[Bug-tar] Bug#361077: tar -x without -p of 777 directory alternately sets wrong mode

[Ian Jackson]

Package: tar
Version: 1.15.1-2
Tags: patch

An Ubuntu user reports at
 https://launchpad.net/distros/ubuntu/+source/tar/+bug/19540
that:
 If you have a tarball containing a mode 777 directory and your umask
 is set to 022, tar(1) will change the permissions on that directory
 every time you unpack it.

This is indeed true; the behaviour is very odd.  The bug happens
whenever you extract from a tarfile a directory when the directory
already exists and the version in the tarfile has more permissive
permissions than your umask.  In this case, the permissions of the
on-disk directory permissions will toggle between the version which
complies with your umask (which would be correct, without -p) and the
version from the tarfile.

(If you have --same-permissions (-p) or are root without
--no-same-permissions, then the bug doesn't happen.)

Attached is the patch which I have applied to Ubuntu's tar to fix the
problem.  I'm pretty confident it's correct and you should probably
apply it to Debian's GNU tar, and upstream GNU tar, too.

Also, I noticed that if you attempt to extract a tarfile (at least,
one which contains directories and files inside them) as non-root
without -p with a umask which excludes 0100 or 0200, tar falls over
because it obeys the umask when creating the directories and is then
unable to access the files inside.  It would be possible for tar to
avoid this problem because it already has machinery for copying with
overly-restrictive permissions inside the tarfile.  However, I'm not
sure whether this should be considered a bug or even a misfeature - a
perfectly plausible answer to people with insane umasks is `don't do
that then'.

Ian.

diff -u tar-1.15.1/debian/changelog tar-1.15.1/debian/changelog
--- tar-1.15.1/debian/changelog
+++ tar-1.15.1/debian/changelog
@@ -1,3 +1,10 @@
+tar (1.15.1-2ubuntu2) dapper; urgency=low
+
+  * Do not mess with directory permissions when extracting
+    without -p.  Malone 19540.
+
+ -- Ian Jackson <address@hidden>  Wed,  5 Apr 2006 17:25:15 +0100
+
 tar (1.15.1-2ubuntu1) dapper; urgency=low
 
   * SECURITY UPDATE: Arbitrary code execution with crafted tar files.
only in patch2:
unchanged:
--- tar-1.15.1.orig/src/extract.c
+++ tar-1.15.1/src/extract.c
@@ -1065,7 +1065,7 @@
                    }
                  if (S_ISDIR (st.st_mode))
                    {
-                     mode = st.st_mode & ~ current_umask;
+                     mode = st.st_mode;
                      goto directory_exists;
                    }
                }
@@ -1085,11 +1085,17 @@
        }
 
     directory_exists:
+      /* Now if same_permissions_option > 0, `mode' is the actual
+       * permissions of the existing directory.  Otherwise `mode'
+       * may be wrong but we don't use it in that case.
+       */
       if (status == 0
          || old_files_option == DEFAULT_OLD_FILES
          || old_files_option == OVERWRITE_OLD_FILES)
        delay_set_stat (file_name, &current_stat_info.stat,
-                       MODE_RWX & (mode ^ current_stat_info.stat.st_mode),
+                       (0 < same_permissions_option
+                        ? MODE_RWX & (mode ^ current_stat_info.stat.st_mode)
+                        : 0),
                        (status == 0
                         ? ARCHIVED_PERMSTATUS
                         : UNKNOWN_PERMSTATUS));