phingofficial / phingofficial/phing

DeleteTask not working with ACLs

Open
#1,088 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
PHP
Stars
1.2k
Forks
319
PR merge metrics
No merged PRs in 30d

Description

We are using file access control lists (ACLs) on our Linux systems because otherwise, we are not able to delete web server created files (e.g. caches or session files) with a non-root CLI script.

Example: we use setfacl on our cache directory like
setfacl -R -m u:www-data:rwX -m u:some-user:rwX cache

If the web server (www-data) is creating files in that folder, it looks like this

$ ll cache/
total 556
drwxrwxrwx+ 1 www-data www-data 11026 Jul  3 09:37 ./
drwxrwxrwx+ 1 www-data www-data    16 Jul  3 09:18 ../
-rw-------+ 1 www-data www-data   796 Jul  3 08:52 some_file

or with getfacl cache/some_file like this

$ getfacl cache/some_file
# file: some_file
# owner: www-data
# group: www-data
user::rw-
user:www-data:rwx		#effective:---
user:some-user:rwx		#effective:---
group::rwx			#effective:---
mask::---
other::---

Currently those files cannot be delete using DeleteTask like

<delete includeemptydirs="true">
  <fileset dir="cache/">
    <include name="**/*" />
  </fileset>
</delete>

even though some-user is able to delete those files on the console. The only unusual thing is just, that the console is confirming the removal, if rm is used without -f option

$ rm cache/some_file
rm: remove write-protected regular file 'cache/some_file'?

Alternatively you could also use rm -f cache/some_file to aviod the confirmation and the file is removed immediately.

Would it be possible to enable DeleteTask to delete ACLs (unprotected) files as well? Maybe with an attribute to "force" the delete? (force = true, default = false)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the DeleteTask entry point and reproduce the ACL-protected-file case using the setfacl, getfacl, and rm examples in the report. Read the task's existing deletion behavior and related tests, if present, then define completion as removing eligible ACL-protected files without breaking the current default behavior or confirmation semantics.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.