rpms
/
acl
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

new upstream release: acl-2.2.50

This commit is contained in:
Kamil Dudka 2011-04-19 09:41:47 +02:00
parent 6fe61386fa
commit 05710cfe1c
11 changed files with 21 additions and 3832 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1 +1,2 @@
acl-2.2.49.src.tar.gz
/acl-2.2.50.src.tar.gz

3280
acl-2.2.39-nfsv4.patch
View File

File diff suppressed because it is too large Load Diff

90
acl-2.2.49-bz467936.patch
View File

@ -1,90 +0,0 @@
From 16230023e5afcb0b42b8d01207e3449d22772c31 Mon Sep 17 00:00:00 2001
From: Brandon Philips <brandon@ifup.org>
Date: Thu, 17 Dec 2009 14:28:04 -0800
Subject: [PATCH] setfacl: changing owner and when S_ISUID should be set --restore fix
Fix a problem in setfacl --restore when the owner or group is changed
and the S_ISUID and S_ISGID are to be set.
The root of the problem is that chown() can clear the S_ISUID and
S_ISGID bits as described in chown(2):
When the owner or group of an executable file are changed by a
non- superuser, the S_ISUID and S_ISGID mode bits are cleared. POSIX
does not specify whether this also should happen when root does the
chown(); the Linux behavior depends on the kernel version. In case of
a non- group-executable file (i.e., one for which the S_IXGRP bit is
not set) the S_ISGID bit indicates mandatory locking, and is not
cleared by a chown().
To fix the issue re-stat() the file after chown() so that the logic
surrounding the chmod() has the updated mode of the file.
Signed-off-by: Brandon Philips <bphilips@suse.de>
---
setfacl/setfacl.c | 8 +++++++-
test/root/restore.test | 23 +++++++++++++++++++++++
2 files changed, 30 insertions(+), 1 deletions(-)
create mode 100644 test/root/restore.test
diff --git a/setfacl/setfacl.c b/setfacl/setfacl.c
index 091b9cc..56b0aa4 100644
--- a/setfacl/setfacl.c
+++ b/setfacl/setfacl.c
@@ -128,6 +128,7 @@ restore(
struct do_set_args args;
int line = 0, backup_line;
int error, status = 0;
+ int chmod_required = 0;
memset(&st, 0, sizeof(st));
@@ -206,10 +207,15 @@ restore(
strerror(errno));
status = 1;
}
+
+ /* chown() clears setuid/setgid so force a chmod if
+ * S_ISUID/S_ISGID was expected */
+ if ((st.st_mode & flags) & (S_ISUID | S_ISGID))
+ chmod_required = 1;
}
mask = S_ISUID | S_ISGID | S_ISVTX;
- if ((st.st_mode & mask) != (flags & mask)) {
+ if (chmod_required || ((st.st_mode & mask) != (flags & mask))) {
if (!args.mode)
args.mode = st.st_mode;
args.mode &= (S_IRWXU | S_IRWXG | S_IRWXO);
diff --git a/test/root/restore.test b/test/root/restore.test
new file mode 100644
index 0000000..6003cd4
--- /dev/null
+++ b/test/root/restore.test
@@ -0,0 +1,23 @@
+Ensure setuid bit is restored when the owner changes
+ https://bugzilla.redhat.com/show_bug.cgi?id=467936#c7
+
+ $ touch passwd
+ $ chmod 755 passwd
+ $ chmod u+s passwd
+ $ getfacl passwd > passwd.acl
+ $ cat passwd.acl
+ > # file: passwd
+ > # owner: root
+ > # group: root
+ > # flags: s--
+ > user::rwx
+ > group::r-x
+ > other::r-x
+ >
+ $ chown bin passwd
+ $ chmod u+s passwd
+ $ setfacl --restore passwd.acl
+ $ ls -dl passwd | awk '{print $1 " " $3 " " $4}'
+ > -rwsr-xr-x root root
+
+ $ rm passwd passwd.acl
--
1.6.2.5

