Gentoo Archives: gentoo-hardened

From: Michael Orlitzky <michael@××××××××.com>
To: gentoo-hardened@l.g.o
Subject: [gentoo-hardened] Re: Group permissions bits interfering with default ACL mask
Date: Mon, 13 Aug 2012 00:02:17
Message-Id: 50283DD5.2000901@orlitzky.com
In Reply to: [gentoo-hardened] Group permissions bits interfering with default ACL mask by Michael Orlitzky
1 On 08/06/2012 02:31 PM, Michael Orlitzky wrote:
2 >
3 > I have a directory (drupal modules directory) where developers regularly
4 > untar (or cp) archives. The contents should be rwx for the 'developers'
5 > group, so that some other developer can update or remove the module later.
6 >
7 > I've set default ACLs on the parent directory, and the regular default
8 > ACLs are applied but the default mask is not. This is because tar/cp
9 > preserve the original group permission bits -- a strategy that doesn't
10 > make sense under a directory with default ACLs.
11 >
12
13 I wrote a function reapply_default_acl() which will apply foo's default
14 ACL to foo/bar when called like reapply_default_acl("foo/bar").
15
16 It still retains the original execute bits, though, unless the default
17 ACL states that we shouldn't.
18
19 http://michael.orlitzky.com/git/?p=aclq.git
20
21 I've patched a modification of this into coreutils to get at least cp
22 and mkdir working. Does this sound at all sane?