diff options
| -rw-r--r-- | src/journal/journald-server.c | 6 | ||||
| -rw-r--r-- | src/shared/acl-util.c | 28 | ||||
| -rw-r--r-- | src/shared/acl-util.h | 1 |
3 files changed, 33 insertions, 2 deletions
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index b717b92ffb..da5b725863 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -227,9 +227,11 @@ void server_fix_perms(Server *s, JournalFile *f, uid_t uid) { } } - /* We do not recalculate the mask here, so that the fchmod() mask above stays intact. */ + /* We do not recalculate the mask unconditionally here, + * so that the fchmod() mask above stays intact. */ if (acl_get_permset(entry, &permset) < 0 || - acl_add_perm(permset, ACL_READ) < 0) { + acl_add_perm(permset, ACL_READ) < 0 || + calc_acl_mask_if_needed(&acl) < 0) { log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); goto finish; } diff --git a/src/shared/acl-util.c b/src/shared/acl-util.c index 48bb12f46b..fb04e49dc4 100644 --- a/src/shared/acl-util.c +++ b/src/shared/acl-util.c @@ -69,6 +69,34 @@ int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry) { return 0; } +int calc_acl_mask_if_needed(acl_t *acl_p) { + acl_entry_t i; + int found; + + assert(acl_p); + + for (found = acl_get_entry(*acl_p, ACL_FIRST_ENTRY, &i); + found > 0; + found = acl_get_entry(*acl_p, ACL_NEXT_ENTRY, &i)) { + + acl_tag_t tag; + + if (acl_get_tag_type(i, &tag) < 0) + return -errno; + + if (tag == ACL_MASK) + return 0; + } + + if (found < 0) + return -errno; + + if (acl_calc_mask(acl_p) < 0) + return -errno; + + return 0; +} + int search_acl_groups(char*** dst, const char* path, bool* belong) { acl_t acl; diff --git a/src/shared/acl-util.h b/src/shared/acl-util.h index 23090d9984..36ef490d7e 100644 --- a/src/shared/acl-util.h +++ b/src/shared/acl-util.h @@ -24,4 +24,5 @@ #include <stdbool.h> int acl_find_uid(acl_t acl, uid_t uid, acl_entry_t *entry); +int calc_acl_mask_if_needed(acl_t *acl_p); int search_acl_groups(char*** dst, const char* path, bool* belong); |