systemd / casync

Content-Addressable Data Synchronization Tool
1.51k stars 117 forks source link

setuid/setgid mode bits not always retained #235

Closed srd424 closed 4 years ago

srd424 commented 4 years ago

Setuid/setgid bits are not always retained on extract. I notice this most obviously when moving Ubuntu containers around, in /sbin pam_extrausers_chkpwd and unix_chkpwd should be setgid. They get created correctly, but then reset:

15841 openat(7, ".#unix_chkpwdf53ffc41b6fa1c73", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC, 0102755) = 8
15841 ioctl(8, FS_IOC_GETFLAGS, 0x7fff18156ca4) = 0
15841 write(8, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0Y\26\0\0004\0\0\0"..., 21928) = 21928
15841 fstat(8, {st_mode=S_IFREG|S_ISGID|0755, st_size=21928, ...}) = 0
15841 fchown(8, 0, 42)                  = 0
15841 fgetxattr(8, "security.capability", 0x7fff18156b68, 1) = -1 ENODATA (No data available)
15841 fgetxattr(8, "security.selinux", 0x55f3b4f42920, 255) = -1 ENODATA (No data available)
15841 utimensat(8, NULL, [UTIME_OMIT, {tv_sec=1551277610, tv_nsec=0} /* 2019-02-27T14:26:50+0000 */], 0) = 0
15841 renameat(7, ".#unix_chkpwdf53ffc41b6fa1c73", 7, "unix_chkpwd") = 0
15841 ioctl(8, FS_IOC_GETFLAGS, 0x7fff18156ad4) = 0
15841 fstat(8, {st_mode=S_IFREG|0755, st_size=21928, ...}) = 0
15841 close(8)                          = 0

fchown(2) behaviour on Linux seems to be responsible, per man page:

When the owner or group of an executable file is changed by an unprivileged user, the S_ISUID and S_ISGID mode bits are cleared. POSIX does not specify whether this also should happen when root does the chown(); the Linux behavior depends on the kernel version, and since Linux 2.2.13, root is treated like other users.

ca_decoder_finalize_child performs the fchown(), so probably needs to reset the mode again afterwards...

Slightly baffled how this one has slipped through the net for so long?

srd424 commented 4 years ago

Attached should do the trick (sorry, I'm a dinosaur who doesn't do git..)

casync-stat.diff.txt

srd424 commented 4 years ago

OK, I think I've managed to do a PR. I feel a bit like a T. Rex trying to fly an A380..