Text editing bug: Not permitted to perform this action

[edshot99]

A file with the permission of 664 in a directory with a permission of 775 can be edited with vi in a terminal.
When I try to edit the same file through the Cockpit file browser it throws an error of 'Not permitted to perform this action'.
I tried to find more information through the web inspector and journalctl, but I couldn't find anything.

Cockpit versions

cockpit.x86_64                                 334.2-1.0.1.el9_6                   @ol9_baseos_latest 
cockpit-bridge.x86_64                          334.2-1.0.1.el9_6                   @ol9_baseos_latest 
cockpit-files.noarch                           16-1.el9                            @ol9_appstream     
cockpit-packagekit.noarch                      334.2-1.0.1.el9_6                   @ol9_appstream     
cockpit-storaged.noarch                        334.2-1.0.1.el9_6                   @ol9_appstream     
cockpit-system.noarch                          334.2-1.0.1.el9_6                   @ol9_baseos_latest 
cockpit-ws.x86_64                              334.2-1.0.1.el9_6                   @ol9_baseos_latest 

[jelly]

We use test -w to determine if you can edit such a file, what is the result of test -w $filename && echo "ok" in the cockpit terminal?

[edshot99]

[edshot99]

Found out the issue is caused by cockpit file.replace() trying to set a user id that isn't the account editing.
I just removed the tag to get around it, but the real fix is to set chown for current account editing and the original group if the account is in that group.

https://github.com/cockpit-project/cockpit/blob/main/src/cockpit/channels/filesystem.py#L223

[jelly]

Found out the issue is caused by cockpit file.replace() trying to set a user id that isn't the account editing.

We read the current uid/gid from the file and try to write it back the same. Are you editing a file you don't own as root by having "administrative access"?

I just removed the tag to get around it, but the real fix is to set chown for current account editing and the original group if the account is in that group.

I have read over this a few times now and I don't understand what you are trying to say, do you mind elaborating?

[edshot99]

We read the current uid/gid from the file and try to write it back the same. Are you editing a file you don't own as root by having "administrative access"?

No since I don't want people to use administrative access because the file can be edited with group permissions.
Editing the file with vi works because it doesn't tamper the uid of the file (1002) even if other users 1003 or 1004 are editing it because they are all in the same user group (1002).

Cockpit file.replace() breaks this because its trying to run chown 1002:1002 as user 1003.

I have read over this a few times now and I don't understand what you are trying to say, do you mind elaborating?

diff --git a/src/dialogs/editor.tsx b/src/dialogs/editor.tsx
index b463041..b36dc9b 100644
--- a/src/dialogs/editor.tsx
+++ b/src/dialogs/editor.tsx
@@ -115,7 +115,7 @@ class Editor extends EventEmitter<{ updated(state: EditorState): void }> {
             const content_with_nl = content && !content.endsWith('\n') ? content + '\n' : content;
 
             this.update({ saving: true });
-            const tag = await this.file.replace(content_with_nl, this.state.tag_now);
+            const tag = await this.file.replace(content_with_nl);
             this.update({ saving: false, modified: false, tag_now: tag, tag_at_load: tag });
         } catch (exc: any /* eslint-disable-line @typescript-eslint/no-explicit-any */) {
             this.update({ error: exc, saving: false });

With the tag (this.state.tag_now) removed the cockpit chmod/chown commands are skipped and the file is able to be saved albeit without the preserved permissions, but its fine for me at the moment.

As for a proper fix it'd be modifying the linked file in the last post to make it so that instead of chown 1002:1002 it'd be chown 1003:1002 since regular users are not going to (and shouldn't) have admin access to be able to do the first chown command.