Skip to content

mkdir: acl and permission inheritance with -p#11931

Open
j5awry wants to merge 2 commits intouutils:mainfrom
j5awry:mkdir-acl-inheritance-11036
Open

mkdir: acl and permission inheritance with -p#11931
j5awry wants to merge 2 commits intouutils:mainfrom
j5awry:mkdir-acl-inheritance-11036

Conversation

@j5awry
Copy link
Copy Markdown

@j5awry j5awry commented Apr 21, 2026 •
edited by cakebaker
Loading

Fixes #11036

Workflow for permission setting and ACLs failed in several scenarios, most notable when passing -p. Parent directories in the mkdir call would not appropriately set ACLs and could end up with more open permissions. Generally, there was a misunderstanding that GNU coreutils was setting umask (0) and that was the default -- the real flow was using a shaped umask that takes current umask and ensures that the user has the ability to execute mkdir commands through the tree. The umask (0) call was part of a read setup for the equivalent of our UmaskGuard. New workflow focuses on safe defaults, shaped umask, and allowing the Kernel to do to apply ACLs. Adds a test specifically to guard against regression, ensuring a more restrictive ACL is respected with mkdir -p

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 21, 2026 •
edited
Loading

GNU testsuite comparison:

Note: The gnu test tests/rm/many-dir-entries-vs-OOM is now being skipped but was previously passing.
Congrats! The gnu test tests/expand/bounded-memory is now passing!
Congrats! The gnu test tests/printf/printf-surprise is now passing!

@j5awry
mkdir: acl and permission inheritance with -p
c3bf7c8 
Workflow for permission setting and ACLs failed in several scenarios,
most notable when passing -p. Parent directories in the mkdir call would
not appropriately set ACLs and could end up with more open permissions.
Generally, there was a misunderstanding that GNU coreutils was setting
umask (0) and that was the default -- the real flow was using a shaped
umask that takes current umask and ensures that the user has the ability
to execute mkdir commands through the tree. The umask (0) call was part
of a read setup for the equivalent of our UmaskGuard. New workflow
focuses on safe defaults, shaped umask, and allowing the Kernel to do
to apply ACLs. Adds a test specifically to guard against regression,
ensuring a more restrictive ACL is respected with mkdir -p
@j5awry j5awry force-pushed the mkdir-acl-inheritance-11036 branch from 36827d3 to c3bf7c8 Compare April 21, 2026 15:06
@j5awry
mkdir: cast mode bits to rustix::fs::RawMode
da0bbac 
rustix::fs::Mode::from_bits_truncated accepts u32 on Linux and u16 on
MacOS. Casting to rustix::fs::RawMode makes the value compatible on
either platform.
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Apr 21, 2026

Merging this PR will improve performance by 31.27%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 308 untouched benchmarks
⏩ 46 skipped benchmarks1

Performance Changes

Mode Benchmark BASE HEAD Efficiency
⚡ Memory cp_recursive_deep_tree[(120, 4)] 699.2 KB 532.7 KB +31.27%

Comparing j5awry:mkdir-acl-inheritance-11036 (da0bbac) with main (8cc048b)

Open in CodSpeed

Footnotes

  1. 46 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@j5awry
Copy link
Copy Markdown
Author

j5awry commented Apr 23, 2026

as an integration test, i made a patch and applied it to 0.8.0-ubuntu3 (making 0.8.0-ubuntu4~ppa1) in a PPA. This is runnable on resolute (i used an lxc container with lxc launch ubuntu-daily:resolute acl-test )

https://launchpad.net/~jchittum/+archive/ubuntu/rust-coreutils-lp2138215

I then ran the acl package tests that are most interesting. copying here for anyone else to test manually. it's a direct copy, $ = command , > = output

Default ACL
	 
	$ umask 027
	$ mkdir d
	$ setfacl -m u:bin:rwx,u:daemon:rw,d:u:bin:rwx,d:m:rx d
	$ ls -dl d | awk '{print $1}'
	> drwxrwx---+

	$ getfacl --omit-header d
	> user::rwx
	> user:bin:rwx
	> user:daemon:rw-
	> group::r-x
	> mask::rwx
	> other::---
	> default:user::rwx
	> default:user:bin:rwx	#effective:r-x
	> default:group::r-x
	> default:mask::r-x
	> default:other::---
	> 
	 
Umask now ignored?
 
	$ umask 027
	$ touch d/f
	$ ls -dl d/f | awk '{print $1}'
	> -rw-r-----+

	$ getfacl --omit-header d/f
	> user::rw-
	> user:bin:rwx	#effective:r--
	> group::r-x	#effective:r--
	> mask::r--
	> other::---
	> 

	$ rm d/f
	$ umask 022
	$ touch d/f
	$ ls -dl d/f | awk '{print $1}'
	> -rw-r-----+

	$ getfacl --omit-header d/f
	> user::rw-
	> user:bin:rwx	#effective:r--
	> group::r-x	#effective:r--
	> mask::r--
	> other::---
	> 

	$ rm d/f
	 
Default ACL copying
 
	$ umask 000
	$ mkdir d/d
	$ ls -dl d/d | awk '{print $1}'
	> drwxr-x---+

	$ getfacl --omit-header d/d
	> user::rwx
	> user:bin:rwx	#effective:r-x
	> group::r-x
	> mask::r-x
	> other::---
	> default:user::rwx
	> default:user:bin:rwx	#effective:r-x
	> default:group::r-x
	> default:mask::r-x
	> default:other::---
	> 

	$ rmdir d/d
	$ umask 022
	$ mkdir d/d
	$ ls -dl d/d | awk '{print $1}'
	> drwxr-x---+

	$ getfacl --omit-header d/d
	> user::rwx
	> user:bin:rwx	#effective:r-x
	> group::r-x
	> mask::r-x
	> other::---
	> default:user::rwx
	> default:user:bin:rwx	#effective:r-x
	> default:group::r-x
	> default:mask::r-x
	> default:other::---
	> 
	 
Add some users and groups
 
	$ setfacl -nm u:daemon:rx,d:u:daemon:rx,g:users:rx,g:daemon:rwx d/d
	$ ls -dl d/d | awk '{print $1}'
	> drwxr-x---+

	$ getfacl --omit-header d/d
	> user::rwx
	> user:bin:rwx	#effective:r-x
	> user:daemon:r-x
	> group::r-x
	> group:daemon:rwx	#effective:r-x
	> group:users:r-x
	> mask::r-x
	> other::---
	> default:user::rwx
	> default:user:bin:rwx	#effective:r-x
	> default:user:daemon:r-x
	> default:group::r-x
	> default:mask::r-x
	> default:other::---
	>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

mkdir creates child directories with setuid+sticky bits (mode 05775) when parent has default POSIX ACLs

1 participant

@j5awry