Patch sent upstream (to Stephan Kulow) on 2009-04-06. -- Michal

commit e5dcc8beda99ffb4cb19b8eef024dbc22b010d54

Author: Michal Schmidt <mschmidt@redhat.com>

Date:   Sun Apr 5 23:32:32 2009 +0200

    fix permissions in the cache dir

    The way icecream changes permissions of /var/cache/icecream is buggy.

    When the daemon initializes, it creates the directory owned by root:root

    and readable for everyone. As soon as it installs a foreign environment,

    it changes the owner to root:icecream and removes access for everyone

    else.  This causes trouble for locally run icecc which wants read access

    to /var/cache/icecream/native. As a result, local compile jobs can no

    longer determine the native environment and fail to get distributed to

    other nodes.

    This patch assigns the owners and permissions like this:

    0755 root:root      /var/cache/icecream/

    0775 root:icecream  /var/cache/icecream/native/

    0770 root:icecream  /var/cache/icecream/target=<target>/

    0770 root:icecream  /var/cache/icecream/target=<target>/<hash>/

    It also sets the umask in the initialization of the daemon so that we

    can depend on it being sane and we no longer need some of the chmods.

    The access() check in start_install_environment() can be dropped,

    because if we don't have access, we'll soon find out anyway.

diff --git a/daemon/environment.cpp b/daemon/environment.cpp

index 9dc2831..979da91 100644

--- a/daemon/environment.cpp

+++ b/daemon/environment.cpp

@@ -180,8 +180,6 @@ bool cleanup_cache( const string &basedir )

             log_perror( "mkdir in cleanup_cache() failed" );

         return false;

     }

-    chown( basedir.c_str(), 0, 0 );

-    chmod( basedir.c_str(), 0755 );

     return ret;

 }

@@ -219,14 +217,14 @@ size_t setup_env_cache(const string &basedir, string &native_environment, uid_t

     if ( ::access( "/usr/bin/gcc", X_OK ) || ::access( "/usr/bin/g++", X_OK ) ) 

 	return 0;

-    if ( mkdir( nativedir.c_str(), 0755 ) )

+    if ( mkdir( nativedir.c_str(), 0775 ) )

    	return 0; 

-    if ( chown( nativedir.c_str(), nobody_uid, nobody_gid) ) {

+    if ( chown( nativedir.c_str(), 0, nobody_gid ) ||

+         chmod( nativedir.c_str(), 0775 ) ) {

 	rmdir( nativedir.c_str() );

 	return 0;

     }

-    chmod( nativedir.c_str(), 0755 );

     flush_debug();

     pid_t pid = fork();

@@ -251,7 +249,6 @@ size_t setup_env_cache(const string &basedir, string &native_environment, uid_t

         }

     }

     // else

-    umask(022);

     if ( setgid( nobody_gid ) < 0) {

       log_perror("setgid failed");

@@ -313,30 +310,28 @@ pid_t start_install_environment( const std::string &basename, const std::string

             compression = BZip2;

     }

-    if( ::access( basename.c_str(), W_OK ) ) {

-       log_error() << "access for basename " <<  basename.c_str() << " gives " << strerror(errno) << endl;

-       return 0;

-    }

-

-    chown( basename.c_str(), 0, nobody_gid );

-    chmod( basename.c_str(), 0770 );

-

-    if ( mkdir( dirname.c_str(), 0755 ) && errno != EEXIST ) {

+    if ( mkdir( dirname.c_str(), 0770 ) && errno != EEXIST ) {

         log_perror( "mkdir target" );

         return 0;

     }

-    chown( dirname.c_str(), 0, nobody_gid );

-    chmod( dirname.c_str(), 0770 );

+    if ( chown( dirname.c_str(), 0, nobody_gid ) ||

+         chmod( dirname.c_str(), 0770 ) ) {

+        log_perror( "chown,chmod target" );

+        return 0;

+    }

     dirname = dirname + "/" + name;

-    if ( mkdir( dirname.c_str(), 0700 ) ) {

+    if ( mkdir( dirname.c_str(), 0770 ) ) {

         log_perror( "mkdir name" );

         return 0;

     }

-    chown( dirname.c_str(), 0, nobody_gid );

-    chmod( dirname.c_str(), 0770 );

+    if ( chown( dirname.c_str(), 0, nobody_gid ) ||

+         chmod( dirname.c_str(), 0770 ) ) {

+        log_perror( "chown,chmod name" );

+        return 0;

+    }

     int fds[2];

     if ( pipe( fds ) )

diff --git a/daemon/main.cpp b/daemon/main.cpp

index 17fc761..7a6498f 100644

--- a/daemon/main.cpp

+++ b/daemon/main.cpp

@@ -1598,6 +1598,8 @@ int main( int argc, char ** argv )

         }

     }

+    umask(022);

+

     if ( !logfile.length() && detach)

         logfile = "/var/log/iceccd";