0

While trying to make my tarballs reproducible, i followed this guide.

As a side-effect I noticed that I can easily create a tar-file that, when unpacked will change the permissions of the current working directory (where i extract my files into).

Like so:

				
rm -rf /tmp/user mkdir -p /tmp/user/test
touch /tmp/user/test/README.txt ls -lhan /tmp/user/ /tmp/user/test/README.txt 
-rw-r--r-- 1 11002 11002    0 Sep 15 10:31 /tmp/user/test/README.txt
/tmp/user/:
total 32K
drwxr-xr-x  3 11002 11002 4.0K Sep 15 10:31 .
drwxrwxrwt 23     0     0  20K Sep 15 10:31 ..
drwxr-xr-x  2 11002 11002 4.0K Sep 15 10:31 test
cd /tmp/user/test tar --numeric-owner --owner=0 --group=0 --mode="go-rwx,u-w" --transform 's|./|foobar/|' 
      -czf ../foobar.tgz .
tar tvf ../foobar.tgz dr-x------ 0/0               0 2021-09-15 10:25 ./ -r-------- 0/0               0 2021-09-15 10:25 foobar/README.txt cd /tmp/user/
tar xvf foobar.tgz ls -lhan
total 40K
dr-x------  4 11002 11002 4.0K Sep 15 10:31 .
drwxrwxrwt 23     0     0  20K Sep 15 10:31 ..
drwxr-xr-x  2 11002 11002 4.0K Sep 15 10:33 foobar
-rw-r--r--  1 11002 11002  143 Sep 15 10:32 foobar.tgz
drwxr-xr-x  2 11002 11002 4.0K Sep 15 10:31 test
rm foobar.tgz  rm: cannot remove 'foobar.tgz': Permission denied

So what happens is:

  • the tarfile contains a
    ./
    entry that has permissions
    0500
    (aka
    r-x------
    )
  • when extracting the tarfile it will also extract the
    ./
    direcctory (which happens to be the current directory) and sets its permissions to the ones found in the archive
  • after the operation, the user can no longer remove files from this directory and others can no longer do anything with it.

this comes as a big surprise. it might render the system "unusable" for the user (e.g. effectively running

chmod a-rwx
on the users home directory).

of course it is easy enough to restore the permissions - if you have heard of

chmod
before (something the typical Ubuntu user might not) and you remember the prior permissions (something I cannot say for myself and an arbitrary directory where i would extract a tarball)

so my question is twofold:

  • how can i prevent
    tar --extract
    to change the permissions of my current working directory while still preserving the permissions of the other files in the archive?
  • how can I prevent
    tar --create
    from actually creating such an archive (so that it also works for people that don't know the answer to the first question), while still prepending a known path-component)?

edit

i probably already found parts of the answer to my 2nd question.

Changing the path mangling to

--transform 's|^.|foobar|'
will also mangle the
./
entry into
foobar/
, which will then get the permissions declared in the archive (and leave my current working directory alone). I wonder though why
--transform 's|./|foobar/|'
will not mangle
./
(as it seems this matches the
./
regex nicely.