Function UnshiftACL

shared/idmap/shift_linux.go:594–661

UnshiftACL unshifts the uid/gid in the raw ACL entry.

(value string, set *Set)

// UnshiftACL unshifts the uid/gid in the raw ACL entry.
func UnshiftACL(value string, set *Set) (string, error) {
	if set == nil {
		return "", errors.New("Invalid Set supplied")
	}

	buf := []byte(value)
	cBuf := C.CBytes(buf)
	defer C.free(cBuf)
	var header *C.struct_posix_acl_xattr_header = (*C.struct_posix_acl_xattr_header)(cBuf)

	size := len(buf)
	if size < int(unsafe.Sizeof(*header)) {
		return "", errors.New("Invalid ACL size")
	}

	if header.a_version != C.native_to_le32(C.POSIX_ACL_XATTR_VERSION) {
		return "", fmt.Errorf("Invalid ACL header version %d != %d", header.a_version, C.native_to_le32(C.POSIX_ACL_XATTR_VERSION))
	}

	count := C.posix_acl_xattr_count(C.size_t(size))
	if count < 0 {
		return "", errors.New("Invalid ACL count")
	}

	if count == 0 {
		return "", errors.New("No valid ACLs found")
	}

	entryPtr := C.posix_entry_start(unsafe.Pointer(header))
	endEntryPtr := C.posix_entry_end(entryPtr, C.size_t(count))
	for entryPtr != endEntryPtr {
		entry := (*C.struct_posix_acl_xattr_entry)(entryPtr)
		switch C.le16_to_native(entry.e_tag) {
		case C.ACL_USER:
			ouid := int64(C.le32_to_native(entry.e_id))
			uid, _ := set.ShiftFromNS(ouid, -1)
			if int(uid) != -1 {
				entry.e_id = C.native_to_le32(C.int(uid))
				logger.Debugf("Unshifting ACL_USER from uid %d to uid %d", ouid, uid)
			}

		case C.ACL_GROUP:
			ogid := int64(C.le32_to_native(entry.e_id))
			_, gid := set.ShiftFromNS(-1, ogid)
			if int(gid) != -1 {
				entry.e_id = C.native_to_le32(C.int(gid))
				logger.Debugf("Unshifting ACL_GROUP from gid %d to gid %d", ogid, gid)
			}

		case C.ACL_USER_OBJ:
			logger.Debugf("Ignoring ACL type ACL_USER_OBJ")
		case C.ACL_GROUP_OBJ:
			logger.Debugf("Ignoring ACL type ACL_GROUP_OBJ")
		case C.ACL_MASK:
			logger.Debugf("Ignoring ACL type ACL_MASK")
		case C.ACL_OTHER:
			logger.Debugf("Ignoring ACL type ACL_OTHER")
		default: