Commit baf10d0b authored by Jan Alexander Steffens (heftig)'s avatar Jan Alexander Steffens (heftig) Committed by Michael Biebl

journald: DO recalculate the ACL mask, but only if it doesn't exist

Since 11ec7ced, journald isn't setting the ACLs properly anymore if
the files had no ACLs to begin with: acl_set_fd fails with EINVAL.

An ACL with ACL_USER or ACL_GROUP entries but no ACL_MASK entry is
invalid, so make sure a mask exists before trying to set the ACL.
parent aa10669e
......@@ -227,9 +227,11 @@ void server_fix_perms(Server *s, JournalFile *f, uid_t uid) {
}
}
/* We do not recalculate the mask here, so that the fchmod() mask above stays intact. */
/* We do not recalculate the mask unconditionally here,
* so that the fchmod() mask above stays intact. */
if (acl_get_permset(entry, &permset) < 0 ||
acl_add_perm(permset, ACL_READ) < 0) {
acl_add_perm(permset, ACL_READ) < 0 ||
calc_acl_mask_if_needed(&acl) < 0) {
log_warning("Failed to patch ACL on %s, ignoring: %m", f->path);
goto finish;
}
......
......@@ -69,6 +69,34 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) {
return 0;
}
int calc_acl_mask_if_needed(acl_t *acl_p) {
acl_entry_t i;
int found;
assert(acl_p);
for (found = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i);
found > 0;
found = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) {
acl_tag_t tag;
if (acl_get_tag_type(i, &tag) < 0)
return -errno;
if (tag == ACL_MASK)
return 0;
}
if (found < 0)
return -errno;
if (acl_calc_mask(acl_p) < 0)
return -errno;
return 0;
}
int search_acl_groups(char*** dst, const char* path, bool* belong) {
acl_t acl;
......
......@@ -24,4 +24,5 @@
#include <stdbool.h>
int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry);
int calc_acl_mask_if_needed(acl_t *acl_p);
int search_acl_groups(char*** dst, const char* path, bool* belong);
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment