svn commit: r326031 - head/sys/fs/msdosfs

[Bruce Evans]

On Tue, 21 Nov 2017, Bruce Evans wrote:

> On Tue, 21 Nov 2017, Bruce Evans wrote:
>
>> On Mon, 20 Nov 2017, Conrad Meyer wrote:
>> 
>>> Log:
>>>  msdosfs(5): Reflect READONLY attribute in file mode
>> ...
>> This undoes only a small part of READONLY changes in r254627 (which are
>> small part of of r253627).  I think r254627 got the READONLY semantics
>> wrong, but they were almost consistent and well documented in the commit
>> log.  Now they are more seriously inconsistent.
>> ...
> PS: I now see a good reason to not change the READONLY attribute using
> permissions (doing so is the inconsistent part of r254627), but perhaps
> we should complete the undoing of the changes to ignore READONLY for
> permissions.
>
> Under MSDOS or Windows, you have to use attrib to change attributes.
> This corresponds to having to use chflags(1) under FreeBSD.  Allowing
> chmod(1) to change flags together with permissons gives confusing
> non-orthogonal behaviour.  Only old FreeBSD and old(?) Cygwin have to
> do that since they don't have UF_READONLY (or even chflags).
> 
> Example of non-orthogonal behaviour: the fake default permissions are
> -r-xr-xr-x and attributes are R.  You try to change this using chmod
> u+w.  This doesn't change the permissions, but it changes the attributes
> to 0.  Then on rebooting to msdosfs, the R attribute has been lost.  It
> is safer to require using only chflags(1 or 2) to change attributes.

I now see the correct way to fix this.  UF_READONLY should be independent
of the permissions and act like a partial immutable flag.

Changes for this:
- back out the curent commit
- remove toggling of ATTR_READONLY for setattr of the mode (the neglected
   change in r254627)
- add return (EACCES) in msdosfs_setattr() if (accmode & VMUMBLE) &&
   (dep->de_Attributes & ATTR_READONLY).  Clone 3 lines in ffs for this.
   ffs used to use VWRITE for VMUMBLE in ufs_vaccessx(), but now uses
   (VMODIFY_PERMS & ~VADMIN_PERMS) in ufs_vaccess().  I think VWRITE is
   still enough for msdosfs.  msdosfs doesn't use V*PERMS anywhere else.
   ffs also uses VMODIFY_PERMS for the v_type checks.  I think they are
   for ACLs, but msdosfs doesn't support ACLs.

Also check that ATTR_READONLY only prevents writing in MSDOS.  It could
reasonably make more things immutable.  In Windows 7, for readonly files,
the DEL commands gives "Access is Denied", but rm in Cygwin gives the
POSIX behaviour of prompting for removal.

We have lots of experience with the permissions in the mode having little
to do with the actual permissions.  Write bits in them remain set when
the file becomes unwritable when immutable flag(s) or certain other flags
are set.  ACLs also affect accessibilty but not the mode.  They just can't
change the mode since their effect depends on user ids.  The effect of
file flags might also depend on user ids.  UF_IMMUTABLE happens to deny
writability for all users, but it doesn't deny changing itself for root.

Note that after the above changes, ATTR_READONLY denies write access even
for root, while its old effect on the permissions only denied write access
to non-root.  This is probably what is wanted.

Bruce