|
 |
ff6046 |
From bbe9ac11d8d4a8511214605509a593fb9f04ffaa Mon Sep 17 00:00:00 2001
|
|
|
ff6046 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
ff6046 |
Date: Fri, 19 Oct 2018 11:28:40 +0200
|
|
|
ff6046 |
Subject: [PATCH] chown-recursive: also drop ACLs when recursively chown()ing
|
|
|
ff6046 |
|
|
|
ff6046 |
Let's better be safe than sorry and also drop ACLs.
|
|
|
ff6046 |
|
|
|
ff6046 |
(cherry-picked from commit f89bc84f3242449cbc308892c87573b131f121df)
|
|
|
ff6046 |
|
|
|
ff6046 |
Related: #1643368
|
|
|
ff6046 |
---
|
|
|
ff6046 |
src/core/chown-recursive.c | 16 ++++++++++++----
|
|
|
ff6046 |
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
ff6046 |
|
|
|
ff6046 |
diff --git a/src/core/chown-recursive.c b/src/core/chown-recursive.c
|
|
|
ff6046 |
index 27c64489b5..447b771267 100644
|
|
|
ff6046 |
--- a/src/core/chown-recursive.c
|
|
|
ff6046 |
+++ b/src/core/chown-recursive.c
|
|
|
ff6046 |
@@ -3,6 +3,7 @@
|
|
|
ff6046 |
#include <fcntl.h>
|
|
|
ff6046 |
#include <sys/stat.h>
|
|
|
ff6046 |
#include <sys/types.h>
|
|
|
ff6046 |
+#include <sys/xattr.h>
|
|
|
ff6046 |
|
|
|
ff6046 |
#include "chown-recursive.h"
|
|
|
ff6046 |
#include "dirent-util.h"
|
|
|
ff6046 |
@@ -14,6 +15,7 @@
|
|
|
ff6046 |
|
|
|
ff6046 |
static int chown_one(int fd, const struct stat *st, uid_t uid, gid_t gid) {
|
|
|
ff6046 |
char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
|
|
|
ff6046 |
+ const char *n;
|
|
|
ff6046 |
|
|
|
ff6046 |
assert(fd >= 0);
|
|
|
ff6046 |
assert(st);
|
|
|
ff6046 |
@@ -26,13 +28,19 @@ static int chown_one(int fd, const struct stat *st, uid_t uid, gid_t gid) {
|
|
|
ff6046 |
* O_PATH. (Note: fchown() and fchmod() do not work with O_PATH, the kernel refuses that. */
|
|
|
ff6046 |
xsprintf(procfs_path, "/proc/self/fd/%i", fd);
|
|
|
ff6046 |
|
|
|
ff6046 |
+ /* Drop any ACL if there is one */
|
|
|
ff6046 |
+ FOREACH_STRING(n, "system.posix_acl_access", "system.posix_acl_default")
|
|
|
ff6046 |
+ if (removexattr(procfs_path, n) < 0)
|
|
|
ff6046 |
+ if (!IN_SET(errno, ENODATA, EOPNOTSUPP, ENOSYS, ENOTTY))
|
|
|
ff6046 |
+ return -errno;
|
|
|
ff6046 |
+
|
|
|
ff6046 |
if (chown(procfs_path, uid, gid) < 0)
|
|
|
ff6046 |
return -errno;
|
|
|
ff6046 |
|
|
|
ff6046 |
- /* The linux kernel alters the mode in some cases of chown(). Let's undo this. We do this only for non-symlinks
|
|
|
ff6046 |
- * however. That's because for symlinks the access mode is ignored anyway and because on some kernels/file
|
|
|
ff6046 |
- * systems trying to change the access mode will succeed but has no effect while on others it actively
|
|
|
ff6046 |
- * fails. */
|
|
|
ff6046 |
+ /* The linux kernel alters the mode in some cases of chown(), as well when we change ACLs. Let's undo this. We
|
|
|
ff6046 |
+ * do this only for non-symlinks however. That's because for symlinks the access mode is ignored anyway and
|
|
|
ff6046 |
+ * because on some kernels/file systems trying to change the access mode will succeed but has no effect while
|
|
|
ff6046 |
+ * on others it actively fails. */
|
|
|
ff6046 |
if (!S_ISLNK(st->st_mode))
|
|
|
ff6046 |
if (chmod(procfs_path, st->st_mode & 07777) < 0)
|
|
|
ff6046 |
return -errno;
|