13
acl-2.2.49-bz675451.patch
View File

@ -1,19 +1,10 @@
man/man1/setfacl.1 | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
man/man1/setfacl.1 | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/man/man1/setfacl.1 b/man/man1/setfacl.1
index 25908e2..776f22d 100644
--- a/man/man1/setfacl.1
+++ b/man/man1/setfacl.1
@@ -62,7 +62,7 @@ ACL entries for this operation must include permissions.
The
.IR "\-x (\-\-remove)" " and " "\-X (\-\-remove-file)"
-options remove ACL enries. Only
+options remove ACL entries. Only
ACL entries without the
.I perms
field are accepted as parameters, unless POSIXLY_CORRECT is defined.
@@ -240,8 +240,8 @@ owner, owning group, or others entry, a copy of the ACL owner, owning group, or
.IP * 4
If a Default ACL contains named user entries or named group entries, and no mask entry exists, a mask entry containing the same permissions as the default Default ACL's group entry is added. Unless the

375
acl-2.2.49-bz692982.patch
View File

@ -1,375 +0,0 @@
From 6bf5e24d48077db58b389e90558100fc121b8134 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Mon, 4 Apr 2011 12:43:39 +0200
Subject: [PATCH 1/2] libacl: Add acl_extended_file_nofollow()
This function calls lgetxattr() instead of getxattr(), which helps ls(1)
to prevent unnecessary automatic mounts, which acl_extended_file()
triggers. See the following bug report for more details:
https://bugzilla.redhat.com/692982
---
exports | 1 +
include/libacl.h | 1 +
libacl/Makefile | 3 +-
libacl/__acl_extended_file.c | 49 +++++++++++++++++++++++++++++++++++
libacl/__acl_extended_file.h | 4 +++
libacl/acl_extended_file.c | 20 ++------------
libacl/acl_extended_file_nofollow.c | 34 ++++++++++++++++++++++++
man/man3/acl_extended_file.3 | 11 +++++++-
man/man5/acl.5 | 1 +
9 files changed, 105 insertions(+), 19 deletions(-)
create mode 100644 libacl/__acl_extended_file.c
create mode 100644 libacl/__acl_extended_file.h
create mode 100644 libacl/acl_extended_file_nofollow.c
diff --git a/exports b/exports
index ef02842..b368c22 100644
--- a/exports
+++ b/exports
@@ -82,4 +82,5 @@ ACL_1.1 {
# Linux specific extensions
perm_copy_fd;
perm_copy_file;
+ acl_extended_file_nofollow;
} ACL_1.0;
diff --git a/include/libacl.h b/include/libacl.h
index 41ec48e..d6a6650 100644
--- a/include/libacl.h
+++ b/include/libacl.h
@@ -59,6 +59,7 @@ extern int acl_check(acl_t acl, int *last);
extern acl_t acl_from_mode(mode_t mode);
extern int acl_equiv_mode(acl_t acl, mode_t *mode_p);
int acl_extended_file(const char *path_p);
+int acl_extended_file_nofollow(const char *path_p);
int acl_extended_fd(int fd);
extern int acl_entries(acl_t acl);
extern const char *acl_error(int code);
diff --git a/libacl/Makefile b/libacl/Makefile
index 1224b65..cfe3d3a 100644
--- a/libacl/Makefile
+++ b/libacl/Makefile
@@ -47,7 +47,8 @@ POSIX_CFILES = \
LIBACL_CFILES = \
acl_to_any_text.c acl_entries.c acl_check.c acl_error.c acl_cmp.c \
