Re: Bugreport on Ubuntu LTS: not ok - 2 Objects creation does not break ACLs with restrictive umask

From: Junio C Hamano <gitster@pobox.com>
Date: Jun 4, 2012, 22:19 UTC
Message-ID: <7vy5o2ra7w.fsf@alter.siamese.dyndns.org>
In-Reply-To: <CALbm-EatNCPjFRO4NyGfZuSa72-FXwZcd_7cFe-f_iMOdGL4MQ@mail.gmail.com>

Stefan Beller <stefanbeller@googlemail.com> writes:

Show 38 quoted lines

> I tried debugging into it:
> In git/t/t1304-default-acl.sh there is:
> check_perms_and_acl () {
>     test -r "$1" &&
>     getfacl "$1" > actual &&
>     grep -q "user:root:rwx" actual &&
>     grep -q "user:${LOGNAME}:rwx" actual &&
>     egrep "mask::?r--" actual > /dev/null 2>&1 &&
>     grep -q "group::---" actual || false
> }
>
> but when I do all the commands as in the test2:
> test_expect_success SETFACL 'Objects creation does not break ACLs with
> restrictive umask' '
>     # SHA1 for empty blob
>     check_perms_and_acl .git/objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
> '
> Now I run the second line in check_perms_and_acl ()  with
> .git/objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
> there is
>
> getfacl .git/objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
> # file: .git/objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
> # owner: sb
> # group: sb
> user::r--
> user:root:rwx			#effective:---
> user:sb:rwx			#effective:---
> group::---
> mask::---
> other::---
>
> This command seem to fail 'egrep "mask::?r--" actual' as there is
> mask::---
> but expected is
> mask::r--
>
> That's my understanding of the test case so far.

Hmph. Running the test manually does not seem to fail for me and gives the "r--" mask.

I am lost. Matthieu, you introduced this as a failing test with 7aba618 (Add a testcase for ACL with restrictive umask., 2010-02-22), as part of the series leading to 5256b00 (Use git_mkstemp_mode instead of plain mkstemp to create object files, 2010-02-22). Any ideas (other than "Your filesystem is broken", that is)? As far as I can tell, with 'mask::---', these specific users who are given permissions to read from the objects wouldn't be able to read from them, so...