Is it possible to keep setgid bit when unzipping files as non-root user?
Clash Royale CLAN TAG#URR8PPP up vote
2
down vote
favorite
I have a folder with the following permissions:
drwxrws--x+ 13 myuser www-data 4096 Mar 20 09:57 project-folder
In this folder I have an archive archive.zip with the following permissions:
-rw-rw----+ 1 myuser www-data 10260 Mar 20 09:56 archive.zip
When I unzipped archive by calling unzip archive.zip I got the following file listing:
drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 folder-from-archive
As we can see, the owner group is www-data as same for parent folder project-folder, but the folder-from-archive does not have the setgid bit (the s in the permissions string) and the content of this folder is not owned by group www-data:
-rw-rw----+ 1 myuser myuser 1083 May 5 2017 LICENSE
-rw-rw----+ 1 myuser myuser 2197 May 5 2017 README.md
-rw-rw----+ 1 myuser myuser 720 May 5 2017 autoload.php
-rw-rw----+ 1 myuser myuser 786 May 5 2017 composer.json
drwxrwx--x+ 3 myuser myuser 4096 May 5 2017 source
But when I tried unzipping this archive as root user the permissions and group owner (as well as the files in the folder) were correct:
drwxr-s--x+ 3 root www-data 4096 May 5 2017 folder-from-archive
Files in folder folder-from-archive:
-rw-r-----+ 1 root www-data 1083 May 5 2017 LICENSE
-rw-r-----+ 1 root www-data 2197 May 5 2017 README.md
-rw-r-----+ 1 root www-data 720 May 5 2017 autoload.php
-rw-r-----+ 1 root www-data 786 May 5 2017 composer.json
drwxr-s--x+ 3 root www-data 4096 May 5 2017 source
As we can see after unzipping by root user the folder inherited the setgid bit and set correct group www-data for itself and all containing files.
How to get the same behavior for the user myuser?
permissions root zip unzip acl
edited Mar 20 at 10:55
Zanna
48.1k13119228
asked Mar 20 at 10:40
koninka
111
add a comment |Â
up vote
2
down vote
favorite
I have a folder with the following permissions:
drwxrws--x+ 13 myuser www-data 4096 Mar 20 09:57 project-folder
In this folder I have an archive archive.zip with the following permissions:
-rw-rw----+ 1 myuser www-data 10260 Mar 20 09:56 archive.zip
When I unzipped archive by calling unzip archive.zip I got the following file listing:
drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 folder-from-archive
As we can see, the owner group is www-data as same for parent folder project-folder, but the folder-from-archive does not have the setgid bit (the s in the permissions string) and the content of this folder is not owned by group www-data:
-rw-rw----+ 1 myuser myuser 1083 May 5 2017 LICENSE
-rw-rw----+ 1 myuser myuser 2197 May 5 2017 README.md
-rw-rw----+ 1 myuser myuser 720 May 5 2017 autoload.php
-rw-rw----+ 1 myuser myuser 786 May 5 2017 composer.json
drwxrwx--x+ 3 myuser myuser 4096 May 5 2017 source
But when I tried unzipping this archive as root user the permissions and group owner (as well as the files in the folder) were correct:
drwxr-s--x+ 3 root www-data 4096 May 5 2017 folder-from-archive
Files in folder folder-from-archive:
-rw-r-----+ 1 root www-data 1083 May 5 2017 LICENSE
-rw-r-----+ 1 root www-data 2197 May 5 2017 README.md
-rw-r-----+ 1 root www-data 720 May 5 2017 autoload.php
-rw-r-----+ 1 root www-data 786 May 5 2017 composer.json
drwxr-s--x+ 3 root www-data 4096 May 5 2017 source
As we can see after unzipping by root user the folder inherited the setgid bit and set correct group www-data for itself and all containing files.
