bug: chmod() and chown() return values silently ignored in metadata restore #31

New Issue

2026-07-20T14:57:41+02:00

TapTap commented

2026-07-20 14:57:41 +02:00

In src/shared/metadata.c, the return values of security-critical system calls are silently discarded:

Line 99: chmod() return value ignored

chmod(path, metadata->mode & 07777);

Line 100-101: chown() return value explicitly suppressed

int chown_ret = chown(path, metadata->uid, metadata->gid);
(void)chown_ret;

This means:

If chmod fails (e.g., permission denied, read-only filesystem), the operation silently continues with incorrect permissions
If chown fails (e.g., not running as root), the operation silently continues with wrong ownership
Users will not be notified that metadata restoration failed, which could lead to security issues (wrong file permissions)

Fix: Check return values and log warnings/errors when metadata restoration fails.

Severity: high

In `src/shared/metadata.c`, the return values of security-critical system calls are silently discarded: **Line 99:** `chmod()` return value ignored ```c chmod(path, metadata->mode & 07777); ``` **Line 100-101:** `chown()` return value explicitly suppressed ```c int chown_ret = chown(path, metadata->uid, metadata->gid); (void)chown_ret; ``` This means: 1. If `chmod` fails (e.g., permission denied, read-only filesystem), the operation silently continues with incorrect permissions 2. If `chown` fails (e.g., not running as root), the operation silently continues with wrong ownership 3. Users will not be notified that metadata restoration failed, which could lead to security issues (wrong file permissions) **Fix:** Check return values and log warnings/errors when metadata restoration fails. **Severity:** high

TapTap referenced this issue from a commit

2026-07-20 17:09:16 +02:00

Fix 11 Gitea issues (#29, #30, #31, #35, #38, #41, #42, #43, #44, #45, #46)

TapTap referenced this issue

2026-07-20 17:13:18 +02:00

Fix 11 Gitea issues — bugs, quality, security, and refactoring #47

TapTap closed this issue

2026-07-20 17:51:45 +02:00

Sign in to join this conversation.