Mimic gzip chown(gid), chmod(), chown(uid) Behavior

Avoids a race condition in which we unintentionally open up permissions to
the wrong group.

diff --git a/programs/util.c b/programs/util.c
index 7402b75d2a24c3512352702d2ccebc2259f90411..d0411e68db807ba6e0591737bc2bf1f07a6d1993 100644 (file)
--- a/programs/util.c
+++ b/programs/util.c
@@ -249,11 +249,23 @@ int UTIL_setFileStat(const char *filename, const stat_t *statbuf)
     /* set access and modification times */
     res += UTIL_utime(filename, statbuf);
 
+    /* Mimic gzip's behavior:
+     *
+     * "Change the group first, then the permissions, then the owner.
+     * That way, the permissions will be correct on systems that allow
+     * users to give away files, without introducing a security hole.
+     * Security depends on permissions not containing the setuid or
+     * setgid bits." */
+
 #if !defined(_WIN32)
-    res += chown(filename, statbuf->st_uid, statbuf->st_gid);  /* Copy ownership */
+    res += chown(filename, -1, statbuf->st_gid);  /* Apply group ownership */
 #endif
 
-    res += UTIL_chmod(filename, &curStatBuf, statbuf->st_mode & 07777);  /* Copy file permissions */
+    res += UTIL_chmod(filename, &curStatBuf, statbuf->st_mode & 0777);  /* Copy file permissions */
+
+#if !defined(_WIN32)
+    res += chown(filename, statbuf->st_uid, -1);  /* Apply user ownership */
+#endif
 
     errno = 0;
     UTIL_TRACE_RET(-res);

diff --git a/tests/cli-tests/file-stat/compress-file-to-file.sh b/tests/cli-tests/file-stat/compress-file-to-file.sh
index 949f34ff14dd4af723e7a11882d44fb59aa9bdc9..c5f5900318fa993d521bc0a9a30f79de800fea15 100755 (executable)
--- a/tests/cli-tests/file-stat/compress-file-to-file.sh
+++ b/tests/cli-tests/file-stat/compress-file-to-file.sh
@@ -3,6 +3,7 @@
 set -e
 
 datagen > file
+chmod 642 file
 
 zstd file -q --trace-file-stat -o file.zst
 zstd -tq file.zst

diff --git a/tests/cli-tests/file-stat/compress-file-to-file.sh.stderr.exact b/tests/cli-tests/file-stat/compress-file-to-file.sh.stderr.exact
index 8944e4cb415319fd306005a0c771f49b43220eaf..49a8152f3f60cc4abe3d3cf625000845d9dd367c 100644 (file)
--- a/tests/cli-tests/file-stat/compress-file-to-file.sh.stderr.exact
+++ b/tests/cli-tests/file-stat/compress-file-to-file.sh.stderr.exact
@@ -35,7 +35,7 @@ Trace:FileStat:  > UTIL_stat(file.zst)
 Trace:FileStat:  < 1
 Trace:FileStat:  > UTIL_utime(file.zst)
 Trace:FileStat:  < 0
-Trace:FileStat:  > UTIL_chmod(file.zst, 420)
+Trace:FileStat:  > UTIL_chmod(file.zst, 418)
 Trace:FileStat:   > chmod
 Trace:FileStat:   < 0
 Trace:FileStat:  < 0

diff --git a/tests/cli-tests/file-stat/decompress-file-to-file.sh b/tests/cli-tests/file-stat/decompress-file-to-file.sh
index 3e08c247bd6c03a04fd381a23ee1a4c694dd6d57..9e68f8f332a05fab547949568d771ce549df2306 100755 (executable)
--- a/tests/cli-tests/file-stat/decompress-file-to-file.sh
+++ b/tests/cli-tests/file-stat/decompress-file-to-file.sh
@@ -3,5 +3,6 @@
 set -e
 
 datagen | zstd -q > file.zst
+chmod 642 file.zst
 
 zstd -dq --trace-file-stat file.zst

diff --git a/tests/cli-tests/file-stat/decompress-file-to-file.sh.stderr.exact b/tests/cli-tests/file-stat/decompress-file-to-file.sh.stderr.exact
index 3b9d6992227584c413892a0c2171ee657d7586cc..65547537a6b995bd3e653fcb08044e92216e00ce 100644 (file)
--- a/tests/cli-tests/file-stat/decompress-file-to-file.sh.stderr.exact
+++ b/tests/cli-tests/file-stat/decompress-file-to-file.sh.stderr.exact
@@ -31,7 +31,7 @@ Trace:FileStat:  > UTIL_stat(file)
 Trace:FileStat:  < 1
 Trace:FileStat:  > UTIL_utime(file)
 Trace:FileStat:  < 0
-Trace:FileStat:  > UTIL_chmod(file, 420)
+Trace:FileStat:  > UTIL_chmod(file, 418)
 Trace:FileStat:   > chmod
 Trace:FileStat:   < 0
 Trace:FileStat:  < 0