diff options
author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2015-11-28 18:41:08 -0500 |
---|---|---|
committer | Sven Eden <yamakuzure@gmx.net> | 2017-05-17 15:22:14 +0200 |
commit | 7fd82b1492ab3a8987095b237dc8c4b7ab6d00de (patch) | |
tree | 91a92a911d4945514a78b53d3e26d5815ce86cbe /src/shared | |
parent | 754a768833613e94527ef4403e62858bce189db4 (diff) |
acl-util: only set the mask if not present
When we have non-owner user or group entries, we need the mask
for the acl to be valid. But acl_calc_mask() calculates the mask
to include all permissions, even those that were masked before.
Apparently this happens when we inherit *:r-x permissions from
a parent directory — the kernel sets *:r-x, mask:r--, effectively
masking the executable bit. acl_calc_mask() would set the mask:r-x,
effectively enabling the bit. To avoid this, be more conservative when
to add the mask entry: first iterate over all entries, and do nothing
if a mask.
This returns the code closer to J.A.Steffens' original version
in v204-90-g23ad4dd884.
Should fix https://github.com/elogind/elogind/issues/1977.
Diffstat (limited to 'src/shared')
-rw-r--r-- | src/shared/acl-util.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c index 583cb017d..27225e3fe 100644 --- a/src/shared/acl-util.c +++ b/src/shared/acl-util.c @@ -72,6 +72,7 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) { int calc_acl_mask_if_needed(acl_t *acl_p) { acl_entry_t i; int r; + bool need = false; assert(acl_p); @@ -86,17 +87,16 @@ int calc_acl_mask_if_needed(acl_t *acl_p) { if (tag == ACL_MASK) return 0; - if (IN_SET(tag, ACL_USER, ACL_GROUP)) { - if (acl_calc_mask(acl_p) < 0) - return -errno; - - return 1; - } + if (IN_SET(tag, ACL_USER, ACL_GROUP)) + need = true; } if (r < 0) return -errno; - return 0; + if (need && acl_calc_mask(acl_p) < 0) + return -errno; + + return need; } int add_base_acls_if_needed(acl_t *acl_p, const char *path) { |