bug#44627: 25.2; tempsetmodes handling does not update extended attributes

bug#44627: 25.2; tempsetmodes handling does not update extended attributes

[Michael Young]

This bug report will be sent to the Bug-GNU-Emacs mailing list
and the GNU bug tracker at debbugs.gnu.org.  Please check that
the From: line contains a valid email address.  After a delay of up
to one day, you should receive an acknowledgment at that address.

Please write in English if possible, as the Emacs maintainers
usually do not have translators for other languages.

Please describe exactly what actions triggered the bug, and
the precise symptoms of the bug.  If you can, give a recipe
starting from 'emacs -Q':

Open a read-only file, toggle read-only mode, and modify the file.
Attempt to save the file.
Answer "yes" to the prompt
   File <FILENAME> is write-protected; try to save anyway? (yes or no)

If the filesystem housing <FILENAME> supports extended attributes,
the attempt to temporarily change the file mode doesn't do anything,
and the subsequent attempt to write fails in basic-save-buffer-2:
     Opening output file: Permission denied, <FILENAME>

This section of files.el appears to be the problem:
     https://github.com/emacs-mirror/emacs/blob/d408866ff2a0de7af5d8bb40d9c1c310573f1800/lisp/files.el#L5444

It retrieves the extended attributes, but then does not make any changes
to them before setting them.  If the attempt to set the extended
attributes fails, it falls back on set-file-modes to set the
POSIX user write permission (128) -- that appears to work as intended.

I'm not sure whether the right fix is to add the write bit in the extended-attributes
ACL entry somehow, or to execute the set-file-modes (with the 128 bit)
even when there are extended attirbutes.  The description of
file-extended-attributes at the top of files.el says that they
are platform-specific metadata, so it's not clear to me how to
modify the ACL in a portable way, or if there is library support
for doing that.

I have encountered this behavior in several different versions of emacs,
including 25.2.2 and 27.1.

Let me know if you need any more information.

Thanks for your support!

If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
     'bt full' and 'xbacktrace'.
For information about debugging Emacs, please read the file
/usr/share/emacs/25.2/etc/DEBUG.


In GNU Emacs 25.2.2 (x86_64-pc-linux-gnu, GTK+ Version 3.22.21)
  of 2017-09-22, modified by Debian built on lgw01-amd64-050
System Description:     Ubuntu 18.04.4 LTS

Configured using:
  'configure --build x86_64-linux-gnu --prefix=/usr
  --sharedstatedir=/var/lib --libexecdir=/usr/lib
  --localstatedir=/var/lib --infodir=/usr/share/info
  --mandir=/usr/share/man --with-pop=yes
  --enable-locallisppath=/etc/emacs25:/etc/emacs:/usr/local/share/emacs/25.2/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/25.2/site-lisp:/usr/share/emacs/site-lisp
  --with-sound=alsa --without-gconf --build x86_64-linux-gnu
  --prefix=/usr --sharedstatedir=/var/lib --libexecdir=/usr/lib
  --localstatedir=/var/lib --infodir=/usr/share/info
  --mandir=/usr/share/man --with-pop=yes
  --enable-locallisppath=/etc/emacs25:/etc/emacs:/usr/local/share/emacs/25.2/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/25.2/site-lisp:/usr/share/emacs/site-lisp
  --with-sound=alsa --without-gconf --with-x=yes --with-x-toolkit=gtk3
  --with-toolkit-scroll-bars 'CFLAGS=-g -O2
  -fdebug-prefix-map=/build/emacs25-jYekUr/emacs25-25.2+1=. -fstack-protector-strong
  -Wformat -Werror=format-security -Wall' 'CPPFLAGS=-Wdate-time
  -D_FORTIFY_SOURCE=2' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro''

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS NOTIFY
ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11

Important settings:
   value of $LANG: en_US.UTF-8
   locale-coding-system: utf-8-unix

Major mode: Fundamental

Minor modes in effect:
   tooltip-mode: t
   global-eldoc-mode: t
   mouse-wheel-mode: t
   tool-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t
   line-number-mode: t
   transient-mark-mode: t

