o Separate acl_t into internal and external representations as

  required by POSIX.1e.  This maintains the current 'struct acl'
  in the kernel while providing the generic external acl_t
  interface required to complete the ACL editing library.
o Add the acl_get_entry() function.
o Convert the existing ACL utilities, getfacl and setfacl, to
  fully make use of the ACL editing library.

Obtained from:	TrustedBSD Project

1 files changed, 24 insertions, 16 deletions

diff --git a/lib/libc/posix1e/acl_perm.c b/lib/libc/posix1e/acl_perm.c
index cdd8e3064774..8f634cb4ecb1 100644
--- a/lib/libc/posix1e/acl_perm.c
+++ b/lib/libc/posix1e/acl_perm.c
@@ -35,25 +35,29 @@
 #include <string.h>
 
 /*
- * acl_add_perm() adds the permission contained in perm to the
+ * acl_add_perm() (23.4.1): add the permission contained in perm to the
  * permission set permset_d
  */
 int
 acl_add_perm(acl_permset_t permset_d, acl_perm_t perm)
 {
 
-	if (!permset_d || (perm & !(ACL_PERM_BITS))) {
-		errno = EINVAL;
-		return -1;
+	if (permset_d) {
+		switch(perm) {
+		case ACL_READ:
+		case ACL_WRITE:
+		case ACL_EXECUTE:
+			*permset_d |= perm;
+			return 0;
+		}
 	}
 
-	*permset_d |= perm;
-
-	return 0;
+	errno = EINVAL;
+	return -1;
 }
 
 /*
- * acl_clear_perms() clears all permisions from the permission
+ * acl_clear_perms() (23.4.3): clear all permisions from the permission
  * set permset_d
  */
 int
@@ -65,25 +69,29 @@ acl_clear_perms(acl_permset_t permset_d)
 		return -1;
 	}
 
-	*permset_d = 0;
+	*permset_d = ACL_PERM_NONE;
 
 	return 0;
 }
 
 /*
- * acl_delete_perm() removes the permission in perm from the
+ * acl_delete_perm() (23.4.10): remove the permission in perm from the
  * permission set permset_d
  */
 int
 acl_delete_perm(acl_permset_t permset_d, acl_perm_t perm)
 {
 
-	if (!permset_d) {
-		errno = EINVAL;
-		return -1;
+	if (permset_d) {
+		switch(perm) {
+		case ACL_READ:
+		case ACL_WRITE:
+		case ACL_EXECUTE:
+			*permset_d &= ~(perm & ACL_PERM_BITS);
+			return 0;
+		}
 	}
 
-	*permset_d &= ~(perm & ACL_PERM_BITS);
-
-	return 0;
+	errno = EINVAL;
+	return -1;
 }