From a9c75e76895641510338124331fc837cefac1872 Mon Sep 17 00:00:00 2001 From: r-vdp Date: Thu, 8 May 2025 12:13:50 +0200 Subject: [PATCH] make-initrd-ng: fix file permissions We want to strip the write bit from files after we copied them. XOR is not the right operator for this, since if the bit is 0 in both the actual permissions and the mask, then the result will be a 1. So in practice, we were assigning write permissions for group and others to all files and we were only stripping the write permissions of the owner (since the owner had write permissions, and so the result of the XOR is 0). The correct thing to do is to AND with the maximum permissions that we want to maintain (which is the inverse of what we want to strip), so that only those bits are preserved and the others are always set to 0. --- pkgs/build-support/kernel/make-initrd-ng/src/main.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs index 64c114f2d9fa..149c5393e35a 100644 --- a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs +++ b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs @@ -212,7 +212,7 @@ fn copy_file< } // Remove writable permissions - permissions.set_mode(permissions.mode() ^ 0o222); + permissions.set_mode(permissions.mode() & 0o555); fs::set_permissions(&target, permissions) .wrap_err_with(|| format!("failed to remove writable permissions for {:?}", target))?; };