4 ms·

Do tarballs still have that unfixed/unfixable bug where the extracted files will have the permissions of the person who untarr'd the file?

delinka 8y ago
I think you mean owner rather than permissions. In most cases, you want to maintain permissions/file mode (read/write/execute) but not the original owner.
- AdmiralAsshat 8y ago
  Except it doesn't do either. I've had files that had 666 user:group permissions/owner that I tar into a backup file, then untar, only to find that the file is now 664 with me:me ownership. It's brought production to a halt on more than one occasion if I try to "restore" from a backup by extracting the files and moving into production without manually fixing them first.
  - noja 8y ago
    What was your umask?
  - delinka 8y ago
    Your umask affects mode during extraction. You can pass -p to tar asking tar to attempt to restore exactly the modes in the archive. If you extract as root, it'll preserve the owner and group. Otherwise, the default is to assign the owner and group of the user running tar.
  - dozzie 8y ago
    > I've had files that had 666 user:group permissions/owner that I tar into a backup file, then untar, only to find that the file is now 664 with me:me ownership. It was PEBKAC, not tar's fault (GNU tar, anyway). Tar does store the original owner and permissions. But the ownership of the unpacked files -- do you really expect your process to set ownership of the files to another user? The permissions would also be restored to 666 if you ran the tar as root; there are several options whose defaults depend on whether EUID is 0 or not.
master-litty 8y ago
That seems sensible to me, what else would you expect?
- AdmiralAsshat 8y ago
  I expect that they should preserve the ownership and permissions of the original file if I tell it to.
  - rakoo 8y ago
    How can it have the same owner if it's a different machine, and users aren't the same ?
    - spookthesunset 8y ago
      Do tarballs store the user/group names as strings or do they store the uid/gid instead? It is one of the goofy things about Unix systems is most tools speak uid/gid and woah is you if two machines on the network have “bob” only as different uid’s. Not entirely sure if windows has the same problem as to be honest if you use active directory most of that stuff is auto-magic. My hunch is that going with the ID vs. the “friendly name” has a bunch of trade offs and whichever you pick will come with serious drawbacks.
      - saulrh 8y ago
        I feel you're on the right track with that hunch - Zooko's triangle should apply in some way.
      - justincormack 8y ago
        They can do either - traditional tar formats have uid as a number, but the newer pax format has both numeric and named values.
        Hello71 8y ago
        in fact, names are the default. "--numeric-owner" must be passed to use numeric values.
oconnor663 8y ago
Or where the paths in the tarball can start with `..`?
vinceguidry 8y ago
You can use the --same-owner flag and extract the tarball as root in order to preserve ownership. The -p flag ensures that the permissions umask will match the archive's as well.
tannhaeuser 8y ago
It's a feature: you must be running tar as root or equivalently to restore to uids/gids other than the effective process uid. Otherwise you could happily overwrite any host system file including parts of the O/S. It's a restriction shared by all archivers.
Grue3 8y ago
I like the amazing "feature" where the act of extracting a tar file into a directory can change permissions on this directory. You have to pass --no-overwrite-dir flag to disable this.
cyphar 8y ago
That's a detail of the extraction tool. In umoci (which extracts tar archives as part of an OCI image)[1] you can remap the users or even extract as yourself and then add an xattr which represents the original owner in the archive (which is then read back when creating a new tar archive from the delta of the rootfs). [1]: https://github.com/openSUSE/umoci https://github.com/openSUSE/umoci

delinka 8y ago

I think you mean owner rather than permissions. In most cases, you want to maintain permissions/file mode (read/write/execute) but not the original owner.

AdmiralAsshat 8y ago
Except it doesn't do either. I've had files that had 666 user:group permissions/owner that I tar into a backup file, then untar, only to find that the file is now 664 with me:me ownership. It's brought production to a halt on more than one occasion if I try to "restore" from a backup by extracting the files and moving into production without manually fixing them first.
- noja 8y ago
  What was your umask?
- delinka 8y ago
  Your umask affects mode during extraction. You can pass -p to tar asking tar to attempt to restore exactly the modes in the archive. If you extract as root, it'll preserve the owner and group. Otherwise, the default is to assign the owner and group of the user running tar.
- dozzie 8y ago
  > I've had files that had 666 user:group permissions/owner that I tar into a backup file, then untar, only to find that the file is now 664 with me:me ownership. It was PEBKAC, not tar's fault (GNU tar, anyway). Tar does store the original owner and permissions. But the ownership of the unpacked files -- do you really expect your process to set ownership of the files to another user? The permissions would also be restored to 666 if you ran the tar as root; there are several options whose defaults depend on whether EUID is 0 or not.

master-litty 8y ago

That seems sensible to me, what else would you expect?

AdmiralAsshat 8y ago
I expect that they should preserve the ownership and permissions of the original file if I tell it to.
- rakoo 8y ago
  How can it have the same owner if it's a different machine, and users aren't the same ?
  - spookthesunset 8y ago
    Do tarballs store the user/group names as strings or do they store the uid/gid instead? It is one of the goofy things about Unix systems is most tools speak uid/gid and woah is you if two machines on the network have “bob” only as different uid’s. Not entirely sure if windows has the same problem as to be honest if you use active directory most of that stuff is auto-magic. My hunch is that going with the ID vs. the “friendly name” has a bunch of trade offs and whichever you pick will come with serious drawbacks.
    - saulrh 8y ago
      I feel you're on the right track with that hunch - Zooko's triangle should apply in some way.
    - justincormack 8y ago
      They can do either - traditional tar formats have uid as a number, but the newer pax format has both numeric and named values.
      - Hello71 8y ago
        in fact, names are the default. "--numeric-owner" must be passed to use numeric values.

oconnor663 8y ago

Or where the paths in the tarball can start with `..`?

vinceguidry 8y ago

You can use the --same-owner flag and extract the tarball as root in order to preserve ownership. The -p flag ensures that the permissions umask will match the archive's as well.

tannhaeuser 8y ago

It's a feature: you must be running tar as root or equivalently to restore to uids/gids other than the effective process uid. Otherwise you could happily overwrite any host system file including parts of the O/S. It's a restriction shared by all archivers.

Grue3 8y ago

I like the amazing "feature" where the act of extracting a tar file into a directory can change permissions on this directory. You have to pass --no-overwrite-dir flag to disable this.

cyphar 8y ago

That's a detail of the extraction tool. In umoci (which extracts tar archives as part of an OCI image)[1] you can remap the users or even extract as yourself and then add an xattr which represents the original owner in the archive (which is then read back when creating a new tar archive from the delta of the rootfs). [1]: https://github.com/openSUSE/umoci https://github.com/openSUSE/umoci