Си: проверить права на файл/директорию для определенного пользователя

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>

int accessuid(const char *path, int mode, uid_t uid)
{
	pid_t ch;
	int fds[2];
	int rv = -1;
	int status = 0;

	if (uid == getuid()) {
		return access(path, mode);
	}

	if (pipe(fds) < 0) {
		return -1;
	}

	ch = fork();
	if (ch < 0) { /* Error */
		close(fds[0]);
		close(fds[1]);
		return -1;
	}

	if (ch > 0) { /* Parent: */
		close(fds[1]);
		if (read(fds[0], &rv, sizeof(int)) != sizeof(int)) {
			close(fds[0]);
			return -1;
		}
		close(fds[0]);
		if (waitpid(ch, &status, 0) < 0) {
			close(fds[0]);
			return -1;
		}
		return rv;
	} else { /* Child */
		close(fds[0]);
		if (setuid(uid) < 0) {
			rv = -1;
			write(fds[1], &rv, sizeof(int));
			exit(EXIT_FAILURE);
		}
		rv = access(path, mode);
		if (write(fds[1], &rv, sizeof(int)) != sizeof(int)) {
			exit(EXIT_FAILURE);
		}
		close(fds[0]);
		exit(EXIT_SUCCESS);
	}

	return -1;
}

int main(int argc, char *argv[])
{
	uid_t uid;
	const char *filename = NULL;
	int mode = R_OK;
	int i;

	if (argc < 3) {
		fprintf(stderr, "Usage: %s UID filename [mode]\n", argv[0]);
		return EXIT_FAILURE;
	}

	uid = atoi(argv[1]);
	filename = argv[2];
	if (argc > 3) {
		mode = 0;
		for (i = 0; argv[3][i]; i++) {
			switch (argv[3][i]) {
				case 'r':
					mode |= R_OK;
					break;
				case 'w':
					mode |= W_OK;
					break;
				case 'x':
					mode |= X_OK;
					break;
				default:
					break;
			}
		}
	}

	printf("ACCESS == %d\n", accessuid(filename, mode, uid));

	return EXIT_SUCCESS;
}

#include <stdlib.h>
#include <stdio.h>
#include <grp.h>
#include <pwd.h>
#include <acl/libacl.h>
#include <sys/acl.h>
#include <sys/stat.h>
#include <sys/xattr.h>
#include <unistd.h>

int
access_suid(const char* path, const char* user, mode_t mode)
{
  struct passwd *pw = getpwnam(user);
  if(pw == NULL)
    return false;
  if(setuid(pw->pw_uid) == -1)
    return false;
  int ret = access(path, mode) == 0;
  setuid(0);
  return ret;
}

int
access_uid(const char* path, const char* user, mode_t mode)
{
  int entryId;
  acl_permset_t permset;
  acl_t acl;
  acl_entry_t entry;
  acl_tag_t tag;
  uid_t *uidp;
  gid_t *gidp;
  struct stat sb;
  struct passwd *pw;
  int j, ngroups;
  gid_t *groups;
  mode_t uo_mode = 0;
  mode_t u_mode = 0;
  mode_t go_mode = 0;
  mode_t g_mode = 0;
  mode_t o_mode = 0;
  mode_t mask = 0;
  if(stat(path, &sb))
    return false;
  pw = getpwnam(user);
  if(pw == NULL)
    return false;
  ngroups = 0;
  getgrouplist(user, pw->pw_gid, groups, &ngroups);
  groups = (gid_t*) malloc(ngroups * sizeof (gid_t));
  if(groups == NULL)
    return false;
  if(getgrouplist(user, pw->pw_gid, groups, &ngroups) != -1)
    {
      acl = acl_get_file(path, ACL_TYPE_ACCESS);
      if(acl != NULL)
        {
          for(entryId = ACL_FIRST_ENTRY;; entryId = ACL_NEXT_ENTRY)
            {
              if(acl_get_entry(acl, entryId, &entry) != 1)
                break;
              if(acl_get_tag_type(entry, &tag) == -1)
                break;
              if(acl_get_permset(entry, &permset) == -1)
                break;
              int p = ((mode_t*) permset)[0];
              if(tag == ACL_USER_OBJ && sb.st_uid == pw->pw_uid)
                {
                  uo_mode = p;
                  continue;
                }
              if(tag == ACL_USER)
                {
                  uidp = (uid_t*) acl_get_qualifier(entry);
                  if(uidp != NULL && *uidp == pw->pw_uid)
                    u_mode = p;
                  continue;
                }
              if(tag == ACL_GROUP_OBJ && sb.st_gid == pw->pw_gid)
                {
                  go_mode = p;
                  continue;
                }
              if(tag == ACL_GROUP)
                {
                  gidp = (gid_t*) acl_get_qualifier(entry);
                  if(gidp != NULL)
                    {
                      for(j = 0; j < ngroups; j++)
                        {
                          if(*gidp == groups[j])
                            g_mode = p;
                        }
                    }
                  continue;
                }
              if(tag == ACL_OTHER)
                {
                  o_mode = p;
                  continue;
                }
              if(tag == ACL_MASK)
                {
                  mask = p;
                  continue;
                }
            }
          acl_free(acl);
        }
      free(groups);
    }
  if(uo_mode)
    return uo_mode & mode;
  if(u_mode)
    return u_mode & mask & mode;
  if(go_mode)
    return go_mode & mask & mode;
  if(g_mode)
    return g_mode & mask & mode;
  return o_mode & mode;
}