- acl_extended_fd.c acl_extended_file.c acl_equiv_mode.c acl_from_mode.c
+ acl_extended_fd.c acl_extended_file.c acl_equiv_mode.c acl_from_mode.c \
+ acl_extended_file_nofollow.c __acl_extended_file.c
INTERNAL_CFILES = \
__acl_to_any_text.c __acl_to_xattr.c __acl_from_xattr.c \
diff --git a/libacl/__acl_extended_file.c b/libacl/__acl_extended_file.c
new file mode 100644
index 0000000..629afe9
--- /dev/null
+++ b/libacl/__acl_extended_file.c
@@ -0,0 +1,49 @@
+/*
+ File: acl_extended_file.c
+
+ Copyright (C) 2000, 2011
+ Andreas Gruenbacher, <a.gruenbacher@bestbits.at>
+
+ This program is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with this library; if not, write to the Free Software
+ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+*/
+
+#include <unistd.h>
+#include <attr/xattr.h>
+#include "libacl.h"
+
+#include "byteorder.h"
+#include "acl_ea.h"
+#include "__acl_extended_file.h"
+
+
+int
+__acl_extended_file(const char *path_p, getxattr_t fun)
+{
+ int base_size = sizeof(acl_ea_header) + 3 * sizeof(acl_ea_entry);
+ int retval;
+
+ retval = fun(path_p, ACL_EA_ACCESS, NULL, 0);
+ if (retval < 0 && errno != ENOATTR && errno != ENODATA)
+ return -1;
+ if (retval > base_size)
+ return 1;
+ retval = fun(path_p, ACL_EA_DEFAULT, NULL, 0);
+ if (retval < 0 && errno != ENOATTR && errno != ENODATA)
+ return -1;
+ if (retval >= base_size)
+ return 1;
+ return 0;
+}
+
diff --git a/libacl/__acl_extended_file.h b/libacl/__acl_extended_file.h
new file mode 100644
index 0000000..f8881a1
--- /dev/null
+++ b/libacl/__acl_extended_file.h
@@ -0,0 +1,4 @@
+typedef ssize_t (*getxattr_t)(const char *, const char *, void *value,
+ size_t size);
+
+int __acl_extended_file(const char *path_p, getxattr_t fun);
diff --git a/libacl/acl_extended_file.c b/libacl/acl_extended_file.c
index d1cb85d..f417784 100644
--- a/libacl/acl_extended_file.c
+++ b/libacl/acl_extended_file.c
@@ -1,7 +1,7 @@
/*
File: acl_extended_file.c
- Copyright (C) 2000
+ Copyright (C) 2011
Andreas Gruenbacher, <a.gruenbacher@bestbits.at>
This program is free software; you can redistribute it and/or
@@ -23,26 +23,12 @@
#include <attr/xattr.h>
#include "libacl.h"
-#include "byteorder.h"
-#include "acl_ea.h"
+#include "__acl_extended_file.h"
int
acl_extended_file(const char *path_p)
{
- int base_size = sizeof(acl_ea_header) + 3 * sizeof(acl_ea_entry);
- int retval;
-
- retval = getxattr(path_p, ACL_EA_ACCESS, NULL, 0);
- if (retval < 0 && errno != ENOATTR && errno != ENODATA)
- return -1;
- if (retval > base_size)
- return 1;
- retval = getxattr(path_p, ACL_EA_DEFAULT, NULL, 0);
- if (retval < 0 && errno != ENOATTR && errno != ENODATA)
- return -1;
- if (retval >= base_size)
- return 1;
- return 0;
+ return __acl_extended_file(path_p, getxattr);
}
diff --git a/libacl/acl_extended_file_nofollow.c b/libacl/acl_extended_file_nofollow.c
