aboutsummaryrefslogtreecommitdiff
path: root/internal
diff options
context:
space:
mode:
Diffstat (limited to 'internal')
-rw-r--r--internal/fusefrontend/node.go4
-rw-r--r--internal/nametransform/perms.go24
2 files changed, 21 insertions, 7 deletions
diff --git a/internal/fusefrontend/node.go b/internal/fusefrontend/node.go
index 80d642c..87ba835 100644
--- a/internal/fusefrontend/node.go
+++ b/internal/fusefrontend/node.go
@@ -239,6 +239,10 @@ func (n *Node) Setattr(ctx context.Context, f fs.FileHandle, in *fuse.SetAttrIn,
defer syscall.Close(dirfd)
// chmod(2)
+ //
+ // gocryptfs.diriv & gocryptfs.longname.[sha256].name files do NOT get chmod'ed
+ // or chown'ed with their parent file/dir for simplicity.
+ // See nametransform/perms.go for details.
if mode, ok := in.GetMode(); ok {
errno = fs.ToErrno(syscallcompat.FchmodatNofollow(dirfd, cName, mode))
if errno != 0 {
diff --git a/internal/nametransform/perms.go b/internal/nametransform/perms.go
index 98b51d6..cfcd062 100644
--- a/internal/nametransform/perms.go
+++ b/internal/nametransform/perms.go
@@ -1,16 +1,26 @@
package nametransform
const (
- // Permissions for gocryptfs.diriv files
+ // Permissions for gocryptfs.diriv files.
+ // The gocryptfs.diriv files are created once, never modified,
+ // never chmod'ed or chown'ed.
//
- // It makes sense to have the diriv files group-readable so the FS can
- // be mounted from several users from a network drive (see
- // https://github.com/rfjakob/gocryptfs/issues/387 ).
+ // Group-readable so the FS can be mounted by several users in the same group
+ // (see https://github.com/rfjakob/gocryptfs/issues/387 ).
//
// Note that gocryptfs.conf is still created with 0400 permissions so the
// owner must explicitly chmod it to permit access.
- dirivPerms = 0440
+ //
+ // World-readable so an encrypted directory can be copied by the non-root
+ // owner when gocryptfs is running as root
+ // ( https://github.com/rfjakob/gocryptfs/issues/539 ).
+ dirivPerms = 0444
- // Permissions for gocryptfs.longname.[sha256].name files
- namePerms = 0400
+ // Permissions for gocryptfs.longname.[sha256].name files.
+ // The .name files are created once, never modified,
+ // never chmod'ed or chown'ed.
+ //
+ // Group- and world-readable for the same reasons as the gocryptfs.diriv
+ // files (see above).
+ namePerms = 0444
)