How to get the same behavior for the user myuser?
permissions root zip unzip acl
edited Mar 20 at 10:55
Zanna
48.1k13119228
asked Mar 20 at 10:40
koninka
111
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I have a folder with the following permissions:
drwxrws--x+ 13 myuser www-data 4096 Mar 20 09:57 project-folder
In this folder I have an archive archive.zip with the following permissions:
-rw-rw----+ 1 myuser www-data 10260 Mar 20 09:56 archive.zip
When I unzipped archive by calling unzip archive.zip I got the following file listing:
drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 folder-from-archive
As we can see, the owner group is www-data as same for parent folder project-folder, but the folder-from-archive does not have the setgid bit (the s in the permissions string) and the content of this folder is not owned by group www-data:
-rw-rw----+ 1 myuser myuser 1083 May 5 2017 LICENSE
-rw-rw----+ 1 myuser myuser 2197 May 5 2017 README.md
-rw-rw----+ 1 myuser myuser 720 May 5 2017 autoload.php
-rw-rw----+ 1 myuser myuser 786 May 5 2017 composer.json
drwxrwx--x+ 3 myuser myuser 4096 May 5 2017 source
But when I tried unzipping this archive as root user the permissions and group owner (as well as the files in the folder) were correct:
drwxr-s--x+ 3 root www-data 4096 May 5 2017 folder-from-archive
Files in folder folder-from-archive:
-rw-r-----+ 1 root www-data 1083 May 5 2017 LICENSE
-rw-r-----+ 1 root www-data 2197 May 5 2017 README.md
-rw-r-----+ 1 root www-data 720 May 5 2017 autoload.php
-rw-r-----+ 1 root www-data 786 May 5 2017 composer.json
drwxr-s--x+ 3 root www-data 4096 May 5 2017 source
As we can see after unzipping by root user the folder inherited the setgid bit and set correct group www-data for itself and all containing files.
How to get the same behavior for the user myuser?
permissions root zip unzip acl
edited Mar 20 at 10:55
Zanna
48.1k13119228
asked Mar 20 at 10:40
koninka
111
I have a folder with the following permissions:
drwxrws--x+ 13 myuser www-data 4096 Mar 20 09:57 project-folder
In this folder I have an archive archive.zip with the following permissions:
-rw-rw----+ 1 myuser www-data 10260 Mar 20 09:56 archive.zip
When I unzipped archive by calling unzip archive.zip I got the following file listing:
drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 folder-from-archive
As we can see, the owner group is www-data as same for parent folder project-folder, but the folder-from-archive does not have the setgid bit (the s in the permissions string) and the content of this folder is not owned by group www-data:
-rw-rw----+ 1 myuser myuser 1083 May 5 2017 LICENSE
-rw-rw----+ 1 myuser myuser 2197 May 5 2017 README.md
-rw-rw----+ 1 myuser myuser 720 May 5 2017 autoload.php
-rw-rw----+ 1 myuser myuser 786 May 5 2017 composer.json
drwxrwx--x+ 3 myuser myuser 4096 May 5 2017 source
But when I tried unzipping this archive as root user the permissions and group owner (as well as the files in the folder) were correct:
drwxr-s--x+ 3 root www-data 4096 May 5 2017 folder-from-archive
Files in folder folder-from-archive:
-rw-r-----+ 1 root www-data 1083 May 5 2017 LICENSE
-rw-r-----+ 1 root www-data 2197 May 5 2017 README.md
-rw-r-----+ 1 root www-data 720 May 5 2017 autoload.php
-rw-r-----+ 1 root www-data 786 May 5 2017 composer.json
drwxr-s--x+ 3 root www-data 4096 May 5 2017 source
As we can see after unzipping by root user the folder inherited the setgid bit and set correct group www-data for itself and all containing files.
How to get the same behavior for the user myuser?
permissions root zip unzip acl
permissions root zip unzip acl
edited Mar 20 at 10:55
Zanna
48.1k13119228
asked Mar 20 at 10:40
koninka
111
edited Mar 20 at 10:55
Zanna
48.1k13119228
asked Mar 20 at 10:40
koninka
111
edited Mar 20 at 10:55
Zanna
48.1k13119228
edited Mar 20 at 10:55
Zanna
48.1k13119228
edited Mar 20 at 10:55
Zanna
48.1k13119228
48.1k13119228
asked Mar 20 at 10:40
koninka
111
asked Mar 20 at 10:40
koninka
111
asked Mar 20 at 10:40
koninka
111
111
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53
add a comment |Â
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
0
down vote
That behavior was default but later it began to be considered as security issue (CVE-2005-0602).
unzip --help shows argument that should help: -K keep setuid/setgid/tacky permissions.