new file mode 100644
index 0000000..8f4711f
--- /dev/null
+++ b/libacl/acl_extended_file_nofollow.c
@@ -0,0 +1,34 @@
+/*
+ File: acl_extended_file.c
+
+ Copyright (C) 2011
+ Andreas Gruenbacher, <a.gruenbacher@bestbits.at>
+
+ This program is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with this library; if not, write to the Free Software
+ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+*/
+
+#include <unistd.h>
+#include <attr/xattr.h>
+#include "libacl.h"
+
+#include "__acl_extended_file.h"
+
+
+int
+acl_extended_file_nofollow(const char *path_p)
+{
+ return __acl_extended_file(path_p, lgetxattr);
+}
+
diff --git a/man/man3/acl_extended_file.3 b/man/man3/acl_extended_file.3
index 0ca7e0f..1f04331 100644
--- a/man/man3/acl_extended_file.3
+++ b/man/man3/acl_extended_file.3
@@ -25,7 +25,7 @@
.Dt ACL_EXTENDED_FILE 3
.Os "Linux ACL"
.Sh NAME
-.Nm acl_extended_file
+.Nm acl_extended_file, acl_extended_file_nofollow
.Nd test for information in ACLs by file name
.Sh LIBRARY
Linux Access Control Lists library (libacl, \-lacl).
@@ -34,6 +34,8 @@ Linux Access Control Lists library (libacl, \-lacl).
.In acl/libacl.h
.Ft int
.Fn acl_extended_file "const char *path_p"
+.Ft int
+.Fn acl_extended_file_nofollow "const char *path_p"
.Sh DESCRIPTION
The
.Fn acl_extended_file
@@ -61,6 +63,13 @@ mechanisms, such as Mandatory Access Control schemes. The
.Xr access 2
system call can be used to check whether a given type of access to a file
object would be granted.
+.Pp
+.Fn acl_extended_file_nofollow
+is identical to
+.Fn acl_extended_file ,
+except in the case of a symbolic link, where the link itself is interrogated,
+not the file that it refers to. Since symbolic links have no ACL themselves,
+the operation is supposed to fail on them.
.Sh RETURN VALUE
If successful, the
.Fn acl_extended_file
diff --git a/man/man5/acl.5 b/man/man5/acl.5
index 6b0f468..aec58aa 100644
--- a/man/man5/acl.5
+++ b/man/man5/acl.5
@@ -497,6 +497,7 @@ These non-portable extensions are available on Linux systems.
.Xr acl_error 3 ,
.Xr acl_extended_fd 3 ,
.Xr acl_extended_file 3 ,
+.Xr acl_extended_file_nofollow 3 ,
.Xr acl_from_mode 3 ,
.Xr acl_get_perm 3 ,
.Xr acl_to_any_text 3
--
1.7.4
From ad4ca5aaee96e98b2e8e8a4351fa5e6c58d65216 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruen@linbit.com>
Date: Mon, 4 Apr 2011 17:18:38 +0200
Subject: [PATCH 2/2] Minor fixes to the previous commit
* Assign the new libacl version ACL_1.2 to acl_extended_file_nofollow
so that package managers will end up with the appropriate
dependencies.
* Add a manpage entry for acl_extended_file_nofollow which sources
("links to") the acl_extended_file manpage.
* Remove the prototype for getxattr/lgetxattr.
* Whitespace cleanups.
---
exports | 7 ++++++-
libacl/__acl_extended_file.c | 7 ++++---
libacl/__acl_extended_file.h | 7 +++----
libacl/acl_extended_file_nofollow.c | 3 +--
