From 7f20c71497ec7c78c6d2572a0d7075f78b14548a Mon Sep 17 00:00:00 2001 From: "Jan Alexander Steffens (heftig)" Date: Tue, 28 May 2013 20:45:34 +0200 Subject: [PATCH 4/8] journald: DO recalculate the ACL mask, but only if it doesn't exist Since 11ec7ce, journald isn't setting the ACLs properly anymore if the files had no ACLs to begin with: acl_set_fd fails with EINVAL. An ACL with ACL_USER or ACL_GROUP entries but no ACL_MASK entry is invalid, so make sure a mask exists before trying to set the ACL. --- src/journal/journald-server.c | 6 ++++-- src/shared/acl-util.c | 28 ++++++++++++++++++++++++++++ src/shared/acl-util.h | 1 + 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index cc52b8a..01f23ce 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -227,9 +227,11 @@ void server_fix_perms(Server *s, JournalFile *f, uid_t uid) { } } - /* We do not recalculate the mask here, so that the fchmod() mask above stays intact. */ + /* We do not recalculate the mask unconditionally here, + * so that the fchmod() mask above stays intact. */ if (acl_get_permset(entry, &permset) < 0 || - acl_add_perm(permset, ACL_READ) < 0) { + acl_add_perm(permset, ACL_READ) < 0 || + calc_acl_mask_if_needed(&acl) < 0) { log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); goto finish; } diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c index 48bb12f..fb04e49 100644 --- a/src/shared/acl-util.c +++ b/src/shared/acl-util.c @@ -69,6 +69,34 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) { return 0; } +int calc_acl_mask_if_needed(acl_t *acl_p) { + acl_entry_t i; + int found; + + assert(acl_p); + + for (found = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i); + found > 0; + found = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) { + + acl_tag_t tag; + + if (acl_get_tag_type(i, &tag) < 0) + return -errno; + + if (tag == ACL_MASK) + return 0; + } + + if (found < 0) + return -errno; + + if (acl_calc_mask(acl_p) < 0) + return -errno; + + return 0; +} + int search_acl_groups(char*** dst, const char* path, bool* belong) { acl_t acl; diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h index 23090d9..36ef490 100644 --- a/src/shared/acl-util.h +++ b/src/shared/acl-util.h @@ -24,4 +24,5 @@ #include int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry); +int calc_acl_mask_if_needed(acl_t *acl_p); int search_acl_groups(char*** dst, const char* path, bool* belong); -- 1.8.1.4