EcryptFS development
 help / color / mirror / Atom feed
From: Junio C Hamano <gitster@pobox.com>
To: Jeff King <peff@peff.net>
Cc: Matthieu Moy <Matthieu.Moy@grenoble-inp.fr>,
	ecryptfs@vger.kernel.org,
	Stefan Beller <stefanbeller@googlemail.com>,
	git@vger.kernel.org
Subject: Re: Bugreport on Ubuntu LTS: not ok - 2 Objects creation does not break ACLs with restrictive umask
Date: Tue, 05 Jun 2012 10:27:39 -0700	[thread overview]
Message-ID: <7v62b5pt2s.fsf@alter.siamese.dyndns.org> (raw)
In-Reply-To: <20120605164439.GA2694@sigill.intra.peff.net> (Jeff King's message of "Tue, 5 Jun 2012 12:44:39 -0400")

Jeff King <peff@peff.net> writes:

> On Tue, Jun 05, 2012 at 09:31:54AM -0700, Junio C Hamano wrote:
>
>> >>   setfacl -m m:rwx .
>> >>   perl -MFcntl -e 'sysopen(X, "a", O_WRONLY|O_CREAT, 0444)'
>> >>   umask 077
>> >>   perl -MFcntl -e 'sysopen(X, "b", O_WRONLY|O_CREAT, 0444)'
>> >>   getfacl a b
>> [...]
>> >
>> > Reading the withdrawn posix 1003.1e and "man 5 acl", it seems pretty
>> > clear that if a default ACL is present, it should be used, and umask
>> > consulted only if it is not (so the umask should not be making a
>> > difference in this case).
>> >
>> > The reproduction recipe above shows the minimum required to trigger it;
>> > adding a more realistic default ACL (with actual entries for users) does
>> > not seem to make a difference.
>> 
>> Thanks; so combining the above with your earlier patch to 1304 we
>> would have a good detection for SETFACL prerequisite?
>
> Yes, I think we can detect it reliably. I'd like to hear back from
> ecryptfs folks before making a final patch, though. It may be that there
> is some subtle reason for their behavior, and I want to make sure before
> we write it off as just buggy.

Sensible; thanks.

  reply	other threads:[~2012-06-05 17:27 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <7vy5o2ra7w.fsf@alter.siamese.dyndns.org>
     [not found] ` <vpqpq9ejnxs.fsf@bauges.imag.fr>
     [not found]   ` <CALbm-EZrKGaj1Q7gbmPmG0wQHxksnJqaS3bz3tMDsego7Zm2ZQ@mail.gmail.com>
     [not found]     ` <20120605075614.GE25809@sigill.intra.peff.net>
     [not found]       ` <vpq4nqqj8ss.fsf@bauges.imag.fr>
     [not found]         ` <CALbm-EbGoaxkvBXphAPF8rRkS=VFeeFHXQSFdWVrZUJJ8DYovw@mail.gmail.com>
     [not found]           ` <vpqk3zlhorc.fsf@bauges.imag.fr>
     [not found]             ` <20120605140449.GA15640@sigill.intra.peff.net>
     [not found]               ` <20120605141039.GB15640@sigill.intra.peff.net>
     [not found]                 ` <20120605142813.GA17238@sigill.intra.peff.net>
2012-06-05 15:05                   ` Bugreport on Ubuntu LTS: not ok - 2 Objects creation does not break ACLs with restrictive umask Jeff King
2012-06-05 16:31                     ` Junio C Hamano
2012-06-05 16:44                       ` Jeff King
2012-06-05 17:27                         ` Junio C Hamano [this message]
2012-06-05 19:16                         ` Tyler Hicks
2012-06-05 20:45                           ` Stefan Beller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=7v62b5pt2s.fsf@alter.siamese.dyndns.org \
    --to=gitster@pobox.com \
    --cc=Matthieu.Moy@grenoble-inp.fr \
    --cc=ecryptfs@vger.kernel.org \
    --cc=git@vger.kernel.org \
    --cc=peff@peff.net \
    --cc=stefanbeller@googlemail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox