GNOME Bugzilla – Bug 711058
Does not copy directory metadata when merging /etc
Last modified: 2013-11-29 04:33:10 UTC
Somewhat similar to #711057, but different root cause. When a directory is added in /etc/ in a deployment upon upgrade the directory metadata won't be copied (e.g. ownersihp, permissions). copy_one_config_file has FIXMEs for this, but i couldn't find a bug hence this report.
So now that bug #711057 has fixed ownership, let's discuss precisely what should be copied: * Unix mode for sure * ACLs? Definitely. * Extended attributes like security.selinux? I'd say yes. What about timestamps? We could try to say we'll just do what GNU coreutils "cp -a" does, since the underlying function *is* named that way...
Copying everything (including) timestamps would be the safest i guess. Assuming the case of a etc merge where the default etc hasn't changed, i would expect the new deployments /etc being _exactly_ the same as the old one i guess. (Although i doubt timestamps have a practical effect).
Created attachment 260394 [details] [review] Import xattr code from OSTree, use it to make gs_shutil_cp_a() copy xattrs For SELinux, it's crucial that we actually copy the "security.selinux" xattr which provides the security context. the "cp_a" name kind of strongly implies that we do what coreutils "cp -a" does, and this patch moves us a lot closer to what it says on the tin. Concretely, we now match directory modes (and ownership), and we copy all xattrs for directories. We're not (yet) copying xattrs for files, but sadly this is a GLib bug. This patch will allow OSTree to simply use gs_shutil_cp_a() for merging configuration. Still TODO: * Timestamps
Created attachment 260395 [details] [review] Move xattr handling into libgsystem, fix sysroot to handle directory ownership/perms This large patch moves the core xattr logic down into libgsystem, which allows the gs_shutil_cp_a() API to copy them. In turn, this allows us to just use that API instead of rolling our own recursive copy here. As noted in the new comment though, one case that we are explicitly regressing is where the new /etc removes a parent directory that's needed by a modified file. This seems unlikely for most vendors now, but let's do that as a separate bug.
Created attachment 260396 [details] [review] Move xattr handling into libgsystem, fix sysroot to handle directory ownership/perms A quick self-review revealed I forgot to rebase this.
I decided to just go with these, but if anyone wants to review later, please do...