diff options
author | Corinna Vinschen <corinna@vinschen.de> | 2015-02-25 20:18:13 +0300 |
---|---|---|
committer | Corinna Vinschen <corinna@vinschen.de> | 2015-02-25 20:18:13 +0300 |
commit | cc70635c0da7977b36b5dee4904c34f15f118106 (patch) | |
tree | be671b132345b9bd7a70e4ccba0c6f8389d6da8e /winsup/cygwin/security.cc | |
parent | 9d5309bf8911fbfee2270132da8446e81527f2fb (diff) |
* security.cc (alloc_sd): Don't apply temporary workaround for chmod
to DEF_USER_OBJ, DEF_GROUP_OBJ, and DEF_OTHER_OBJ ACEs.
Diffstat (limited to 'winsup/cygwin/security.cc')
-rw-r--r-- | winsup/cygwin/security.cc | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc index 929e8a32e..9c94c7053 100644 --- a/winsup/cygwin/security.cc +++ b/winsup/cygwin/security.cc @@ -777,14 +777,19 @@ alloc_sd (path_conv &pc, uid_t uid, gid_t gid, int attribute, ace->Header.AceFlags &= ~INHERITED_ACE; } else if (uid == ILLEGAL_UID && gid == ILLEGAL_UID - && ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) - /* FIXME: Temporary workaround for the problem that chmod does - not affect the group permissions if other users and groups - in the ACL have more permissions than the primary group due - to the CLASS_OBJ emulation. The temporary workaround is to - disallow any secondary ACE in the ACL more permissions than - the primary group when writing a new ACL via chmod. */ - ace->Mask &= group_allow; + && ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE + && ace_sid != well_known_creator_group_sid + && ace_sid != well_known_creator_owner_sid + && ace_sid != well_known_world_sid) + { + /* FIXME: Temporary workaround for the problem that chmod does + not affect the group permissions if other users and groups + in the ACL have more permissions than the primary group due + to the CLASS_OBJ emulation. The temporary workaround is to + disallow any secondary ACE in the ACL more permissions than + the primary group when writing a new ACL via chmod. */ + ace->Mask &= group_allow; + } /* Add unrelated ACCESS_DENIED_ACE to the beginning but behind the owner_deny, ACCESS_ALLOWED_ACE to the end. FIXME: this would break the order of the inherit-only ACEs. */ |