Bug 112948

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Description of problem:
I am seeing an unexpected access restriction while unlinking/
renaming a file in a directory with a 'sticky bit' (S_ISVTX)
set (see the Steps to Reproduce).

The permission settings of the file allow any 'users' group 
member to modify the file 'stickydir/file'. However an attempt 
to unlink the file or replace it with another file is not allowed.

The current behavior of unlink/rename is superfluous because
it does not increase security -- the unlinking/renaming error
can be bypassed by opening the file and rewriting its contents.

Here is one unintended effect of this access restriction. Say,
I wish to modify the file in a "fail-safe" manner. So I would 
prepare an updated version of a file as a tempfile, and then 
make a single system call: rename(tempfile, file). But because
of the current access restriction, rename() will not work!!!
So, the "fail-safe" is impossible with such a file. Instead, I
have to truncate the file, and then write it piece-by-piece.
BUT if interrupted, the file is left in an inconsistent state.

I believe, the unlink/rename/rmdir should succeed if the access
permissions allow modification of the target file/directory.

Thanks!

Version-Release number of selected component (if applicable):
2.4.9-31

How reproducible:
Always

Steps to Reproduce:
#
# Step 1: create a directory with a 'sticky bit' set
#
$ mkdir stickydir
$ chmod 1775 stickydir
$ ls -ld stickydir
rwxrwxr-t   2 user1 users         512 Jan 05 16:10 stickydir

#
# Step 2: create a group-writeable file
#
$ touch stickydir/file
$ chmod 660 stickydir/file
$ ls -l stickydir/file
-rw-rw----   1 user1 users           0 Jan 05 16:11 stickydir/file

#
# Step 3: log in as another user of group 'users'
#
$ su user2
user2's Password:
% groups
users

#
# Step 4: modifying the file succeeds as expected
#
% echo XXX >> stickydir/file
% cat stickydir/file
XXX

#
# Step 5: deleting the file UNEXPECTEDLY FAILS
#
% rm stickydir/file
rm: cannot remove `stickydir/file': Operation not permitted

Additional info: