Errors found when using tar and ACL's

Question

Having difficulties with TAR and ACLs, and wondering if anyone had seen this before.
Here's the scenario: create a few directories and a few files. Tar it up and extract the files. Now assign some ACL's to them (some default for directories), tar it up, and extract the files. Permissions should remain the same. Under most circumstances they are.
Now repeat the procedure, but put a default directory ACL on the parent directory where the TAR is created. What happens is that the group permissions for anything un-tared gets trashed.
Here's a script to test it out.
Create a dummy user (I called mine foobar) -- required for setting ACL's. Run the script with the "-d" option at first. Things appear good. You can compare the permissions on the bottom for each file/directory.
Run the script with the "-s" option setting default ACL's on the parent.
#!/usr/bin/sh
ROOTDIR=/export/home/christian/config
TESTDIR=/export/home/christian
USER_X="oam"
# Run the script once with normal permissions (no ACL's) in the test directory (where tar is located)
# --> ./test.sh -d
# look at the result (ls -l) of .../sub1dir, .../sub1dir_acl, and /sub1dir_orig
# They should be relatively the same:
# --> rwxrwxrwx permissions on directories
# --> rw-rw-rw- on files
# Now run the script but set the parent directory of the script (where the TAR's are located) to have default ACL's
# --> /opt/MMSsyscnf/sub2dir/test/test.sh -s
# Now look at the result (ls -l) of .../sub1dir, .../sub1dir_acl, and /sub1dir_orig
# They are COMPLETELY skewed. Both times we tried to untar the files, ACL's wound up
# all over the place and permissions were not set correctly.
# --> rwxrwxrwx permissions ONLY on original directory (not the product of an UNTAR)
# --> rwxr--rwx permissions on directories created by untar
# --> rw-rw-rw- on files ONLY on original directory (not the product of an UNTAR)
# --> rw-r--rw- on files created by untar
# ****** Why is group affected by this, but "other" is not?! It's gotta be a bug!
# MAIN
ACTION="NOPREP"
while [ -n "$1" ]
do
if [ "ABC$1" = "ABC-d" ]; then
#flag set to try and remove default directory ACL's
setfacl -d u:$USER_X $TESTDIR
setfacl -d d:u:$USER_X $TESTDIR
setfacl -d d:u::,d:g::,d:m:,d:o: $TESTDIR
elif [ "ABC$1" = "ABC-s" ]; then
setfacl -r -m d:u::rw-,d:g::r--,d:o:---,d:m:rwx $TESTDIR
setfacl -r -m d:u:$USER_X:rw- $TESTDIR
setfacl -r -m u:$USER_X:r-x $TESTDIR
fi
shift;
done
# clean up previous run of the test
rm -r $ROOTDIR
# create files/directories
mkdir $ROOTDIR
mkdir $ROOTDIR/sub1dir
mkdir $ROOTDIR/sub1dir/sub2dir
mkdir $ROOTDIR/sub1dir/sub2dir/sub3dir
#set permissions
chmod 777 $ROOTDIR
chmod 777 $ROOTDIR/sub1dir
chmod 777 $ROOTDIR/sub1dir/sub2dir
chmod 777 $ROOTDIR/sub1dir/sub2dir/sub3dir
# create files
echo "" > $ROOTDIR/sub1dir/sub2dir/file1.txt
echo "" > $ROOTDIR/sub1dir/sub2dir/sub3dir/file2.txt
chmod 666 $ROOTDIR/sub1dir/sub2dir/file1.txt
chmod 666 $ROOTDIR/sub1dir/sub2dir/sub3dir/file2.txt
# tar/zip the files:
/usr/bin/tar -cvf $ROOTDIR/tarBeforeACLs.tar $ROOTDIR/sub1dir
/usr/bin/gzip $ROOTDIR/tarBeforeACLs.tar
# move the directory (so we keep the original as a template of what things should look like)
mv $ROOTDIR/sub1dir $ROOTDIR/sub1dir_orig
# untar/zip the files:
/usr/bin/gunzip $ROOTDIR/tarBeforeACLs.tar
/usr/bin/tar -xvf $ROOTDIR/tarBeforeACLs.tar
ls -lR $ROOTDIR
# Ok. These have been tested to be the exact same.
echo "********************************************************************************"
echo "********************************************************************************"
echo "********************************************************************************"
# Let's try using ACL's now
# --> directories (owned by root) must be acessible to OAM user.
# --> files (owned by root) must be read/writable by user OAM when created in the directories
setfacl -r -m u:$USER_X:r-x $ROOTDIR/sub1dir
setfacl -r -m u:$USER_X:r-x $ROOTDIR/sub1dir/sub2dir
setfacl -r -m u:$USER_X:r-x $ROOTDIR/sub1dir/sub2dir/sub3dir
setfacl -r -m u:$USER_X:rw- $ROOTDIR/sub1dir/sub2dir/file1.txt
setfacl -r -m u:$USER_X:rw- $ROOTDIR/sub1dir/sub2dir/sub3dir/file2.txt
setfacl -r -m d:u::rw-,d:g::r--,d:o:---,d:m:rwx $ROOTDIR/sub1dir
setfacl -r -m d:u:$USER_X:rw- $ROOTDIR/sub1dir
setfacl -r -m d:u::rw-,d:g::r--,d:o:---,d:m:rwx $ROOTDIR/sub1dir/sub2dir
setfacl -r -m d:u:$USER_X:rw- $ROOTDIR/sub1dir/sub2dir
setfacl -r -m d:u::rw-,d:g::r--,d:o:---,d:m:rwx $ROOTDIR/sub1dir/sub2dir/sub3dir
setfacl -r -m d:u:$USER_X:rw- $ROOTDIR/sub1dir/sub2dir/sub3dir
# here are things as they stand
ls -lR $ROOTDIR
echo "********************************************************************************"
echo "********************************************************************************"
echo "********************************************************************************"
# tar/zip the files:
/usr/bin/tar -cvfp $ROOTDIR/tarAfterACLs.tar $ROOTDIR/sub1dir
/usr/bin/gzip $ROOTDIR/tarAfterACLs.tar
# move the directory (so we keep the directory that was applied ACL's)
mv $ROOTDIR/sub1dir $ROOTDIR/sub1dir_acl
# untar/zip the files:
/usr/bin/gunzip $ROOTDIR/tarAfterACLs.tar
/usr/bin/tar -xvfp $ROOTDIR/tarAfterACLs.tar
# here are things after we've untared them
ls -lR $ROOTDIR
echo "********************************************************************************"
echo "********************************************************************************"
echo "********************************************************************************"
getfacl $ROOTDIR/sub1dir_orig $ROOTDIR/sub1dir_acl $ROOTDIR/sub1dir
echo "********************************************************************************"
getfacl $ROOTDIR/sub1dir_orig/sub2dir $ROOTDIR/sub1dir_acl/sub2dir $ROOTDIR/sub1dir/sub2dir
echo "********************************************************************************"
getfacl $ROOTDIR/sub1dir_orig/sub2dir/sub3dir $ROOTDIR/sub1dir_acl/sub2dir/sub3dir $ROOTDIR/sub1dir/sub2dir/sub3dir
echo "********************************************************************************"
getfacl $ROOTDIR/sub1dir_orig/sub2dir/file1.txt $ROOTDIR/sub1dir_acl/sub2dir/file1.txt $ROOTDIR/sub1dir/sub2dir/file1.txt
echo "********************************************************************************"
getfacl $ROOTDIR/sub1dir_orig/sub2dir/sub3dir/file2.txt $ROOTDIR/sub1dir_acl/sub2dir/sub3dir/file2.txt $ROOTDIR/sub1dir/sub2dir/sub3dir/file2.txt
echo "********************************************************************************"
Any ideas?

Answer 1

UFSDUMP has some limitations, including being on a file system that is read-only. Yes, I could force it on a read-write FS, but I normally stay away from big sticker labels found in man pages when I encounter them. :-(
What I was originally after was a script that makes a backup of application configuration files before I modify them. Thus, I tar/zip the directory.
These config files/directores have ACL's attached to them to allow various roles to access them (group permissions are not fine-grain enough). However, when I ran through a couple of tests, I came across a scenario that overwrote the original permissions. Tested it on Solaris 10 and Solaris 9, and both fail.
So now (very late into the feature design) I'm VERY concerned about using ACL's on Solaris, and wonder what other side-effects there are that I'm not aware of. Can't seem to find a bug report on it, so I thought I'd ask around to see if it was just the behaviour of the TAR/ACL that I'm not quite getting, or if it really is a bug.
/chris