bugGNU Core Utilities - Bugs: bug #11638, chmod and setgid bit

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #11638: chmod and setgid bit

Submitted by:  None
Submitted on:  Wed 19 Jan 2005 05:49:36 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Tue 19 Sep 2006 10:18:18 PM UTC, comment #1:

Thanks for the bug report. I think this bug is fixed in coreutils 6.2, which you're welcome to try <ftp://alpha.gnu.org/gnu/coreutils/coreutils-6.1.tar.gz>.

Paul Eggert <eggert>
Project Administrator
Wed 19 Jan 2005 05:49:36 PM UTC, original submission:

Let's say you have a directory like this :
drwxr-s--- 5 user www-data 4,0K 2005-01-19 00:19 html/
It's useful when you want an user to be the owner of its web repository, give access to web files to the webserver without giving access to world.

The problem is that when you try to chmod g+w or o+rx html/ for example, the directory loses its setgid bit if "user" is not in "www-data" group.
Then either you disallow him the right to chmod with a RBAC but then he'll no more be able to give write access to the webserver to its website, or you put "user" in the www-data group, thus granting him access to other users' web files.... Both are no solutions at all...

I understand the reasons why you could have decided to remove the setgid/setuid bit from an executable when it's changed mode or owner, since this could grant privileges to users not allowed to have them.
But the setgid bit on directories has a very specific behavior. It only ensures files or directories created in the setgid dir will have the same group (+setgid bit for directories) as their parent. Very useful for HTML dirs as I explained before. But not if it's removed on chmod ! I see no harm letting the setgid bit active whenever anyone changes modes for the directory.

What do you think about it ? :)

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 19 Sep 2006 10:18:18 PM UTCeggertStatusNone=>Fixed
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1