From 400caafb2bb63712bb23cfa4d800261aab8e5cae Mon Sep 17 00:00:00 2001 From: Clément Chigot Date: Thu, 25 Apr 2019 07:01:56 +0000 Subject: git-compat-util: work around for access(X_OK) under root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On AIX, access(X_OK) may succeed when run as root even if the execution isn't possible. This behavior is allowed by POSIX which says: ... for a process with appropriate privileges, an implementation may indicate success for X_OK even if execute permission is not granted to any user. It can lead hook programs to have their execution refused: git commit -m content fatal: cannot exec '.git/hooks/pre-commit': Permission denied Add NEED_ACCESS_ROOT_HANDLER in order to use an access helper function. It checks with stat if any executable flags is set when the current user is root. Signed-off-by: Clément Chigot Signed-off-by: Junio C Hamano --- compat/access.c | 31 +++++++++++++++++++++++++++++++ compat/fileno.c | 2 +- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 compat/access.c (limited to 'compat') diff --git a/compat/access.c b/compat/access.c new file mode 100644 index 0000000000..19fda3e877 --- /dev/null +++ b/compat/access.c @@ -0,0 +1,31 @@ +#define COMPAT_CODE_ACCESS +#include "../git-compat-util.h" + +/* Do the same thing access(2) does, but use the effective uid, + * and don't make the mistake of telling root that any file is + * executable. This version uses stat(2). + */ +int git_access(const char *path, int mode) +{ + struct stat st; + + /* do not interfere a normal user */ + if (geteuid()) + return access(path, mode); + + if (stat(path, &st) < 0) + return -1; + + /* Root can read or write any file. */ + if (!(mode & X_OK)) + return 0; + + /* Root can execute any file that has any one of the execute + * bits set. + */ + if (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) + return 0; + + errno = EACCES; + return -1; +} diff --git a/compat/fileno.c b/compat/fileno.c index 7b105f4cd7..8e80ef335d 100644 --- a/compat/fileno.c +++ b/compat/fileno.c @@ -1,4 +1,4 @@ -#define COMPAT_CODE +#define COMPAT_CODE_FILENO #include "../git-compat-util.h" int git_fileno(FILE *stream) -- cgit v1.3