From: "afazio (Alfred Fazio)" <alfred.fazio@...>
Date: 2013-02-21T06:04:31+09:00
Subject: [ruby-core:52597] [ruby-trunk - Bug #7886] Not recognizing unix group permissions for Mac OS X (Mountain Lion) Active Directory (AD) mobile accounts


Issue #7886 has been updated by afazio (Alfred Fazio).

File ruby-rb_group_member-ngroups.patch added

So, to summarize, this is not a problem with AD.  This is an issue for any user that is a member of more than 16 groups in OS X.

It just so happened that my AD user account has many NTDOMAIN groups that it is a member of, which inflated my group membership to well over 16.

I propose that the minimum NGROUPS be set at 32.  I'm sure there are other ways to solve the issue, however.

I've attached a patch for the rb_group_member() function in file.c that ensures a minimum of 32 for NGROUPS.

I've compiled Ruby with this patch and it indeed fixes the issue.
----------------------------------------
Bug #7886: Not recognizing unix group permissions for Mac OS X (Mountain Lion) Active Directory (AD) mobile accounts
https://bugs.ruby-lang.org/issues/7886#change-36686

Author: afazio (Alfred Fazio)
Status: Feedback
Priority: High
Assignee: nobu (Nobuyoshi Nakada)
Category: core
Target version: next minor
ruby -v: ruby 1.9.3p374 (2013-01-15 revision 38858) [x86_64-darwin12.2.1]


The following bug occurs in 1.9.3 p374 and also in 1.8.7 p371

When using a Active Directory mobile account in Mac OS X (only tested thus far with Mountain Lion), Ruby does not honor Unix group membership when testing file permissions.

Let me give an example:

% whoami
afazio

# I am in the "rvm" group:

% groups
<snip> rvm <snip>

# Let's create a simple file:
% touch test-file
% sudo chown root:rvm test-file
% sudo chmod 660 test-file

% ls -l test-file
-rw-rw----  1 root  rvm  4 Feb 19 11:43 test-file

# At this moment only root and members of "rvm" group can modify test-file
# OS recognizes I have correct permissions:
% echo "test data" >> test-file
% cat test-file
test data

# However, Ruby does not:
% irb
1.9.3-p374 :001 > File.exists?("test-file")
 => true
1.9.3-p374 :002 > File.writable?("test-file")
 => false

# To further illustrate, I **can** write to this file in Ruby:

pry(main)> File.open("test-file", "w") do |f|
pry(main)*   f.write("wee")  
pry(main)* end  
3
pry(main)> quit

% cat test-file
wee



-- 
http://bugs.ruby-lang.org/