{"thread":{"id":"13194","subject":"git-clone file permissions and cpio","startedAt":"2008-04-21T08:45:18Z","lastAt":"2008-05-04T11:32:07Z","messageCount":3,"participants":["Mark Hills","Paolo Bonzini"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"74861","messageId":"alpine.BSO.1.10.0804210911170.21918@zrgural.vwaro.pbz","threadId":"13194","inReplyTo":null,"subject":"git-clone file permissions and cpio","fromName":"Mark Hills","fromEmail":"mark@pogo.org.uk","sentAt":"2008-04-21T08:45:18Z","receivedAt":"2008-04-21T08:45:18Z","isPatch":false,"sender":{"key":"mark@pogo.org.uk","avatar":null},"body":"I persuaded my employer to test Git -- with good results so far. But we \nhave a problem with file permissions.\n\nWe use the setuid bit on much of our central file hierarchy to ensure that \nanyone in a certain unix group of trusted users can push.\n\nI noticed that the .git/objects directory was losing this setuid bit.\n\nThis creates problems later, when subdirectories of .git/objects are \ncreated by one user, and another user does a checkin which requires write \nto that subdirectory:\n\ndrwxrwx--- 2 mhills trust 51 Apr 18 09:39 eb\ndrwxrwx--- 2 mhills user   6 Apr 18 09:40 f4\ndrwxrwx--- 2 mhills trust  6 Apr 18 09:39 info\ndrwxrwx--- 2 mhills trust  6 Apr 18 09:39 pack\n\nThe offending operation is a cpio-based file copy in git-clone.sh. I \nupdated to the latest Git source and cpio, with the same issue.\n\nI got some kind of working behaviour with the diff below, which stops cpio \n'fixing' the file permissions (only on the directories). But it seems the \nunderlying cause is cpio trying to copy file permissions which it would be \nbetter off not doing in this case (and which there isn't a flag to \ndisable).\n\nIs this a known problem? How can we fix this properly?\n\nMark\n\n\ndiff --git a/git-clone.sh b/git-clone.sh\nindex 2636159..3b8280b 100755\n--- a/git-clone.sh\n+++ b/git-clone.sh\n@@ -333,7 +333,7 @@ yes)\n                         fi\n                 fi &&\n                 cd \"$repo\" &&\n-               find objects -depth -print | cpio $cpio_quiet_flag -pumd$l \"$GIT_DIR/\" || \\\n+               find objects -depth ! -type d -print | cpio $cpio_quiet_flag -pumd$l \"$GIT_DIR/\" || \\\n                         exit 1\n         fi\n         git-ls-remote \"$repo\" >\"$GIT_DIR/CLONE_HEAD\" || exit 1\n"},{"id":"74867","messageId":"480C7D82.9000602@gnu.org","threadId":"13194","inReplyTo":"alpine.BSO.1.10.0804210911170.21918@zrgural.vwaro.pbz","subject":"Re: git-clone file permissions and cpio","fromName":"Paolo Bonzini","fromEmail":"bonzini@gnu.org","sentAt":"2008-04-21T11:41:54Z","receivedAt":"2008-04-21T11:41:54Z","isPatch":false,"sender":{"key":"bonzini@gnu.org","avatar":"https://avatars.githubusercontent.com/u/42082?v=4"},"body":"\n> I got some kind of working behaviour with the diff below, which stops \n> cpio 'fixing' the file permissions (only on the directories). But it \n> seems the underlying cause is cpio trying to copy file permissions which \n> it would be better off not doing in this case (and which there isn't a \n> flag to disable).\n\nI don't think you want to have the setgid bit on files, only on \ndirectories, so your patch seems okay to me.\n\nPaolo\n"},{"id":"76014","messageId":"alpine.BSO.1.10.0805041227550.5819@zrgural.vwaro.pbz","threadId":"13194","inReplyTo":"480C7D82.9000602@gnu.org","subject":"Re: git-clone file permissions and cpio","fromName":"Mark Hills","fromEmail":"mark@pogo.org.uk","sentAt":"2008-05-04T11:32:07Z","receivedAt":"2008-05-04T11:32:07Z","isPatch":false,"sender":{"key":"mark@pogo.org.uk","avatar":null},"body":"On Mon, 21 Apr 2008, Paolo Bonzini wrote:\n\n>> I got some kind of working behaviour with the diff below, which stops \n>> cpio 'fixing' the file permissions (only on the directories). But it \n>> seems the underlying cause is cpio trying to copy file permissions \n>> which it would be better off not doing in this case (and which there \n>> isn't a flag to disable).\n>\n> I don't think you want to have the setgid bit on files, only on \n> directories, so your patch seems okay to me.\n\nI'm spent some time investigating this, as the patch has different \nbehaviour with different version of cpio because of various bugs [1].\n\nI looked at various other ways of achieving the copy of the directory \nincluding variations on cpio, tar, pax, rsync and decided it was best to \nexplicitly divide this into two steps: create the directories honouring \numask and setgid etc. at the destination, and then copy the files over \nwith read-only permissions using the existing method.\n\nI'll send a [PATCH] mail with this new diff, although I can see this might \nbe superceded by a built in clone in the future.\n\nMark\n\n[1] http://www.gnu.org/software/cpio/\n\ndiff --git a/git-clone.sh b/git-clone.sh\nindex 8c7fc7f..53c7e06 100755\n--- a/git-clone.sh\n+++ b/git-clone.sh\n@@ -334,7 +334,10 @@ yes)\n  \t\t\tfi\n  \t\tfi &&\n  \t\tcd \"$repo\" &&\n-\t\tfind objects -depth -print | cpio $cpio_quiet_flag -pumd$l \"$GIT_DIR/\" || \\\n+\t\t# Create dirs using umask and permissions and destination\n+\t\tfind objects -type d -print | (cd \"$GIT_DIR\" && xargs mkdir -p) &&\n+\t\t# Copy 0444 permissions on files\n+\t\tfind objects -type f -print | cpio $cpio_quiet_flag -pumd$l \"$GIT_DIR/\" || \\\n  \t\t\texit 1\n  \tfi\n  \tgit-ls-remote \"$repo\" >\"$GIT_DIR/CLONE_HEAD\" || exit 1\n"}]}