[pbs-devel] applied-series: [PATCH proxmox-backup] chunk_store: fix problem with permission checking

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

with Gabriel's trailers folded in. we can always make this more relaxed if
issues pop up.

Quoting Hannes Laimer (2024-11-13 13:40:47)
> Permissions are stored in the lower 9 bits (rwxrwxrwx),
> so we have to mask `st_mode` with 0o777.
> The datastore root dir is created with 755, the `.chunks` dir and its
> contents with 750 and the `.lock` file with 644, this changes the
> expected permissions accordingly.
> 
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
>  pbs-datastore/src/chunk_store.rs | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/pbs-datastore/src/chunk_store.rs b/pbs-datastore/src/chunk_store.rs
> index 38a88584..29d5874a 100644
> --- a/pbs-datastore/src/chunk_store.rs
> +++ b/pbs-datastore/src/chunk_store.rs
> @@ -576,7 +576,7 @@ impl ChunkStore {
>              Ok(stat) => {
>                  if stat.st_uid != u32::from(pbs_config::backup_user()?.uid)
>                      || stat.st_gid != u32::from(pbs_config::backup_group()?.gid)
> -                    || stat.st_mode != file_mode
> +                    || stat.st_mode & 0o777 != file_mode
>                  {
>                      bail!(
>                              "unable to open existing chunk store path {:?} - permissions or owner not correct",
> @@ -598,22 +598,22 @@ impl ChunkStore {
>      /// subdirectories and the lock file.
>      pub fn verify_chunkstore<T: AsRef<Path>>(path: T) -> Result<(), Error> {
>          // Check datastore root path perm/owner
> -        ChunkStore::check_permissions(path.as_ref(), 0o700)?;
> +        ChunkStore::check_permissions(path.as_ref(), 0o755)?;
>  
>          let chunk_dir = Self::chunk_dir(path.as_ref());
>          // Check datastore .chunks path perm/owner
> -        ChunkStore::check_permissions(&chunk_dir, 0o700)?;
> +        ChunkStore::check_permissions(&chunk_dir, 0o750)?;
>  
>          // Check all .chunks subdirectories
>          for i in 0..64 * 1024 {
>              let mut l1path = chunk_dir.clone();
>              l1path.push(format!("{:04x}", i));
> -            ChunkStore::check_permissions(&l1path, 0o700)?;
> +            ChunkStore::check_permissions(&l1path, 0o750)?;
>          }
>  
>          // Check .lock file
>          let lockfile_path = Self::lockfile_path(path.as_ref());
> -        ChunkStore::check_permissions(lockfile_path, 0o600)?;
> +        ChunkStore::check_permissions(lockfile_path, 0o644)?;
>          Ok(())
>      }
>  }
> -- 
> 2.39.5
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
>


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel