[pbs-devel] [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[pbs-devel] [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[Christian Ebner]

The .pxarexclude-cli encodes the exclude patterns the client was
invoked with in the pxar archive as regular file entry. The current
behaviour of setting the uid and gid to default 0 (root) causes
however issues when trying to backup and restore the backup as
non-root user.

Opt for using the uid/gid of the user the executable was called as,
allowing the restore for this user to succeed. Root will succeed
to restore anyways.

Link to issue in bugtracker:
https://bugzilla.proxmox.com/show_bug.cgi?id=5304

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-client/src/pxar/create.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
index 60efb0ce5..a5afde7af 100644
--- a/pbs-client/src/pxar/create.rs
+++ b/pbs-client/src/pxar/create.rs
@@ -404,6 +404,10 @@ impl Archiver {
 
         let mut metadata = Metadata::default();
         metadata.stat.mode = pxar::format::mode::IFREG | 0o600;
+        // use uid/gid of client process so the backup snapshot might be restored by the same
+        // potentially non-root user
+        metadata.stat.uid = unsafe { libc::getuid() };
+        metadata.stat.gid = unsafe { libc::getgid() };
 
         let mut file = encoder
             .create_file(&metadata, ".pxarexclude-cli", content.len() as u64)
-- 
2.39.2



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[Gabriel Goller]

On Tue Apr 30, 2024 at 5:37 PM CEST, Christian Ebner wrote:
> The .pxarexclude-cli encodes the exclude patterns the client was
> invoked with in the pxar archive as regular file entry. The current
> behaviour of setting the uid and gid to default 0 (root) causes
> however issues when trying to backup and restore the backup as
> non-root user.
>
> Opt for using the uid/gid of the user the executable was called as,
> allowing the restore for this user to succeed. Root will succeed
> to restore anyways.
>
> Link to issue in bugtracker:
> https://bugzilla.proxmox.com/show_bug.cgi?id=5304
>
> Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
> ---
>  pbs-client/src/pxar/create.rs | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
> index 60efb0ce5..a5afde7af 100644
> --- a/pbs-client/src/pxar/create.rs
> +++ b/pbs-client/src/pxar/create.rs
> @@ -404,6 +404,10 @@ impl Archiver {
>  
>          let mut metadata = Metadata::default();
>          metadata.stat.mode = pxar::format::mode::IFREG | 0o600;
> +        // use uid/gid of client process so the backup snapshot might be restored by the same
> +        // potentially non-root user
> +        metadata.stat.uid = unsafe { libc::getuid() };
> +        metadata.stat.gid = unsafe { libc::getgid() };
>  
>          let mut file = encoder
>              .create_file(&metadata, ".pxarexclude-cli", content.len() as u64)

This is a good addition, ran into this myself a few times. The chown
fails and throws an error although the pxarexclude file is correctly
restored (albeit with the current user's permission).

Consider: 
Tested-by: Gabriel Goller <g.goller@proxmox.com>



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[Christian Ebner]

Ping, still applies


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pbs-devel] applied: [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[Fabian Grünbichler]

On April 30, 2024 5:37 pm, Christian Ebner wrote:
> The .pxarexclude-cli encodes the exclude patterns the client was
> invoked with in the pxar archive as regular file entry. The current
> behaviour of setting the uid and gid to default 0 (root) causes
> however issues when trying to backup and restore the backup as
> non-root user.
> 
> Opt for using the uid/gid of the user the executable was called as,
> allowing the restore for this user to succeed. Root will succeed
> to restore anyways.
> 
> Link to issue in bugtracker:
> https://bugzilla.proxmox.com/show_bug.cgi?id=5304
> 
> Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
> ---
>  pbs-client/src/pxar/create.rs | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
> index 60efb0ce5..a5afde7af 100644
> --- a/pbs-client/src/pxar/create.rs
> +++ b/pbs-client/src/pxar/create.rs
> @@ -404,6 +404,10 @@ impl Archiver {
>  
>          let mut metadata = Metadata::default();
>          metadata.stat.mode = pxar::format::mode::IFREG | 0o600;
> +        // use uid/gid of client process so the backup snapshot might be restored by the same
> +        // potentially non-root user
> +        metadata.stat.uid = unsafe { libc::getuid() };
> +        metadata.stat.gid = unsafe { libc::getgid() };
>  
>          let mut file = encoder
>              .create_file(&metadata, ".pxarexclude-cli", content.len() as u64)
> -- 
> 2.39.2
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
> 


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel