Skip to content

Commit

Permalink
Carefully handle symlinks at the last phase of VerifyFilePromise()
Browse files Browse the repository at this point in the history
If the promiser is a symlink, `lstat()` and `stat()` give
different results. We need to use `lstat()` to get info about the
promiser (symlink) itself.

Also, we need to call `VerifyFileLeaf()` on symlinks as well as
on regular files.

Ticket: ENT-11235
Changelog: Ownership of symlinks is now handled properly
  • Loading branch information
vpodzime committed Feb 9, 2024
1 parent 8f1bb17 commit 84b6783
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 10 deletions.
4 changes: 2 additions & 2 deletions cf-agent/verify_files.c
Original file line number Diff line number Diff line change
Expand Up @@ -599,9 +599,9 @@ static PromiseResult VerifyFilePromise(EvalContext *ctx, char *path, const Promi

// Once more in case a file has been created as a result of editing or copying

exists = (stat(changes_path, &osb) != -1);
exists = (lstat(changes_path, &osb) != -1);

if (exists && (S_ISREG(osb.st_mode))
if (exists && (S_ISREG(osb.st_mode) || S_ISLNK(osb.st_mode))
&& (!a.haveselect || SelectLeaf(ctx, path, &osb, &(a.select))))
{
VerifyFileLeaf(ctx, path, &osb, &a, pp, &result);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,7 @@ bundle agent test
"description" -> { "CFE-3116" }
string => "Test that promising ownership of symlinks is not confused by target";

"test_soft_fail"
string => "any",
meta => { "CFE-3116" };

# this test isn't super comprehensive, once the issue is fixed, it will
# need to be skipped on various platforms, at least windows.
# "test_skip_unsupported" string => "windows";
"test_skip_unsupported" string => "windows";

files:
"/tmp/symlink"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
info: Regular file '/tmp/TESTDIR.cfengine/foo' had permissions 0600, changed it to 0777
info: Symbolic link to regular file '/tmp/TESTDIR.cfengine/baz' had permissions 0600, changed it to 0777
info: Directory '/tmp/TESTDIR.cfengine/foobar' had permissions 0700, changed it to 0777

0 comments on commit 84b6783

Please sign in to comment.