Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dchmod: fix check for CAP_CHOWN and CAP_FOWNER capabilities #562

Merged
merged 1 commit into from
Oct 11, 2023

Conversation

adammoody
Copy link
Member

@adammoody adammoody commented Oct 11, 2023

While adding the --open-noatime feature, it was discovered that mfu_flist_chmod was incorrectly checking for CAP_CHOWN and CAP_FOWNER capabilities. The old check would have reported that a process had such capabilities when it did not. This changes things to delegate the check to the new mfu_proc_set() function that was added for --open-noatime.

By default, mfu_flist_chmod should avoid trying to change the group or permissions of files that the current user does not own. However, due to wrong info about capabilities, it attempts the change and then reports an error:

>>:  dchmod --group g123 --mode g+X /path/to/file
[2023-10-11T11:59:19] Walking /path/to/file
[2023-10-11T11:59:19] Walked 1 items in 0.029 secs (34.693 items/sec) ...
[2023-10-11T11:59:19] Walked 1 items in 0.029 seconds (34.580 items/sec)
[2023-10-11T11:59:19] Changing 1 items
[2023-10-11T11:59:19] [0] [/path/to/src/common/mfu_flist_chmod.c:1021] ERROR: Failed to change ownership on `/path/to/file' lchown() (errno=1 Operation not permitted)
[2023-10-11T11:59:19] Processed 1 items in 0.013 seconds (75.637 items/sec) skipped/success/error chown=(0/0/1) chmod=(1/0/0)

With the fix, it now detects that it does not have permission to make the change, and so it correctly skips those files.

>>:  dchmod --group g123 --mode g+X /path/to/file
[2023-10-11T11:59:51] Walking /path/to/file
[2023-10-11T11:59:51] Walked 1 items in 0.009 secs (109.267 items/sec) ...
[2023-10-11T11:59:51] Walked 1 items in 0.009 seconds (108.450 items/sec)
[2023-10-11T11:59:51] Changing 1 items
[2023-10-11T11:59:51] Processed 1 items in 0.011 seconds (87.452 items/sec) skipped/success/error chown=(1/0/0) chmod=(1/0/0)

The end result is that dchmod prints fewer error messages when normal users change group or permission bits on a directory tree that contains files from a mix of different users. If needed, one can still force dchmod to attempt the change with --force.

Signed-off-by: Adam Moody <moody20@llnl.gov>
@adammoody adammoody merged commit fac50e0 into main Oct 11, 2023
@adammoody adammoody deleted the capfowner branch October 11, 2023 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant