Hi David,
On Thursday 27 March 2014 21:41:06 David Heidelberger wrote:
> This patch provide option to build and run udisks without ACL.
> Tested in full desktop environment.
>
> Signed-off-by: David Heidelberger <david.heidelber...@ixit.cz>
>
> v2: as replacement of ACL is used chown call.
> ---
> configure.ac | 38 ++++++++++++++++++++++++++------------
> src/udiskslinuxfilesystem.c | 10 ++++++++--
> 2 files changed, 34 insertions(+), 14 deletions(-)
>
> diff --git a/configure.ac b/configure.ac
> index 3a39b5a..e656abf 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -174,18 +174,31 @@ if test "x$with_systemdsystemunitdir" != "xno";
> then
> fi
> AM_CONDITIONAL(HAVE_SYSTEMD, [test -n "$systemdsystemunitdir"])
>
> -# libacl
> -AC_CHECK_HEADERS(
> - [sys/acl.h acl/libacl.h],
> - [ACL_CFLAGS=""],
> - AC_MSG_ERROR([*** ACL headers not found.]))
> -AC_CHECK_LIB(
> - [acl],
> - [acl_get_file],
> - [ACL_LIBS="-lacl"],
> - AC_MSG_ERROR([*** libacl not found.]))
> -AC_SUBST(ACL_CFLAGS)
> -AC_SUBST(ACL_LIBS)
> +have_acl=no
> +AC_ARG_ENABLE(acl, AS_HELP_STRING([--disable-acl], [disable acl
> support]))
> +if test "x$enable_acl" != "xno"; then
> + AC_CHECK_HEADERS(
> + [sys/acl.h acl/libacl.h],
> + [
> + AC_CHECK_LIB(
> + [acl],
> + [acl_get_file],
> + [AC_DEFINE(HAVE_ACL, 1, [Define if libacl is
> available]) have_acl=yes],
> + have_acl=no)
> + ],
> + have_acl=no)
> + if test "x$have_acl" = "xyes"; then
> + ACL_CFLAGS=""
> + ACL_LIBS="-lacl"
> + fi
> + AC_SUBST(ACL_CFLAGS)
> + AC_SUBST(ACL_LIBS)
> + if test "x$have_acl" = xno -a "x$enable_acl" = xyes; then
> + AC_MSG_ERROR([acl support requested but libraries not found])
> + fi
> +fi
> +AM_CONDITIONAL(HAVE_ACL, [test "$have_acl" = "yes"])
> +
>
> # Internationalization
> #
> @@ -232,6 +245,7 @@ echo "
> udevdir: ${udevdir}
> systemdsystemunitdir: ${systemdsystemunitdir}
> using libsystemd-login: ${have_libsystemd_login}
> + acl support: ${have_acl}
>
> compiler: ${CC}
> cflags: ${CFLAGS}
> diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
> index f243046..9f38630 100644
> --- a/src/udiskslinuxfilesystem.c
> +++ b/src/udiskslinuxfilesystem.c
> @@ -29,7 +29,9 @@
> #include <stdio.h>
> #include <mntent.h>
> #include <sys/types.h>
> +#ifdef HAVE_ACL
> #include <sys/acl.h>
> +#endif
> #include <errno.h>
>
> #include <glib/gstdio.h>
> @@ -795,7 +797,7 @@ ensure_utf8 (const gchar *s)
> }
>
> /*
> ----------------------------------------------------------------------------------------------------
>
> */
> -
> +#ifdef HAVE_ACL
> static gboolean
> add_acl (const gchar *path,
> uid_t uid,
> @@ -831,7 +833,7 @@ add_acl (const gchar *path,
> acl_free (acl);
> return ret;
> }
> -
> +#endif
> /*
> * calculate_mount_point: <internal>
> * @dameon: A #UDisksDaemon.
> @@ -921,7 +923,11 @@ calculate_mount_point (UDisksDaemon
> *daemon,
> goto out;
> }
> /* Finally, add the read+execute ACL for $USER */
> +#ifdef HAVE_ACL
> if (!add_acl (mount_dir, uid, error))
> +#else
> + if (chown (mount_dir, uid, -1) == -1)
> +#endif
Changing the ownership is not the same as simply adding an ACL for $USER.
With different ownerships, one can modify the permissions and obtain
write-privileges for example.
To get close functionality without ACLs, what about changing the group?
So, something like (pseudo-code):
chmod(mount_dir, (current_mask | S_IRWXG) & ~S_IWGRP);
chown(mount_dir, -1, group_id_of_user);
It is still not perfect, but it seems to be a bit safer. For multi-user
systems, this approach does not work (why would one disable ACLs in that
case), but for embedded it looks fine.
Regards,
Peter
> {
> if (rmdir (mount_dir) != 0)
> udisks_warning ("Error calling rmdir() on %s: %m",
> mount_dir);
> --
> 1.9.0
_______________________________________________
devkit-devel mailing list
devkit-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/devkit-devel
