- restrict permissions on .snapshots subvolume (bnc#843219)

diff --git a/package/snapper.changes b/package/snapper.changes
index 23606c2b4343f83687d1732d97a07f89a2048231..7890c1823aac02d06296b5b446a5d73d1fb21235 100644 (file)
--- a/package/snapper.changes
+++ b/package/snapper.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Tue Oct 01 15:46:19 CEST 2013 - aschnell@suse.de
+
+- restrict permissions on .snapshots subvolume (bnc#843219)
+
 -------------------------------------------------------------------
 Mon Sep 30 14:20:22 CEST 2013 - aschnell@suse.de
 

diff --git a/snapper/Btrfs.cc b/snapper/Btrfs.cc
index 49cd0bac8b991443349daa1803e4793e6a49f14e..57f117827b90ceb4615d96491406df29a168fcb4 100644 (file)
--- a/snapper/Btrfs.cc
+++ b/snapper/Btrfs.cc
@@ -107,6 +107,11 @@ namespace snapper
            y2err("create subvolume failed errno:" << errno << " (" << stringerror(errno) << ")");
            throw CreateConfigFailedException("creating btrfs snapshot failed");
        }
+
+       SFile x(subvolume_dir, ".snapshots");
+       struct stat stat;
+       if (x.stat(&stat, 0) == 0)
+           x.chmod(stat.st_mode & ~0027, 0);
     }
 
 

diff --git a/snapper/FileUtils.cc b/snapper/FileUtils.cc
index f693ede570790b24ccbd7fa2ed44f7b54c360d79..3777ad64934789c978473dc880ac60592869ff04 100644 (file)
--- a/snapper/FileUtils.cc
+++ b/snapper/FileUtils.cc
@@ -588,6 +588,13 @@ namespace snapper
     }
 
 
+    int
+    SFile::chmod(mode_t mode, int flags) const
+    {
+       return dir.chmod(name, mode, flags);
+    }
+
+
     bool
     SFile::xaSupported() const
     {

diff --git a/snapper/FileUtils.h b/snapper/FileUtils.h
index bccf31b0940555aeb9219d260ec6e1e37a8f726f..e3d5450883046c604c1582afcebd4922aedf2bea 100644 (file)
--- a/snapper/FileUtils.h
+++ b/snapper/FileUtils.h
@@ -126,6 +126,7 @@ namespace snapper
        int stat(struct stat* buf, int flags) const;
        int open(int flags) const;
        int readlink(string& buf) const;
+       int chmod(mode_t mode, int flags) const;
 
        bool xaSupported() const;