JehanneOS/newlib
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

* security.cc (alloc_sd): Don't apply temporary workaround for chmod

Browse Source 
to DEF_USER_OBJ, DEF_GROUP_OBJ, and DEF_OTHER_OBJ ACEs.
This commit is contained in:
Corinna Vinschen 2015-02-25 17:18:13 +00:00
parent 9d5309bf89
commit cc70635c0d
2 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
winsup/cygwin/ChangeLog
View File

@ -1,3 +1,8 @@
2015-02-25 Corinna Vinschen <corinna@vinschen.de>
* security.cc (alloc_sd): Don't apply temporary workaround for chmod
to DEF_USER_OBJ, DEF_GROUP_OBJ, and DEF_OTHER_OBJ ACEs.
2015-02-25 Corinna Vinschen <corinna@vinschen.de> 2015-02-25 Corinna Vinschen <corinna@vinschen.de>
* fhandler_tty.cc (fhandler_pty_slave::read): Having no input is not an * fhandler_tty.cc (fhandler_pty_slave::read): Having no input is not an

21
winsup/cygwin/security.cc
View File

@ -777,14 +777,19 @@ alloc_sd (path_conv &pc, uid_t uid, gid_t gid, int attribute,
ace->Header.AceFlags &= ~INHERITED_ACE; ace->Header.AceFlags &= ~INHERITED_ACE;
} }
else if (uid == ILLEGAL_UID && gid == ILLEGAL_UID else if (uid == ILLEGAL_UID && gid == ILLEGAL_UID
&& ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) && ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE
/* FIXME: Temporary workaround for the problem that chmod does && ace_sid != well_known_creator_group_sid
not affect the group permissions if other users and groups && ace_sid != well_known_creator_owner_sid
in the ACL have more permissions than the primary group due && ace_sid != well_known_world_sid)
to the CLASS_OBJ emulation. The temporary workaround is to {
disallow any secondary ACE in the ACL more permissions than /* FIXME: Temporary workaround for the problem that chmod does
the primary group when writing a new ACL via chmod. */ not affect the group permissions if other users and groups
ace->Mask &= group_allow; in the ACL have more permissions than the primary group due
to the CLASS_OBJ emulation. The temporary workaround is to
disallow any secondary ACE in the ACL more permissions than
the primary group when writing a new ACL via chmod. */
ace->Mask &= group_allow;
}
/* Add unrelated ACCESS_DENIED_ACE to the beginning but behind /* Add unrelated ACCESS_DENIED_ACE to the beginning but behind
the owner_deny, ACCESS_ALLOWED_ACE to the end. FIXME: this the owner_deny, ACCESS_ALLOWED_ACE to the end. FIXME: this
would break the order of the inherit-only ACEs. */ would break the order of the inherit-only ACEs. */