possible NIS/ACL bug?
rwatson at freebsd.org
Mon Nov 3 12:23:55 PST 2003
On Mon, 3 Nov 2003, Mark Nipper wrote:
> Uh oh! It's that last part where there are the two extra
> entries for the two ACL added groups, but no GID seems to have been
> stored with each entry, whereas the example in the daemon news article
> does actually show GID's in these places.
> So I assume this is an NIS/ACL bug of some kind? Both my uid
> and gid as well as both the gid's above (nes and loki) are mapped via
> NIS. If anyone needs me to do anything else, let me know. I don't feel
> nearly competent enough to start debugging the source for get/setfacl to
> try to grok any of this. :)
Yes, in 5.1 there was a bug in the libc acl_to_text() code that ommitted
the group name when the effective permissions granted by an additional
group ACL entry was not the same as the set permissions. This was fixed
date: 2003/07/24 23:33:25; author: rwatson; state: Exp; lines: +3 -2
Print group name in getfacl output when calculating an effective
permission set based on a more restrictive mask.
Submitted by: Glen Gibb <grg at ridley.unimelb.edu.au>
The change has not been merged to RELENG_5_1 as that branch is currently
owned by the security-officer team for advisories only. If you pull
acl_to_text.3 forward to 1.11 and rebuild libc + getfacl, it should be
corrected. The bug will be fixed "out of the box" in 5.2.
Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org Network Associates Laboratories
More information about the freebsd-current