diff options
| author | Kevin Crowe <kevin.crowe@nexenta.com> | 2016-03-19 23:20:46 +0300 |
|---|---|---|
| committer | Matthew Ahrens <mahrens@delphix.com> | 2016-04-20 08:33:38 -0700 |
| commit | 1eb4e906ec75b9bde421954ace46ef137b0fc9eb (patch) | |
| tree | c010fb055ef7a8b62c243f5e14ca4f1298fd07c8 /usr/src/common/acl/acl_common.c | |
| parent | 380fd671753dd199e149f10e9f73ec52cdfe4230 (diff) | |
| download | illumos-gate-1eb4e906ec75b9bde421954ace46ef137b0fc9eb.tar.gz | |
6762 POSIX write should imply DELETE_CHILD on directories - and some additional considerations
Reviewed by: Gordon Ross <gwr@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
Approved by: Richard Lowe <richlowe@richlowe.net>
Diffstat (limited to 'usr/src/common/acl/acl_common.c')
| -rw-r--r-- | usr/src/common/acl/acl_common.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/usr/src/common/acl/acl_common.c b/usr/src/common/acl/acl_common.c index 6cfcb77937..ac73beace3 100644 --- a/usr/src/common/acl/acl_common.c +++ b/usr/src/common/acl/acl_common.c @@ -20,7 +20,7 @@ */ /* * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. - * Copyright 2013 Nexenta Systems, Inc. All rights reserved. + * Copyright 2014 Nexenta Systems, Inc. All rights reserved. */ #include <sys/types.h> @@ -1578,7 +1578,8 @@ acl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks) uint32_t write_mask = ACE_WRITE_DATA|ACE_APPEND_DATA; uint32_t execute_mask = ACE_EXECUTE; - (void) isdir; /* will need this later */ + if (isdir) + write_mask |= ACE_DELETE_CHILD; masks->deny1 = 0; if (!(mode & S_IRUSR) && (mode & (S_IRGRP|S_IROTH))) @@ -1722,10 +1723,17 @@ ace_trivial_common(void *acep, int aclcnt, return (1); /* - * Delete permissions are never set by default + * Delete permission is never set by default + */ + if (mask & ACE_DELETE) + return (1); + + /* + * Child delete permission should be accompanied by write */ - if (mask & (ACE_DELETE|ACE_DELETE_CHILD)) + if ((mask & ACE_DELETE_CHILD) && !(mask & ACE_WRITE_DATA)) return (1); + /* * only allow owner@ to have * write_acl/write_owner/write_attributes/write_xattr/ |