man/man3/acl_extended_file.3 | 2 +-
man/man3/acl_extended_file_nofollow.3 | 1 +
6 files changed, 16 insertions(+), 11 deletions(-)
create mode 100644 man/man3/acl_extended_file_nofollow.3
diff --git a/exports b/exports
index b368c22..7d8e69e 100644
--- a/exports
+++ b/exports
@@ -82,5 +82,10 @@ ACL_1.1 {
# Linux specific extensions
perm_copy_fd;
perm_copy_file;
- acl_extended_file_nofollow;
} ACL_1.0;
+
+ACL_1.2 {
+ global:
+ # Linux specific extensions
+ acl_extended_file_nofollow;
+} ACL_1.1;
diff --git a/libacl/__acl_extended_file.c b/libacl/__acl_extended_file.c
index 629afe9..3e45abd 100644
--- a/libacl/__acl_extended_file.c
+++ b/libacl/__acl_extended_file.c
@@ -1,5 +1,5 @@
/*
- File: acl_extended_file.c
+ File: __acl_extended_file.c
Copyright (C) 2000, 2011
Andreas Gruenbacher, <a.gruenbacher@bestbits.at>
@@ -29,7 +29,9 @@
int
-__acl_extended_file(const char *path_p, getxattr_t fun)
+__acl_extended_file(const char *path_p,
+ ssize_t (*fun)(const char *, const char *,
+ void *, size_t))
{
int base_size = sizeof(acl_ea_header) + 3 * sizeof(acl_ea_entry);
int retval;
@@ -46,4 +48,3 @@ __acl_extended_file(const char *path_p, getxattr_t fun)
return 1;
return 0;
}
-
diff --git a/libacl/__acl_extended_file.h b/libacl/__acl_extended_file.h
index f8881a1..0b0da9e 100644
--- a/libacl/__acl_extended_file.h
+++ b/libacl/__acl_extended_file.h
@@ -1,4 +1,3 @@
-typedef ssize_t (*getxattr_t)(const char *, const char *, void *value,
- size_t size);
-
-int __acl_extended_file(const char *path_p, getxattr_t fun);
+int __acl_extended_file(const char *path_p,
+ ssize_t (*)(const char *, const char *,
+ void *, size_t));
diff --git a/libacl/acl_extended_file_nofollow.c b/libacl/acl_extended_file_nofollow.c
index 8f4711f..c253e4d 100644
--- a/libacl/acl_extended_file_nofollow.c
+++ b/libacl/acl_extended_file_nofollow.c
@@ -1,5 +1,5 @@
/*
- File: acl_extended_file.c
+ File: acl_extended_file_nofollow.c
Copyright (C) 2011
Andreas Gruenbacher, <a.gruenbacher@bestbits.at>
@@ -31,4 +31,3 @@ acl_extended_file_nofollow(const char *path_p)
{
return __acl_extended_file(path_p, lgetxattr);
}
-
diff --git a/man/man3/acl_extended_file.3 b/man/man3/acl_extended_file.3
index 1f04331..fdeef86 100644
--- a/man/man3/acl_extended_file.3
+++ b/man/man3/acl_extended_file.3
@@ -65,7 +65,7 @@ system call can be used to check whether a given type of access to a file
object would be granted.
.Pp
.Fn acl_extended_file_nofollow
-is identical to
+is identical to
.Fn acl_extended_file ,
except in the case of a symbolic link, where the link itself is interrogated,
not the file that it refers to. Since symbolic links have no ACL themselves,
diff --git a/man/man3/acl_extended_file_nofollow.3 b/man/man3/acl_extended_file_nofollow.3
new file mode 100644
index 0000000..44fc24f
--- /dev/null
+++ b/man/man3/acl_extended_file_nofollow.3
@@ -0,0 +1 @@
+.so man3/acl_extended_file.3
--
1.7.4