int
main(int argc, char** argv)
{
  const char* uid;
  const char *filename = NULL;
  int mode = R_OK;
  int i;

  if(argc < 3)
    {
      fprintf(stderr, "Usage: %s  fileName userName [mode]\n", argv[0]);
      return EXIT_FAILURE;
    }

  uid = argv[2];
  filename = argv[1];
  if(argc > 3)
    {
      mode = 0;
      for(i = 0; argv[3][i]; i++)
        {
          switch(argv[3][i])
            {
            case 'r':
              mode |= R_OK;
              break;
            case 'w':
              mode |= W_OK;
              break;
            case 'x':
              mode |= X_OK;
              break;
            default:
              break;
            }
        }
    }

  printf("ACCESS_UID == %d\n", access_uid(filename, uid, mode));
  printf("ACCESS_SUID == %d\n", access_suid(filename, uid, mode));
  return EXIT_SUCCESS;  
}

ACCESS_UID == 2
ACCESS_SUID == 0

$ g++ -Wall -Wextra -lacl -o test test2.c 
test2.c: In function ‘int access_uid(const char*, const char*, mode_t)’:
test2.c:50:51: warning: ‘groups’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   getgrouplist(user, pw->pw_gid, groups, &ngroups);
                                                   ^

//--------------------- dir_perm --------------------------

// cur_dir -текущая директория
// dir     -целевая директория
// ftp     -содержит номера пользователя и группы

int dir_perm(const char *cur_dir, const char *dir, struct ftp *ftp)
{
// Цикл.
// pdir -очередной кусок пути.
            if(stat(pdir, &st) < 0) return(-1);
            if((st.st_mode & S_IFMT)!=S_IFDIR) return(-1);
            if(st.st_uid == ftp->uid){
                if(((st.st_mode & S_IXUSR)==0)||
                   ((st.st_mode & S_IRUSR)==0)) return(-1);
            }
            else if(st.st_gid == ftp->gid){
                if(((st.st_mode & S_IXGRP)==0)||
                   ((st.st_mode & S_IRGRP)==0)) return(-1);
            }
            else if(((st.st_mode & S_IXOTH)==0)||
                ((st.st_mode & S_IROTH)==0)) return(-1);
}

int
access_suid_wr(const char* path, uid_t uid)
{
    int status, fd;
    pid_t pid;
    pid = fork();
    if(pid < 0) return(-1);
    if(pid == 0){
        if(setuid(uid) == -1) exit(1);
        fd = open(path, O_WRONLY);
        if(fd < 0) exit(1);
        close(fd);
        exit(0);
    }
    if(waitpid(pid, &status, 0) < 0) return(-1);
    if(status==0) return(0);
    return(-1);
}

//---------------- deroot_ftp ----------------------------

int deroot_ftp(struct ftp *ftp)
{
    int k;
    uid_t  uid;
    gid_t  gr_list[2];

    if(ftp->user[0]==0) return(-1);
    uid=getuid();
    if(uid == 0){

        //--- "дерутизация" ---

        //--- группа ---
        k=setgroups(0, gr_list);
        if(k<0) return(-1);

        k=setgid(ftp->gid);
        if(k<0) return(-1);

        //--- пользователь ---
        k=setuid(ftp->uid);
        if(k<0) return(-1);
    }
    else{
        if(ftp->uid != uid) return(-1);
    }
    return(0);
}