Comments (6)
Hmmm, the -m argument is handled in the install_node() dirtree callback but -d and -D are handled in install_main(). In part because "install -dm +x" hasn't got a previous mode to delta from, so... vs 777? Or vs umask?
Bit sleep deprived to fix this at the moment but I'll try to work out the correct thing to do in the morning. (And add a test.)
from toybox.
Hmmm, the -m argument is handled in the install_node() dirtree callback but -d and -D are handled in install_main(). In part because "install -dm +x" hasn't got a previous mode to delta from, so... vs 777? Or vs umask?
I see, so they're handled separately.
Bit sleep deprived to fix this at the moment but I'll try to work out the correct thing to do in the morning. (And add a test.)
Yeah, no worries. I can help with the testing if needed.
from toybox.
Oops, sorry, got distracted. I'll try to get this in tonight.
from toybox.
Did you know that the linux mkdirat() syscall strips permission bits outside 01777? Meaning seting the set group ID bit on a directory (so newly created files in the directory inherit the directory's group rather than the users) is inherently racy.
I can open it (with the no follow symlink bit), stat it to confirm it's a directory (albeit not necessarily the one you just created, or somebody may have done a chown on it in the race window), and then do an fchmod() on that filehandle... except this needs to interact with -g and -o correctly, I think...?
from toybox.
Eh, the chown's already racy if you're being security paranoid, and it has to go after the chown because that would reset suid bits anyway. (I tested by hand that "sudo ./toybox install -dm 1750 -g root directory" is both T and root, meaning the chown doesn't strip the sticky bit, but didn't add it to scripts/install.test because it would require root to test.)
Commit 39dea77.
from toybox.
Eh, the chown's already racy if you're being security paranoid, and it has to go after the chown because that would reset suid bits anyway. (I tested by hand that "sudo ./toybox install -dm 1750 -g root directory" is both T and root, meaning the chown doesn't strip the sticky bit, but didn't add it to scripts/install.test because it would require root to test.)
Commit 39dea77.
Upon further testing, the issue appears to have been fixed. Thanks!
from toybox.
Related Issues (20)
- Request diff -I/--ignore-matching-lines
- [Documentation] Differences to busybox? HOT 3
- [Feature request] Could a static-option be added to the menu interface? HOT 5
- [Documentation / Question] Can toybox be combined with e. g. mruby? HOT 9
- building a rootfs without a kernel HOT 10
- Most scripts use /bin/bash, which not all systems have. Use /usr/bin/env instead? HOT 11
- [Q] Can `bash` compatibility in toysh be turned off during build time and during run time? HOT 2
- building 0.8.11 with ssl and tls is broken HOT 15
- When running shell scripts, the process coredump.
- POSIX deviation: test arithmetic operands must support decimal only HOT 12
- find -size <number-without-suffix> not POSIX HOT 7
- Can you include oksh? HOT 1
- On incremental builds' reproducibility HOT 1
- ASAN failures in various file processing commands HOT 2
- [Feature Suggestion] progress meter (pv subcommand) HOT 5
- [FR] envsubst HOT 4
- getty: does not display issue HOT 1
- command unshare broken HOT 1
- tar honor umask test fails on Android HOT 4
- Building Toybox for J2 Turtleboard fails since 650ff11a
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from toybox.