diff --git a/src/libostree/ostree-repo-checkout.c b/src/libostree/ostree-repo-checkout.c index bb7c1771..2b259464 100644 --- a/src/libostree/ostree-repo-checkout.c +++ b/src/libostree/ostree-repo-checkout.c @@ -749,8 +749,18 @@ checkout_tree_at_recurse (OstreeRepo *self, */ if (!did_exist) { - if (TEMP_FAILURE_RETRY (fchmod (destination_dfd, mode)) < 0) - return glnx_throw_errno (error); + guint32 canonical_mode; + /* Silently ignore world-writable directories (plus sticky, suid bits, + * etc.) when doing a checkout for bare-user-only repos. This is related + * to the logic in ostree-repo-commit.c for files. + * See also: https://github.com/ostreedev/ostree/pull/909 i.e. 0c4b3a2b6da950fd78e63f9afec602f6188f1ab0 + */ + if (self->mode == OSTREE_REPO_MODE_BARE_USER_ONLY) + canonical_mode = (mode & 0775) | S_IFDIR; + else + canonical_mode = mode; + if (TEMP_FAILURE_RETRY (fchmod (destination_dfd, canonical_mode)) < 0) + return glnx_throw_errno_prefix (error, "fchmod"); } if (!did_exist && options->mode != OSTREE_REPO_CHECKOUT_MODE_USER) diff --git a/tests/test-basic-user-only.sh b/tests/test-basic-user-only.sh index deca0e00..29fbbdd3 100755 --- a/tests/test-basic-user-only.sh +++ b/tests/test-basic-user-only.sh @@ -22,7 +22,7 @@ set -euo pipefail . $(dirname $0)/libtest.sh setup_test_repository "bare-user-only" -extra_basic_tests=2 +extra_basic_tests=3 . $(dirname $0)/basic-test.sh # Reset things so we don't inherit a lot of state from earlier tests @@ -59,3 +59,15 @@ $CMD_PREFIX ostree pull-local --repo=repo repo-input $CMD_PREFIX ostree --repo=repo checkout -U -H content-with-group-writable groupwritable-co assert_file_has_mode groupwritable-co/some-group-writable 664 echo "ok supported group writable" + +cd ${test_tmpdir} +rm repo-input -rf +ostree_repo_init repo-input init --mode=archive +rm files -rf && mkdir files +mkdir files/worldwritable-dir +chmod a+w files/worldwritable-dir +$CMD_PREFIX ostree --repo=repo-input commit -b content-with-dir-world-writable --tree=dir=files +$CMD_PREFIX ostree pull-local --repo=repo repo-input +$CMD_PREFIX ostree --repo=repo checkout -U -H content-with-dir-world-writable dir-co +assert_file_has_mode dir-co/worldwritable-dir 775 +echo "ok didn't make world-writable dir"