[pbs-devel] [PATCH proxmox-backup] fix 5304: client: set process uid/gid for .pxarexclude-cli

[Gabriel Goller]

On Tue Apr 30, 2024 at 5:37 PM CEST, Christian Ebner wrote:
> The .pxarexclude-cli encodes the exclude patterns the client was
> invoked with in the pxar archive as regular file entry. The current
> behaviour of setting the uid and gid to default 0 (root) causes
> however issues when trying to backup and restore the backup as
> non-root user.
>
> Opt for using the uid/gid of the user the executable was called as,
> allowing the restore for this user to succeed. Root will succeed
> to restore anyways.
>
> Link to issue in bugtracker:
> https://bugzilla.proxmox.com/show_bug.cgi?id=5304
>
> Signed-off-by: Christian Ebner <c.ebner at proxmox.com>
> ---
>  pbs-client/src/pxar/create.rs | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
> index 60efb0ce5..a5afde7af 100644
> --- a/pbs-client/src/pxar/create.rs
> +++ b/pbs-client/src/pxar/create.rs
> @@ -404,6 +404,10 @@ impl Archiver {
>  
>          let mut metadata = Metadata::default();
>          metadata.stat.mode = pxar::format::mode::IFREG | 0o600;
> +        // use uid/gid of client process so the backup snapshot might be restored by the same
> +        // potentially non-root user
> +        metadata.stat.uid = unsafe { libc::getuid() };
> +        metadata.stat.gid = unsafe { libc::getgid() };
>  
>          let mut file = encoder
>              .create_file(&metadata, ".pxarexclude-cli", content.len() as u64)

This is a good addition, ran into this myself a few times. The chown
fails and throws an error although the pxarexclude file is correctly
restored (albeit with the current user's permission).

Consider: 
Tested-by: Gabriel Goller <g.goller at proxmox.com>