Recent messages:
Loading /etc/emacs/site-start.d/50dictionaries-common.el (source)...done
Loading /etc/emacs/site-start.d/50lilypond-data.el (source)...done
Loading /home/mwyoung/lib/emacs/mwyoung.el (source)...done
For information about GNU Emacs and the GNU system, type <f1> C-a.
Mark set
Note: file is write protected
Read-Only mode disabled in current buffer
‘toggle-read-only’ is an obsolete command (as of 24.3); use ‘read-only-mode’ instead.
Saving file /tmp/hi...
basic-save-buffer-2: Opening output file: Permission denied, /tmp/hi

Load-path shadows:
/usr/share/emacs/25.2/site-lisp/debian-startup hides /usr/share/emacs/site-lisp/debian-startup
/home/mwyoung/lib/emacs/vi hides /usr/share/emacs/25.2/lisp/obsolete/vi

Features:
(shadow sort mail-extr emacsbug message format-spec rfc822 mml mml-sec
password-cache epg epg-config gnus-util mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util help-fns help-mode easymenu cl-loaddefs pcase
cl-lib mail-prsvr mail-utils dired time-date mule-util tooltip eldoc
electric uniquify ediff-hook vc-hooks lisp-float-type mwheel x-win
term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list newcomment elisp-mode lisp-mode prog-mode register page
menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core frame cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese charscript case-table epa-hook jka-cmpr-hook help
simple abbrev minibuffer cl-preloaded nadvice loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
dbusbind inotify dynamic-setting system-font-setting font-render-setting
move-toolbar gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 104135 6434)
  (symbols 48 19842 0)
  (miscs 40 48 135)
  (strings 32 14416 4804)
  (string-bytes 1 411539)
  (vectors 16 9391)
  (vector-slots 8 385376 17862)
  (floats 8 162 258)
  (intervals 56 8579 0)
  (buffers 976 20))

bug#44627: 25.2; tempsetmodes handling does not update extended attributes

[Lars Ingebrigtsen]

Michael Young <mwy-hsyzfo@the-youngs.org> writes:

> Open a read-only file, toggle read-only mode, and modify the file.
> Attempt to save the file.
> Answer "yes" to the prompt
>   File <FILENAME> is write-protected; try to save anyway? (yes or no)
>
> If the filesystem housing <FILENAME> supports extended attributes,
> the attempt to temporarily change the file mode doesn't do anything,
> and the subsequent attempt to write fails in basic-save-buffer-2:
>     Opening output file: Permission denied, <FILENAME>
>
> This section of files.el appears to be the problem:
>     https://github.com/emacs-mirror/emacs/blob/d408866ff2a0de7af5d8bb40d9c1c310573f1800/lisp/files.el#L5444
>
> It retrieves the extended attributes, but then does not make any changes
> to them before setting them.  If the attempt to set the extended
> attributes fails, it falls back on set-file-modes to set the
> POSIX user write permission (128) -- that appears to work as intended.

(I'm going through old bug reports that unfortunately weren't resolved
at the time.)

This bug report is about Emacs 25.2, but the code is still essentially
the same today:

	;; If file not writable, see if we can make it writable
	;; temporarily while we write it.
	;; But no need to do so if we have just backed it up
	;; (setmodes is set) because that says we're superseding.
	(cond ((and tempsetmodes (not setmodes))
	       ;; Change the mode back, after writing.
	       (setq setmodes (list (file-modes buffer-file-name)
				    (file-extended-attributes buffer-file-name)
				    buffer-file-name))
	       ;; If set-file-extended-attributes fails, fall back on
	       ;; set-file-modes.
	       (unless
		   (with-demoted-errors "Error setting attributes: %s"
		     (set-file-extended-attributes buffer-file-name
						   (nth 1 setmodes)))
		 (set-file-modes buffer-file-name
				 (logior (car setmodes) 128)))))

I.e., it's reading the extended attributes -- and then setting the
extended attributes to exactly what they were, which seems nonsensical.
Is this anything but a NOOP on any system?

For this to work, Emacs would have to (as Michael points out) actually
modify the extended attributes to allow writing, but does Emacs have any
functions to do that?  A brief poke around doesn't seem to reveal
anything -- anybody know?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no