{"action":"closed","issue":{"url":"https://api.github.com/repos/cooperative-computing-lab/cctools/issues/887","labels_url":"https://api.github.com/repos/cooperative-computing-lab/cctools/issues/887/labels{/name}","comments_url":"https://api.github.com/repos/cooperative-computing-lab/cctools/issues/887/comments","events_url":"https://api.github.com/repos/cooperative-computing-lab/cctools/issues/887/events","html_url":"https://github.com/cooperative-computing-lab/cctools/issues/887","id":100330332,"number":887,"title":"Chirp should not resolve the target path for ACL checks for `link`","user":{"login":"batrick","id":548304,"avatar_url":"https://avatars.githubusercontent.com/u/548304?v=3","gravatar_id":"","url":"https://api.github.com/users/batrick","html_url":"https://github.com/batrick","followers_url":"https://api.github.com/users/batrick/followers","following_url":"https://api.github.com/users/batrick/following{/other_user}","gists_url":"https://api.github.com/users/batrick/gists{/gist_id}","starred_url":"https://api.github.com/users/batrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/batrick/subscriptions","organizations_url":"https://api.github.com/users/batrick/orgs","repos_url":"https://api.github.com/users/batrick/repos","events_url":"https://api.github.com/users/batrick/events{/privacy}","received_events_url":"https://api.github.com/users/batrick/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cooperative-computing-lab/cctools/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/cooperative-computing-lab/cctools/labels/Chirp","name":"Chirp","color":"fef2c0"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-11T14:49:34Z","updated_at":"2015-08-11T15:15:54Z","closed_at":"2015-08-11T15:15:54Z","body":"The `link` RPC, as with the normal UNIX `link` syscall, allows for symbolic links to be hard linked. For example:\r\n\r\n````\r\n$ ln -s foo bar\r\n$ ln bar baz\r\n$ ls -la bar baz\r\nlrwxrwxrwx 2 batrick users 3 Aug 11 10:45 bar -> foo\r\nlrwxrwxrwx 2 batrick users 3 Aug 11 10:45 baz -> foo\r\n````\r\n\r\nCurrently the Chirp server would perform ACL checks on the resolved target, in this case `foo` instead of `bar`. If this symbolic link points somewhere the current subject lacks rights, then the RPC will fail with permission denied.\r\n\r\nThe fix is to use `chirp_acl_check_link` instead of `chirp_acl_check` on the target."}}