In downward API support (simultaneously with this in code supporting the FreeBSD OS has revealed a critical (), leading to a violation of access rights processing. The essence of the problem is that rights set for the group were processed as rights for the file owner. The issue in the update . The fix up to of the FreeBSD HEAD codebase to OpenZFS.
The problem was caused by the fact that all Access Control List (ACL) entries set for the group owner (group@) and regular groups (group:) were delegated to the current user.
For example, the access mode 0770 (write allowed only for group members) was processed as 0777 (write allowed for all users). A similar situation was observed with ACLs, for instance, the following ACL became equivalent to permissions 0777, as the group member check for builtin_administrators returned True.
# owner: root
# group: wheel
group:builtin_administrators:rwxpDdaARWcCos:——-:allow
Additionally, another issue has been identified in the OpenZFS port for FreeBSD regarding providing rights to change into a directory (cd), regardless of the execution flag state for directories. Entering a directory was possible even when explicitly denied through ACL ('deny — execute')
Source: opennet.ru