27
acl-2.2.49-setfacl-restore.patch
View File

@ -1,27 +0,0 @@
diff --git a/setfacl/setfacl.c b/setfacl/setfacl.c
index 7142af0..23784a7 100644
--- a/setfacl/setfacl.c
+++ b/setfacl/setfacl.c
@@ -125,7 +125,7 @@ restore(
uid_t uid;
gid_t gid;
mode_t mask, flags;
- struct do_set_args args;
+ struct do_set_args args = { 0 };
int line = 0, backup_line;
int error, status = 0;
int chmod_required = 0;
diff --git a/test/misc.test b/test/misc.test
index e6140da..a910bd0 100644
--- a/test/misc.test
+++ b/test/misc.test
@@ -424,3 +424,9 @@ Now, chmod should change the group_obj entry
>
$ rmdir d
+
+Malformed restore file
+
+ $ echo "# owner: root" > f
+ $ setfacl --restore=f 2>&1
+ >setfacl: f: No filename found in line 0, aborting

30
acl-2.2.49-setfacl-walk.patch
View File

@ -1,30 +0,0 @@
diff --git a/setfacl/setfacl.c b/setfacl/setfacl.c
index 091b9cc..be34e69 100644
--- a/setfacl/setfacl.c
+++ b/setfacl/setfacl.c
@@ -76,7 +76,7 @@ struct option long_options[] = {
const char *progname;
const char *cmd_line_options, *cmd_line_spec;
-int walk_flags = WALK_TREE_DEREFERENCE;
+int walk_flags = WALK_TREE_DEREFERENCE_TOPLEVEL;
int opt_recalculate; /* recalculate mask entry (0=default, 1=yes, -1=no) */
int opt_promote; /* promote access ACL to default ACL */
int opt_test; /* do not write to the file system.
@@ -580,13 +580,14 @@ int main(int argc, char *argv[])
break;
case 'L': /* follow symlinks */
- walk_flags |= WALK_TREE_LOGICAL;
+ walk_flags |= WALK_TREE_LOGICAL | WALK_TREE_DEREFERENCE;
walk_flags &= ~WALK_TREE_PHYSICAL;
break;
case 'P': /* do not follow symlinks */
walk_flags |= WALK_TREE_PHYSICAL;
- walk_flags &= ~WALK_TREE_LOGICAL;
+ walk_flags &= ~(WALK_TREE_LOGICAL | WALK_TREE_DEREFERENCE |
+ WALK_TREE_DEREFERENCE_TOPLEVEL);
break;
case 't': /* test mode */

BIN
acl-2.2.50.src.tar.gz.sig Normal file
View File

Binary file not shown.

27
acl.spec
View File

@ -1,7 +1,7 @@
Summary: Access control list utilities
Name: acl
Version: 2.2.49
Release: 11%{?dist}
Version: 2.2.50
Release: 1%{?dist}
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: gawk
BuildRequires: gettext
@ -9,26 +9,15 @@ BuildRequires: libattr-devel
BuildRequires: libtool
Requires: libacl = %{version}-%{release}
Source: http://download.savannah.gnu.org/releases-noredirect/acl/acl-%{version}.src.tar.gz
Source2: malformed-restore-double-owner.acl
Patch1: acl-2.2.39-build.patch
# bz #488674
Patch2: acl-2.2.49-setfacl-walk.patch
# bz #467936
Patch3: acl-2.2.49-bz467936.patch
# prepare the test-suite for SELinux and arbitrary umask
Patch4: acl-2.2.49-tests.patch
# bz #576550
Patch5: acl-2.2.49-setfacl-restore.patch
# fix typos in setfacl(1) man page (#675451)
Patch6: acl-2.2.49-bz675451.patch
# add function acl_extended_file_nofollow() (#692982)
Patch7: acl-2.2.49-bz692982.patch
License: GPLv2+
Group: System Environment/Base
URL: http://oss.sgi.com/projects/xfs/
@ -63,12 +52,11 @@ defined in POSIX 1003.1e draft standard 17.
%prep
%setup -q
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
# part of the test-suite not packaged upstream
install -m0644 %{SOURCE2} test/
%build
touch .census
@ -142,6 +130,9 @@ rm -rf $RPM_BUILD_ROOT
/%{_lib}/libacl.so.*
%changelog
* Tue Apr 19 2011 Kamil Dudka <kdudka@redhat.com> 2.2.50-1
- new upstream release
* Wed Apr 06 2011 Kamil Dudka <kdudka@redhat.com> 2.2.49-11
- add function acl_extended_file_nofollow() (#692982)

8
malformed-restore-double-owner.acl Normal file
View File

@ -0,0 +1,8 @@
# file: tmp
# owner: USER
# owner: USER
# group: GROUP
user::rwx
group::rwx
other::rwx

2
sources
View File

@ -1 +1 @@
181445894cca986da9ae0099d5ce2d08 acl-2.2.49.src.tar.gz
4917495f155260c552d9fcff63769a98 acl-2.2.50.src.tar.gz