[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Tor Lillqvist changed: What|Removed |Added AssignedTo|libreoffice-b...@lists.free |sberg...@redhat.com |desktop.org | --- Comment #11 from Tor Lillqvist 2011-12-07 01:02:34 PST --- Stephan volunteered to have a closer look at all involved issues, re-assigning. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #10 from Tor Lillqvist 2011-12-05 03:07:10 PST --- Had second thoughts; will apply only after 3.5 has been branched. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Tor Lillqvist changed: What|Removed |Added Status|RESOLVED|UNCONFIRMED Resolution|FIXED | --- Comment #9 from Tor Lillqvist 2011-12-04 23:59:25 PST --- Argh, ignore previous comment, wrong bug... -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Tor Lillqvist changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution||FIXED --- Comment #8 from Tor Lillqvist 2011-12-04 23:58:48 PST --- Should be fixed now with: commit a35140f245d774745b806ef12346aa77f0256395 Author: Tor Lillqvist Date: Fri Dec 2 11:41:33 2011 +0200 Fix library layer mapping for the URELIB ones, fdo#42826 -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #7 from Lionel Elie Mamane 2011-12-04 15:46:02 PST --- (In reply to comment #6) >> Which systems is that? > Well, Mac OS X is the first one that comes to mind. Ah, I had temporarily forgotten it is a Unix. Indeed, it does not support it, nor does it support eaccess: http://lists.apple.com/archives/darwin-dev/2009/Mar/msg00110.html > Interestingly, the Mac OS X manpage for plain old access() says: "CAVEAT: > Access() is a potential security hole and should never be used" ;) Well, it should never by used to authorise an action by a privileged process, as there is a race condition. The FreeBSD man page says the same, but then continues saying "but you can use it to give UI hints to the user". -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #6 from Tor Lillqvist 2011-12-04 15:06:32 UTC --- > Which systems is that? Well, Mac OS X is the first one that comes to mind. Interestingly, the Mac OS X manpage for plain old access() says: "CAVEAT: Access() is a potential security hole and should never be used" ;) And my point whether "symlinks are the only thing that can make access() misleading" was not security issues, but just simply that I wouldn't trust that access() (or faccessat()), even on the most bleeding edge Linux, would necessarily be able to tell the truth beforehand whether you will actually succeed in actually opening some pathname for reading or writing in various scenarios. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #5 from Lionel Elie Mamane 2011-12-04 12:45:17 PST --- (In reply to comment #3) > And that is portable to all Unix systems we care for? Which systems is that? Standards-wise, faccessat() is in POSIX.1-2008 and Open Group Extended API Set, Part 2. It is supported by GNU/Linux and FreeBSD: GNU/Linux: by default since glibc 2.10 (released in May 2009), needs "#define _ATFILE_SOURCE 1" in older glibc. Needs kernel 2.6.16 (released 20 March 2006) or later. FreeBSD: version 8.0 and later. Release: 25 November 25 2009. However, FreeBSD and "Open Group Extended API Set, Part 2" do not document the AT_SYMLINK_NOFOLLOW flag for faccessat :-( So, hmm. > And symlinks are the only thing that can make access() misleading? If LibreOffice is setuid-foo, then access() checks permission for the invoking user, not for foo. That is fixed in FreeBSD and GNU/Linux with the eaccess() function, but that is not standard. That's also what the AT_EACCESS flag to faccessat does. However, now that I think about it, checking permissions of the symlink rather than permissions of symlink's target is probably the wrong thing anyway. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #4 from Tor Lillqvist 2011-12-04 11:39:47 PST --- But whatever, getting more contributors is important, I am not opposing, will apply the patch tomorrow when I get to work. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 --- Comment #3 from Tor Lillqvist 2011-12-04 11:31:01 PST --- And that is portable to all Unix systems we care for? And symlinks are the only thing that can make access() misleading? -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Lionel Elie Mamane changed: What|Removed |Added CC||lio...@mamane.lu --- Comment #2 from Lionel Elie Mamane 2011-12-03 13:38:49 PST --- I can guess that the code e.g. wants to put the document in "READ ONLY" mode / show some UI difference when the file it was opened from cannot be written to. Anyway, if we really need to check for permission without actually trying to do the action, we can solve the "access() follows symlink" problem by using faccessat(-1, "/absolute/path", AT_EACCESS | AT_SYMLINK_NOFOLLOW) or faccessat(AT_FDCWD, "relative/or/absolute/path", AT_EACCESS | AT_SYMLINK_NOFOLLOW) -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Tor Lillqvist changed: What|Removed |Added CC||tlillqv...@suse.com --- Comment #1 from Tor Lillqvist 2011-12-03 03:08:22 PST --- I suggest we instead try to see why the code wants to check file access before attempting to open a file (if that is what it does), and if possible just try to get rid of such checks. I very much doubt even access() can get it right in all circumstances. For instance, surely mounting volumes from Windows servers on Unix clients is much more common than using OpenAFS or Linux ACLs. Does acess() work correctly if the file has some funky ACL on the SMB side? Isn't it in general wrong to try to check if something is possible before doing it? See http://en.wikipedia.org/wiki/Time-of-check-to-time-of-use . Instead, just try to do what you want to do (like open a file for reading or writing), and if it doesn't succeed, fail gracefully at that point. -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
[Libreoffice-bugs] [Bug 43095] File access rights are not determined correctly (OpenAFS, ACLs)
https://bugs.freedesktop.org/show_bug.cgi?id=43095 Moritz Bechler changed: What|Removed |Added See Also||https://issues.apache.org/o ||oo/show_bug.cgi?id=101891 -- Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. ___ Libreoffice-bugs mailing list Libreoffice-bugs@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
