First cut of full implementation of new permission handling
* fhandler.cc (fhandler_base::open_with_arch): Call open with mode not umasked. (fhandler_base::open): Explicitely umask mode on NFS here. Call new set_created_file_access rather than set_file_attribute. * fhandler_disk_file.cc (fhandler_disk_file::fchmod): Reimplement setting permissions on filesystems supporting ACLs using the new set_posix_access call. (fhandler_disk_file::fchown): Ditto. (fhandler_disk_file::mkdir): Call new set_created_file_access rather than set_file_attribute. * fhandler_socket.cc (fhandler_socket::bind): Don't umask here. Add WRITE_OWNER access to allow writing group in case of SGID bit set. Call new set_created_file_access rather than set_file_attribute. * path.cc (symlink_worker): Call new set_created_file_access rather than set_file_attribute. * sec_acl.cc (searchace): Un-staticize. (set_posix_access): New, complementary functionality to get_posix_access. (setacl): Implement in terms of get_posix_access/set_posix_access. (get_posix_access): Add handling for just created files requiring their first Cygwin ACL. Fix new_style recognition. Handle SGID bit. For old-style ACLs, ignore SYSTEM and Administrators when computing the {DEF_}CLASS_OBJ perms. * security.cc (get_file_sd): Revamp comment. Change and (hopefully) speed up inheritance processing for just created files. (alloc_sd): Remove. (set_security_attribute): Call set_posix_access instead of alloc_sd. (get_object_attribute): Fix return value. (create_object_sd_from_attribute): Call set_posix_access instead of alloc_sd. (set_file_attribute): Remove. (set_created_file_access): New function implemented in terms of get_posix_access/set_posix_access. * security.h (set_file_attribute): Remove prototype. (set_created_file_access): Add prototype. (searchace): Ditto. (set_posix_access): Ditto. * syscalls.cc (open): Call open_with_arch with mode not umasked. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
This commit is contained in:
@ -1,7 +1,7 @@
|
||||
/* fhandler_socket.cc. See fhandler.h for a description of the fhandler classes.
|
||||
|
||||
Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
|
||||
2011, 2012, 2013, 2014 Red Hat, Inc.
|
||||
2011, 2012, 2013, 2014, 2015 Red Hat, Inc.
|
||||
|
||||
This file is part of Cygwin.
|
||||
|
||||
@ -1039,10 +1039,10 @@ fhandler_socket::bind (const struct sockaddr *name, int namelen)
|
||||
sin.sin_port = ntohs (sin.sin_port);
|
||||
debug_printf ("AF_LOCAL: socket bound to port %u", sin.sin_port);
|
||||
|
||||
mode_t mode = adjust_socket_file_mode ((S_IRWXU | S_IRWXG | S_IRWXO)
|
||||
& ~cygheap->umask);
|
||||
mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH;
|
||||
DWORD fattr = FILE_ATTRIBUTE_SYSTEM;
|
||||
if (!(mode & (S_IWUSR | S_IWGRP | S_IWOTH)) && !pc.has_acls ())
|
||||
if (!pc.has_acls ()
|
||||
&& !(mode & ~cygheap->umask & (S_IWUSR | S_IWGRP | S_IWOTH)))
|
||||
fattr |= FILE_ATTRIBUTE_READONLY;
|
||||
SECURITY_ATTRIBUTES sa = sec_none_nih;
|
||||
NTSTATUS status;
|
||||
@ -1060,7 +1060,7 @@ fhandler_socket::bind (const struct sockaddr *name, int namelen)
|
||||
I don't know what setting that is or how to recognize such a share,
|
||||
so for now we don't request WRITE_DAC on remote drives. */
|
||||
if (pc.has_acls () && !pc.isremote ())
|
||||
access |= READ_CONTROL | WRITE_DAC;
|
||||
access |= READ_CONTROL | WRITE_DAC | WRITE_OWNER;
|
||||
|
||||
status = NtCreateFile (&fh, access, pc.get_object_attr (attr, sa), &io,
|
||||
NULL, fattr, 0, FILE_CREATE,
|
||||
@ -1078,8 +1078,7 @@ fhandler_socket::bind (const struct sockaddr *name, int namelen)
|
||||
else
|
||||
{
|
||||
if (pc.has_acls ())
|
||||
set_file_attribute (fh, pc, ILLEGAL_UID, ILLEGAL_GID,
|
||||
S_JUSTCREATED | mode);
|
||||
set_created_file_access (fh, pc, mode);
|
||||
char buf[sizeof (SOCKET_COOKIE) + 80];
|
||||
__small_sprintf (buf, "%s%u %c ", SOCKET_COOKIE, sin.sin_port,
|
||||
get_socket_type () == SOCK_STREAM ? 's'
|
||||
|
Reference in New Issue
Block a user