Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve customizability for UMASK and default permissions #36367

Open
MartinBrugnara opened this issue Jan 25, 2023 · 0 comments
Open

Improve customizability for UMASK and default permissions #36367

MartinBrugnara opened this issue Jan 25, 2023 · 0 comments
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap enhancement feature: filesystem

Comments

@MartinBrugnara
Copy link
Contributor

How to use GitHub

  • Please use the 👍 reaction to show that you are interested into the same feature.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status changes and new comments.

Improve customizability for UMASK and default permissions

Respect user $UMASK and facl while ensuring NC can write & manage the folders it creates e5dc1a8.

Possible Solution 0

Stop playing with permissions.

Add checks in the " Security & setup warnings " section for FS configuration.
Then, in normal workflow, report any FS errors to both admin and users.

Possible Solution 1

If we have to play with permissions, instead of overriding $UMASK before creating the file and forcing a default chmod:

  • create the file / directory (without modifying the env)
  • check if the permissions are sufficient,
    • if not, extend them by adding only the minimal set of permissions needed to the group.
  • support configuring also $MIN_PERM_F and $MIN_PERM_D instead of hardcoding (we may want NC to rely on the user or the group or on all)...

Bonus

Since we are manipulating the permissions anyway, we may want to try playing nice with NFS & friends:

  • basic:
    • allow mapping users to uid (local or ldap)
    • chown the file uploaded by that user as user_uid:oc_gid
  • gold:
    • allow mapping user and groups to uid/gid (local or ldap)
    • maintain in sync NC ACLs with facl ACLs
      This, combined with inotify support (which NC kinda has-- INotify file watcher ) for change detection, would be magic.
      The flexibility and ease of use of Nextcloud while accessing remotely.
      The performance of NFS when needed.

Context

Deprecates: #29041 #25280
Builds upon: #32723 (merge&shipped NC 25)

@MartinBrugnara MartinBrugnara added 0. Needs triage Pending check for reproducibility or if it fits our roadmap enhancement labels Jan 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap enhancement feature: filesystem
Projects
None yet
Development

No branches or pull requests

2 participants