bugGNU Core Utilities - Bugs: bug #11638, chmod and setgid bit

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #11638: chmod and setgid bit

Submitter:  None
Submitted:  Wed 19 Jan 2005 05:49:36 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Tue 19 Sep 2006 10:18:18 PM UTC, comment #1: 

Thanks for the bug report.  I think this bug is fixed in coreutils 6.2, which you're welcome to try <ftp://alpha.gnu.org/gnu/coreutils/coreutils-6.1.tar.gz>.

Paul Eggert <eggert>
Group administrator
Wed 19 Jan 2005 05:49:36 PM UTC, original submission:  

Let's say you have a directory like this :
drwxr-s---  5 user www-data 4,0K 2005-01-19 00:19 html/
It's useful when you want an user to be the owner of its web repository, give access to web files to the webserver without giving access to world.

The problem is that when you try to chmod g+w or o+rx html/ for example, the directory loses its setgid bit if "user" is not in "www-data" group.
Then either you disallow him the right to chmod with a RBAC but then he'll no more be able to give write access to the webserver to its website, or you put "user" in the www-data group, thus granting him access to other users' web files.... Both are no solutions at all...

I understand the reasons why you could have decided to remove the setgid/setuid bit from an executable when it's changed mode or owner, since this could grant privileges to users not allowed to have them.
But the setgid bit on directories has a very specific behavior. It only ensures files or directories created in the setgid dir will have the same group (+setgid bit for directories) as their parent. Very useful for HTML dirs as I explained before. But not if it's removed on chmod ! I see no harm letting the setgid bit active whenever anyone changes modes for the directory.

What do you think about it ? :)

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-09-19 eggert StatusNone Fixed
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code