bin/41419: pax doesn't handle hard link meta-information correctly when using mtree inputs

[lloyd%must-have-coffee.gen.nz@localhost]

>Number:         41419
>Category:       bin
>Synopsis:       pax doesn't handle hard link meta-information correctly when 
>using mtree inputs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 13 01:45:00 +0000 2009
>Originator:     Lloyd Parkes
>Release:        5.0
>Organization:
Must Have Coffee
>Environment:
NetBSD rhox.must-have-coffee.gen.nz 5.0 NetBSD 5.0 (GENERIC) #0: Sat May  2 
20:44:13 NZST 2009  
lloyd%rhox.must-have-coffee.gen.nz@localhost:/vol/scratch/obj5/amd64/sys/arch/amd64/compile/GENERIC
 amd64

>Description:
There is a bug in NetBSD's pax that affect syspkgs. When pax is 
pulling meta information from an mtree file, it gets the file permissions for 
hard links wrong. The mtree specs that we use for sets and syspkgs only have 
complete meta information for the first hard link to a file. For subsequent 
links, pax uses the mtree default meta information, 
instead of the meta information from the first hard link, which is wrong. This 
doesn't show up in the install sets, because the default mtree ownerships are 
set to group:wheel, which happens to be the right value, even though it was 
found the wrong way. syspkgs don't set any default meta information in the 
mtree spec, so pax has to use a default default, which is the meta 
information on the file system.

The result is that we get this

-r-xr-xr-x  1 root     wheel      22018 May 10 13:14 sbin/swapctl
-r-xr-xr-x  2 lloyd    wheel          0 May 10 13:14 sbin/swapon == 
sbin/swapctl

instead of this

-r-xr-xr-x  1 root     wheel      22018 May 10 13:14 ./sbin/swapctl
-r-xr-xr-x  2 root     wheel          0 May 10 13:14 ./sbin/swapon 
== ./sbin/swapctl

Of course, once pax sets the second ownership during file extraction, we lose. 

I guess that means that there are two bugs on our pax. 1) We should store the 
right information in the archive, and 2) we shouldn't update the file's meta 
information when we are creating a hard link to it.

>How-To-Repeat:
Build syspkgs as an unprivileged user and then run 

  tar tvzf 
RELEASEDIR/MACHINE/binary/syspkgs/base-sysutil-root-5.0.0.20090420.tgz  |grep 
sbin/swap

And see it report your account name.


>Fix:
None yet.