Bug 13406 - The uid and gid of the soft link is changed after decompressing with the busybox tar
Summary: The uid and gid of the soft link is changed after decompressing with the busy...
Status: NEW
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: 1.31.x
Hardware: All Linux
: P5 normal
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-23 06:39 UTC by xiechengliang
Modified: 2021-01-27 22:04 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description xiechengliang 2020-12-23 06:39:26 UTC
Soft links created by ordinary users, after being compressed, the root user uses the busybox tar to decompress, and the owner of the soft link will become root. 
It is expected that the owner of the soft link will remain unchanged after decompression. Is this a bug?

eg.
$ ls -l
drwx------    2 test     test             0 Jan  7 16:21 test
lrwxrwxrwx    1 test     test            12 Jan  7 16:21 test_link -> test/test.sh

$ busybox tar czf test.tar.gz test test_link

$ mkdir result; cd result

# Unzip with the root user, the owner of the soft link becomes root
$busybox tar xzf ../test.tar.gz
drwx------    2 test     test             0 Jan  7 16:25 test
lrwxrwxrwx    1 root     root            12 Jan  7 16:25 test_link -> test/test.sh
Comment 1 alt.j2-4o4s2yon 2021-01-27 22:04:29 UTC
gnu tar defaults to recreate UIDs stored in tarballs by calling chown when the tarball is extracted as root. this is a super annoying default as it breaks usage in sandboxes like ones using unshare (if the chown() syscall fails, tar returns with failure status).
additionally in the internet age 99% of the tarballs the average person extracts are created by other people on the net, and you certainly don't want to have files with random UIDs that don't even have associated users on your box splattered around your fs.
on gnu tar, one has to pass --no-same-owner to get rid of this utterly annoying default.

i'm glad busybox does it the right way.

arguably it might make sense for use cases like xie's if there would be a flag that's equivalent to --same-owner for GNU tar.