Skip to content

backup: Fix spurious "A Required Privilege Is Not Held by the Client" error#5019

Merged
MichaelEischer merged 3 commits intorestic:masterfrom
MichaelEischer:fix-windows-sd-race
Aug 29, 2024
Merged

backup: Fix spurious "A Required Privilege Is Not Held by the Client" error#5019
MichaelEischer merged 3 commits intorestic:masterfrom
MichaelEischer:fix-windows-sd-race

Conversation

@MichaelEischer
Copy link
Copy Markdown
Member

What does this PR change? What problem does it solve?

On Windows, creating a backup could sometimes print the following error

error: nodeFromFileInfo [...]: get named security info failed with: a required privilege is not held by the client.

This was caused by two threads concurrently retrieving security descriptors and both failing due to missing privileges. Then one thread would correctly enter the fallback path and retry with lower privileges whereas the other one prints an error. The error only occurs for the first files/folders that are processed by backup.

Was the change previously discussed in an issue or on the forum?

Fixes #5004

Checklist

  • I have read the contribution guidelines.
  • I have enabled maintainer edits.
  • I have added tests for all code changes.
  • [ ] I have added documentation for relevant changes (in the manual).
  • There's a new file in changelog/unreleased/ that describes the changes for our users (see template).
  • I have run gofmt on the code in all commits.
  • All commit messages are formatted in the same style as the other commits in the repo.
  • I'm done! This pull request is ready for review.

Calling `Load()` twice for an atomic variable can return different
values each time. This resulted in trying to read the security
descriptor with high privileges, but then not entering the code path to
switch to low privileges when another thread has already done so
concurrently.
The retry code path did not filter `ERROR_NOT_SUPPORTED`. Just call the
original function a second time to correctly follow the low privilege
code path.
Copy link
Copy Markdown
Member Author

@MichaelEischer MichaelEischer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@MichaelEischer MichaelEischer merged commit a0f2dfb into restic:master Aug 29, 2024
@MichaelEischer MichaelEischer deleted the fix-windows-sd-race branch August 29, 2024 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

error: nodeFromFileInfo: get named security info failed with: "Client doesn't have necessary privilege"

1 participant