Therefore command should be unzip -K archive.zip.
answered Mar 20 at 11:49
mati865
11
I know about this option, but it does not work. I've already tried this by myuserunzip -K archive.zip, this is outputls -lcommand `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?
– koninka
Mar 20 at 12:42
I think-Kis default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq
– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.
– koninka
Mar 22 at 1:47
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
That behavior was default but later it began to be considered as security issue (CVE-2005-0602).
unzip --help shows argument that should help: -K keep setuid/setgid/tacky permissions.
Therefore command should be unzip -K archive.zip.
answered Mar 20 at 11:49
mati865
11
I know about this option, but it does not work. I've already tried this by myuserunzip -K archive.zip, this is outputls -lcommand `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?
– koninka
Mar 20 at 12:42
I think-Kis default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq
– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.
– koninka
Mar 22 at 1:47
add a comment |Â
up vote
0
down vote
That behavior was default but later it began to be considered as security issue (CVE-2005-0602).
unzip --help shows argument that should help: -K keep setuid/setgid/tacky permissions.
Therefore command should be unzip -K archive.zip.
answered Mar 20 at 11:49
mati865
11
I know about this option, but it does not work. I've already tried this by myuserunzip -K archive.zip, this is outputls -lcommand `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?
– koninka
Mar 20 at 12:42
I think-Kis default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq
– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.
– koninka
Mar 22 at 1:47
add a comment |Â
up vote
0
down vote
up vote
0
down vote
That behavior was default but later it began to be considered as security issue (CVE-2005-0602).
unzip --help shows argument that should help: -K keep setuid/setgid/tacky permissions.
Therefore command should be unzip -K archive.zip.
answered Mar 20 at 11:49
mati865
11
That behavior was default but later it began to be considered as security issue (CVE-2005-0602).
unzip --help shows argument that should help: -K keep setuid/setgid/tacky permissions.
Therefore command should be unzip -K archive.zip.
answered Mar 20 at 11:49
mati865
11
answered Mar 20 at 11:49
mati865
11
answered Mar 20 at 11:49
mati865
11
answered Mar 20 at 11:49
mati865
11
11
I know about this option, but it does not work. I've already tried this by myuserunzip -K archive.zip, this is outputls -lcommand `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?
– koninka
Mar 20 at 12:42
I think-Kis default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq
– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.
– koninka
Mar 22 at 1:47
add a comment |Â
I know about this option, but it does not work. I've already tried this by myuserunzip -K archive.zip, this is outputls -lcommand `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?
– koninka
Mar 20 at 12:42
I think-Kis default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq
– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.
– koninka
Mar 22 at 1:47
I know about this option, but it does not work. I've already tried this by myuser
unzip -K archive.zip, this is output ls -l command `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?– koninka
Mar 20 at 12:42
I know about this option, but it does not work. I've already tried this by myuser
unzip -K archive.zip, this is output ls -l command `drwxrwx--x+ 3 myuser www-data 4096 May 5 2017 project-folder. So, there is no setgid permissions. But why it's working for root without this option?– koninka
Mar 20 at 12:42
I think
-K is default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq– mati865
Mar 21 at 13:57
I think
-K is default for root user. Anyway it works for me: paste.ubuntu.com/p/WZMMJcxMgq– mati865
Mar 21 at 13:57
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (
chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.– koninka
Mar 22 at 1:47
Your example is incorrect. You should have different user owner and group owner, also u have to have setgid bit on the root folder (
chmod g+s folder) and inherit it after unzip (the goal is inherit owner group of root folder, owner group is different for the owner user, and unzipped dir also should have setgid bit.– koninka
Mar 22 at 1:47
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1017581%2fis-it-possible-to-keep-setgid-bit-when-unzipping-files-as-non-root-user%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Take a look at this question about preserving permissions.
– daumie
Mar 20 at 17:53