Re: getfacl doesn't show setuid/setgid/sticky bits (fwd)

Hello,

we *could* add an additional comments line specifying the suid, sgid, and 
sticky bits for those files that have any special bits set:

  # file: suid-root
  # owner: root
  # group: root
  # mode: u--		(out of [-u][-g][-o], for example)
  user::rwx
  group::r-x
  other::r-x

the draft 17 standard would allow to add implementation-defined permissions 
after the three permissions already shown so that we could also add the 
special bits to the respective acl entries, but those are not really 
discretionary access permissions, and so this is not entirely following the 
specification. Also this would make us incompatible with all other 
implementations, which I wouldn't like at all.

I don't see much hope for the per-entry set uid / set gid bits: this would be 
a major, incompatible change to the permission model, not covered by the 
specification. Also it doesn't really cover the sticky bit in an obvious way. 
Changing one of the defined permissions to something else definitely is not 
an option.

The right list to dicuss such things would probably be 
[email protected] (Majordomo; [email protected]); the 
list is mostly dead since many months, though. I also expect nobody there to 
be interested much in acls anymore.

On Monday 06 September 2004 03:19, Nathan Scott wrote:
> FYI - forwarding some issues raised by Andras Korn on the
> Debian lists...
>
> ----- Forwarded message from Andras Korn
> <[email protected]> -----
>
> Date: Sun, 5 Sep 2004 15:08:23 +0200
> To: Debian Bug Tracking System <[email protected]>
> Organization: Technical University of Budapest, Department of Calculus
> User-Agent: Mutt/1.5.6+20040818i
> Reply-To: Andras Korn <[email protected]>,
>    [email protected]
> From: Andras Korn <[email protected]>
> Subject: Bug#270099: getfacl doesn't show setuid/setgid/sticky bits
>
> Package: acl
> Version: 2.2.23-1
> Severity: important
>
> Hi,
>
> based on the documentation one is led to believe that something like
>
> getfacl -R / | ssh otherhost setfacl --restore=-
>
> can be used to duplicate all file permissions, including ACLs, from one
> host to another.
>
> This however is not the case at all, because getfacl seems to ignore the
> first octal permission digit of all entries it processes, causing the above
> command to apparently succeed but lose important information in the
> process.
>
> Neither getfacl(1) nor setfacl(1) appear to contain BIG FAT WARNINGs about
> this issue; if the bug can't be fixed, such warnings should be added at the
> very least.
>
> In particular the sentence "If getfacl is used on a file system that does
> not support ACLs, getfacl displays the access permissions defined by the
> traditional file mode permission bits" is misleading in that only the lower
> three octal digits are actually displayed.
>
> Best regards,
>
> Andras
>
> -- System Information:
> Debian Release: 3.1
>   APT prefers unstable
>   APT policy: (500, 'unstable'), (1, 'experimental')
> Architecture: i386 (i686)
> Kernel: Linux 2.6.7-chardonnay
> Locale: LANG=C, LC_CTYPE=hu_HU
>
> Versions of packages acl depends on:
> ii  libacl1                     2.2.23-1     Access control list shared
> library ii  libattr1                    2.4.16-1     Extended attribute
> shared library ii  libc6                       2.3.2.ds1-16 GNU C Library:
> Shared libraries an
>
> -- no debconf information
>
> --
>                  Andras Korn <korn at chardonnay.math.bme.hu>
>                  <http://chardonnay.math.bme.hu/~korn/>	QOTD:
>            Math and Alcohol don't mix. Please don't drink & derive.
>
>
> ----- End forwarded message -----

Cheers,
-- 
Andreas Gruenbacher <[email protected]>
SUSE Labs, SUSE LINUX AG
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel