mirror of
https://github.com/vhaudiquet/ecrou.git
synced 2026-11-12 22:22:44 +00:00
vhaudiquet
1fb3f0c076
With preservation on, the crate chmods every file to the mode it ships as it extracts, and one refused bit killed the whole run: alpine's usr/bin/chage ships setgid-shadow (02755, group shadow), and an extracting context that cannot set the bit - an overlayfs tmp, a confined sandbox - fails the chmod with EPERM and takes the boot down with "failed to set permissions to 2755". The crate's own chmod now runs with the special bits masked off, which no filesystem refuses, and the shipped modes ride the fixups like directory modes already do: applied after the walk, degraded to plain rwx when the filesystem refuses them, exact everywhere else. Unprivileged tar degrades the same way; the guest re-applies whatever it needs. The setgid regression test pins the round trip.