From owner-cvs-all  Mon Apr 16 21:33:43 2001
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0C40837B43C; Mon, 16 Apr 2001 21:33:35 -0700 (PDT)
	(envelope-from rwatson@FreeBSD.org)
Received: (from rwatson@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f3H4XYr08339;
	Mon, 16 Apr 2001 21:33:34 -0700 (PDT)
	(envelope-from rwatson)
Message-Id: <200104170433.f3H4XYr08339@freefall.freebsd.org>
From: Robert Watson <rwatson@FreeBSD.org>
Date: Mon, 16 Apr 2001 21:33:34 -0700 (PDT)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/sys vnode.h src/sys/kern kern_acl.c
         src/sys/ufs/ufs ufs_acl.c ufs_vnops.c
X-FreeBSD-CVS-Branch: HEAD
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

rwatson     2001/04/16 21:33:34 PDT

  Modified files:
    sys/sys              vnode.h 
    sys/kern             kern_acl.c 
    sys/ufs/ufs          ufs_acl.c ufs_vnops.c 
  Log:
  In my first reading of POSIX.1e, I misinterpreted handling of the
  ACL_USER_OBJ and ACL_GROUP_OBJ fields, believing that modification of the
  access ACL could be used by privileged processes to change file/directory
  ownership.  In fact, this is incorrect; ACL_*_OBJ (+ ACL_MASK and
  ACL_OTHER) should have undefined ae_id fields; this commit attempts
  to correct that misunderstanding.
  
  o Modify arguments to vaccess_acl_posix1e() to accept the uid and gid
    associated with the vnode, as those can no longer be extracted from
    the ACL passed as an argument.  Perform all comparisons against
    the passed arguments.  This actually has the effect of simplifying
    a number of components of this call, as well as reducing the indent
    level, but now seperates handling of ACL_GROUP_OBJ from ACL_GROUP.
  
  o Modify acl_posix1e_check() to return EINVAL if the ae_id field of
    any of the ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} entries is a value
    other than ACL_UNDEFINED_ID.  As a temporary work-around to allow
    clean upgrades, set the ae_id field to ACL_UNDEFINED_ID before
    each check so that this cannot cause a failure in the short term
    (this work-around will be removed when the userland libraries and
    utilities are updated to take this change into account).
  
  o Modify ufs_sync_acl_from_inode() so that it forces
    ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} ae_id fields to ACL_UNDEFINED_ID
    when synchronizing the ACL from the inode.
  
  o Modify ufs_sync_inode_from_acl to not propagate uid and gid
    information to the inode from the ACL during ACL update.  Also
    modify the masking of permission bits that may be set from
    ALLPERMS to (S_IRWXU|S_IRWXG|S_IRWXO), as ACLs currently do not
    carry none-ACCESSPERMS (S_ISUID, S_ISGID, S_ISTXT).
  
  o Modify ufs_getacl() so that when it emulates an access ACL from
    the inode, it initializes the ae_id fields to ACL_UNDEFINED_ID.
  
  o Clean up ufs_setacl() substantially since it is no longer possible
    to perform chown/chgrp operations using vop_setacl(), so all the
    access control for that can be eliminated.
  
  o Modify ufs_access() so that it passes owner uid and gid information
    into vaccess_acl_posix1e().
  
  Pointed out by:	jedger
  Obtained from:	TrustedBSD Project
  
  Revision  Changes    Path
  1.143     +4 -3      src/sys/sys/vnode.h
  1.10      +100 -46   src/sys/kern/kern_acl.c
  1.3       +11 -87    src/sys/ufs/ufs/ufs_acl.c
  1.161     +3 -3      src/sys/ufs/ufs/ufs_vnops.c


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message