From 3e28d45a4106a00d62c87b33763e3dba2d759145 Mon Sep 17 00:00:00 2001 From: retornam Date: Wed, 13 May 2026 13:55:45 -0700 Subject: [PATCH] Fix sticky bit handling in default mode --- README.md | 2 +- .../provisioner.go | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index fa0588e3..16b623da 100644 --- a/README.md +++ b/README.md @@ -295,7 +295,7 @@ spec: **Step 8: Controlling the permissions and ownership of subdirs** -By default new directories will be created with `root:root` ownership, and `0777` permissions in most environments. If you have a need to control this, you can do so by providing the `NFS_DEFAULT_MODE`, `NFS_DEFAULT_UID` and `NFS_DEFAULT_GID` environment variables (or the appropriate configuration in the Helm chart values). The mode must be an octal representation of a file mode, for example `777`, `0755` etc. The uid and gid must be the numeric ids of your desired user and group, so `1000` not `my_user`. +By default new directories will be created with `root:root` ownership, and `0777` permissions in most environments. If you have a need to control this, you can do so by providing the `NFS_DEFAULT_MODE`, `NFS_DEFAULT_UID` and `NFS_DEFAULT_GID` environment variables (or the appropriate configuration in the Helm chart values). The mode must be an octal representation of a file mode, for example `777`, `0755`, `2750` etc. The uid and gid must be the numeric ids of your desired user and group, so `1000` not `my_user`. If your usecase requires per-PVC ownership and/or mode, this can be done via annotations on your PVC: diff --git a/cmd/nfs-subdir-external-provisioner/provisioner.go b/cmd/nfs-subdir-external-provisioner/provisioner.go index 02ec6ef9..60746c54 100644 --- a/cmd/nfs-subdir-external-provisioner/provisioner.go +++ b/cmd/nfs-subdir-external-provisioner/provisioner.go @@ -258,10 +258,20 @@ func getModeFromString(mode string) (os.FileMode, error) { if err != nil { return 0, fmt.Errorf("invalid mode %s: %v", mode, err) } - if modeInt < 0 || modeInt > 0o777 { - return 0, fmt.Errorf("mode must be between 0 and 0777, got %s", mode) + if modeInt < 0 || modeInt > 0o7777 { + return 0, fmt.Errorf("mode must be between 0 and 07777, got %s", mode) } - return os.FileMode(modeInt), nil + fileMode := os.FileMode(modeInt & 0o777) + if modeInt&0o4000 != 0 { + fileMode |= os.ModeSetuid + } + if modeInt&0o2000 != 0 { + fileMode |= os.ModeSetgid + } + if modeInt&0o1000 != 0 { + fileMode |= os.ModeSticky + } + return fileMode, nil } func getIdFromString(id string) (int, error) {