tmpfiles: apply chown, chmod for 'Z' entries too

If changing ownership or permissions is not desired, they can be
configured to '-' or omitted entirely.

3 files changed, 40 insertions, 34 deletions

diff --git a/man/systemd-tmpfiles.xml b/man/systemd-tmpfiles.xml
index 20e399bfd4..74dfd5ac7e 100644
--- a/man/systemd-tmpfiles.xml
+++ b/man/systemd-tmpfiles.xml
@@ -85,7 +85,8 @@
                                 files and directories marked with f,
                                 F, d, D in the configuration files are
                                 created. Files and directories marked with Z
-                                are relabeled.</para></listitem>
+                                have their ownership, access mode and security
+                                labels set.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml
index 6a2a3774ae..e137967654 100644
--- a/man/tmpfiles.d.xml
+++ b/man/tmpfiles.d.xml
@@ -158,8 +158,9 @@ d    /run/user 0755 root root 10d</programlisting>
 
                                 <varlistentry>
                                         <term><varname>Z</varname></term>
-                                        <listitem><para>Recursively
-                                        relabel security context of a path and
+                                        <listitem><para>Recursively set
+                                        ownership, access mode and relabel
+                                        security context of a path and
                                         all its subdirectories (if it is a
                                         directory). Lines of this type accept
                                         shell-style globs in place of normal
@@ -174,8 +175,10 @@ d    /run/user 0755 root root 10d</programlisting>
                         <para>The file access mode to use when
                         creating this file or directory. If omitted or
                         when set to - the default is used: 0755 for
-                        directories, 0644 for files. This parameter is
-                        ignored for x, r, R, Z lines.</para>
+                        directories, 0644 for files. For Z lines
+                        if omitted or when set to - the file access mode will
+                        not be modified. This parameter is ignored for x, r, R
+                        lines.</para>
                 </refsect2>
 
                 <refsect2>
@@ -185,8 +188,9 @@ d    /run/user 0755 root root 10d</programlisting>
                         or directory. This may either be a numeric
                         user/group ID or a user or group name. If
                         omitted or when set to - the default 0 (root)
-                        is used. . These parameters are ignored for x,
-                        r, R, Z lines.</para>
+                        is used. For Z lines when omitted or when set to -
+                        the file ownership will not be modified.
+                        These parameters are ignored for x, r, R lines.</para>
                 </refsect2>
 
                 <refsect2>
diff --git a/src/tmpfiles.c b/src/tmpfiles.c
index 18067c4b1f..13950824e0 100644
--- a/src/tmpfiles.c
+++ b/src/tmpfiles.c
@@ -406,7 +406,27 @@ finish:
         return r;
 }
 
-static int recursive_relabel_children(const char *path) {
+static int item_set_perms(Item *i, const char *path) {
+        /* not using i->path directly because it may be a glob */
+        if (i->mode_set)
+                if (chmod(path, i->mode) < 0) {
+                        log_error("chmod(%s) failed: %m", path);
+                        return -errno;
+                }
+
+        if (i->uid_set || i->gid_set)
+                if (chown(path,
+                          i->uid_set ? i->uid : (uid_t) -1,
+                          i->gid_set ? i->gid : (gid_t) -1) < 0) {
+
+                        log_error("chown(%s) failed: %m", path);
+                        return -errno;
+                }
+
+        return label_fix(path, false);
+}
+
+static int recursive_relabel_children(Item *i, const char *path) {
         DIR *d;
         int ret = 0;
 
@@ -457,7 +477,7 @@ static int recursive_relabel_children(const char *path) {
                 } else
                         is_dir = de->d_type == DT_DIR;
 
-                r = label_fix(entry_path, false);
+                r = item_set_perms(i, entry_path);
                 if (r < 0) {
                         if (ret == 0 && r != -ENOENT)
                                 ret = r;
@@ -466,7 +486,7 @@ static int recursive_relabel_children(const char *path) {
                 }
 
                 if (is_dir) {
-                        r = recursive_relabel_children(entry_path);
+                        r = recursive_relabel_children(i, entry_path);
                         if (r < 0 && ret == 0)
                                 ret = r;
                 }
@@ -483,7 +503,7 @@ static int recursive_relabel(Item *i, const char *path) {
         int r;
         struct stat st;
 
-        r = label_fix(path, false);
+        r = item_set_perms(i, path);
         if (r < 0)
                 return r;
 
@@ -491,7 +511,7 @@ static int recursive_relabel(Item *i, const char *path) {
                 return -errno;
 
         if (S_ISDIR(st.st_mode))
-                r = recursive_relabel_children(path);
+                r = recursive_relabel_children(i, path);
 
         return r;
 }
@@ -523,25 +543,6 @@ static int glob_item(Item *i, int (*action)(Item *, const char *)) {
         return r;
 }
 
-static int item_set_perms(Item *i) {
-        if (i->mode_set)
-                if (chmod(i->path, i->mode) < 0) {
-                        log_error("chmod(%s) failed: %m", i->path);
-                        return -errno;
-                }
-
-        if (i->uid_set || i->gid_set)
-                if (chown(i->path,
-                          i->uid_set ? i->uid : (uid_t) -1,
-                          i->gid_set ? i->gid : (gid_t) -1) < 0) {
-
-                        log_error("chown(%s) failed: %m", i->path);
-                        return -errno;
-                }
-
-        return label_fix(i->path, false);
-}
-
 static int create_item(Item *i) {
         int r;
         mode_t u;
@@ -582,7 +583,7 @@ static int create_item(Item *i) {
                         return -EEXIST;
                 }
 
-                r = item_set_perms(i);
+                r = item_set_perms(i, i->path);
                 if (r < 0)
                         return r;
 
@@ -612,7 +613,7 @@ static int create_item(Item *i) {
                         return -EEXIST;
                 }
 
-                r = item_set_perms(i);
+                r = item_set_perms(i, i->path);
                 if (r < 0)
                         return r;
 
@@ -639,7 +640,7 @@ static int create_item(Item *i) {
                         return -EEXIST;
                 }
 
-                r = item_set_perms(i);
+                r = item_set_perms(i, i->path);
                 if (r < 0)
                         return r;