From owner-freebsd-current@FreeBSD.ORG Mon Nov 3 12:23:55 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C18FB16A4CE for ; Mon, 3 Nov 2003 12:23:55 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id E6D2843FE0 for ; Mon, 3 Nov 2003 12:23:54 -0800 (PST) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.12.9p2/8.12.9) with ESMTP id hA3KMTMg032828; Mon, 3 Nov 2003 15:22:29 -0500 (EST) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)hA3KMSHf032825; Mon, 3 Nov 2003 15:22:28 -0500 (EST) (envelope-from robert@fledge.watson.org) Date: Mon, 3 Nov 2003 15:22:28 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org To: Mark Nipper In-Reply-To: <20031103061758.GA71718@newops.tamu.edu> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: current@freebsd.org Subject: Re: possible NIS/ACL bug? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Nov 2003 20:23:55 -0000 On Mon, 3 Nov 2003, Mark Nipper wrote: > Uh oh! It's that last part where there are the two extra > entries for the two ACL added groups, but no GID seems to have been > stored with each entry, whereas the example in the daemon news article > does actually show GID's in these places. > > So I assume this is an NIS/ACL bug of some kind? Both my uid > and gid as well as both the gid's above (nes and loki) are mapped via > NIS. If anyone needs me to do anything else, let me know. I don't feel > nearly competent enough to start debugging the source for get/setfacl to > try to grok any of this. :) Yes, in 5.1 there was a bug in the libc acl_to_text() code that ommitted the group name when the effective permissions granted by an additional group ACL entry was not the same as the set permissions. This was fixed in src/lib/libc/posix1e/acl_to_text.3:1.11: revision 1.11 date: 2003/07/24 23:33:25; author: rwatson; state: Exp; lines: +3 -2 Print group name in getfacl output when calculating an effective permission set based on a more restrictive mask. Submitted by: Glen Gibb The change has not been merged to RELENG_5_1 as that branch is currently owned by the security-officer team for advisories only. If you pull acl_to_text.3 forward to 1.11 and rebuild libc + getfacl, it should be corrected. The bug will be fixed "out of the box" in 5.2. Thanks! Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Network Associates Laboratories