                aclentry = Bcfg2.Client.XML.Element("ACL", type=atype,
+                                                    perms=str(perms))
+                if (scope == posix1e.ACL_USER or
+                    scope == posix1e.ACL_USER_OBJ):
+                    aclentry.set("scope", "user")
+                elif (scope == posix1e.ACL_GROUP or
+                      scope == posix1e.ACL_GROUP_OBJ):
+                    aclentry.set("scope", "group")
+                elif scope == posix1e.ACL_OTHER:
+                    aclentry.set("scope", "other")
+                else:
+                    self.logger.debug("POSIX: Unknown ACL scope %s on %s" %
+                                      (scope, path))
+                    return
+
+                if scope != posix1e.ACL_OTHER:
+                    aclentry.set(aclentry.get("scope"), qual)
+                entry.append(aclentry)
+
         if not HAS_ACLS:
             if entry.findall("ACL"):
                 self.logger.debug("POSIX: ACLs listed for %s but no pylibacl "
@@ -646,25 +689,7 @@ class POSIXTool(Bcfg2.Client.Tools.Tool):
         extra = []
         wrong = []
         for aclkey, perms in wanted.items():
-            if aclkey not in existing:
-                missing.append(self._acl2string(aclkey, perms))
-            elif existing[aclkey] != perms:
-                wrong.append((self._acl2string(aclkey, perms),
-                              self._acl2string(aclkey, existing[aclkey])))
-            if path == entry.get("name"):
-                atype, scope, qual = aclkey
-                aclentry = Bcfg2.Client.XML.Element("ACL", type=atype,
-                                                    perms=str(perms))
-                if scope == posix1e.ACL_USER:
-                    aclentry.set("scope", "user")
-                elif scope == posix1e.ACL_GROUP:
-                    aclentry.set("scope", "group")
-                else:
-                    self.logger.debug("POSIX: Unknown ACL scope %s on %s" %
-                                      (scope, path))
-                    continue
-                aclentry.set(aclentry.get("scope"), qual)
-                entry.append(aclentry)
+            _verify_acl(aclkey, perms)
 
         for aclkey, perms in existing.items():
             if aclkey not in wanted:
diff --git a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
index e49779a10..1d12ee461 100644
--- a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
+++ b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
@@ -129,12 +129,30 @@ class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
 
     @classmethod
     def Errors(cls):
-        return {"unknown-entry-type": "error",
+        return {"missing-elements": "error",
+                "unknown-entry-type": "error",
                 "unknown-entry-tag": "error",
                 "required-attrs-missing": "error",
                 "required-attr-format": "error",
                 "extra-attrs": "warning"}
 
+    def check_default_acl(self, path):
+        """ Check that a default ACL contains either no entries or minimum
+        required entries """
+        defaults = 0
+        if path.xpath("ACL[@type='default' and @scope='user' and @user='']"):
+            defaults += 1
+        if path.xpath("ACL[@type='default' and @scope='group' and @group='']"):
+            defaults += 1
+        if path.xpath("ACL[@type='default' and @scope='other']"):
+            defaults += 1
+        if defaults > 0 and defaults < 3:
+            self.LintError(
+                "missing-elements",
+                "A Path must have either no default ACLs or at"
+                " least default:user::, default:group:: and"
+                " default:other::")
+
     def check_packages(self):
         """ Check Packages sources for Source entries with missing
         attributes. """
@@ -234,6 +252,9 @@ class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
                     required_attrs['major'] = is_device_mode
                     required_attrs['minor'] = is_device_mode
 
+            if tag == 'Path':
+                self.check_default_acl(entry)
+
             if tag == 'ACL' and 'scope' in required_attrs:
                 required_attrs[entry.get('scope')] = is_username