From 955daa53c6fd7571a8550ccbf81d9a7ed3344709 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Sun, 12 Jul 2026 23:50:34 +0200
Subject: [PATCH] Fix to use physical ACL restore when supported
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ⓘ Detect support for combining `-P` with `setfacl --restore` to prevent acl 2.4.0 security warnings while retaining compatibility with older releases.
---
 web-lib-funcs.pl | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index 08927da2a..953a39e13 100755
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -11390,7 +11390,8 @@ elsif (defined($main::open_tempfiles{$_[0]})) {
 		}
 	if ($file_acls) {
 		# Set original ACLs
-		open(my $pipe, '|-', "$setfacl --restore=-");
+		my $restore_command = &get_setfacl_restore_command($setfacl);
+		open(my $pipe, '|-', $restore_command);
 		print($pipe $file_acls);
 		close($pipe);
 		}
@@ -11455,6 +11456,27 @@ if (!defined($main::selinux_enabled_cache)) {
 return $main::selinux_enabled_cache;
 }
 
+=head2 get_setfacl_restore_command(setfacl-command)
+
+Returns a command for restoring ACLs from standard input. Uses physical
+restore when supported by setfacl, while remaining compatible with versions
+older than 2.4.0 which reject -P together with --restore.
+
+=cut
+sub get_setfacl_restore_command
+{
+my ($setfacl) = @_;
+state %physical_restore_cache;
+
+if (!exists($physical_restore_cache{$setfacl})) {
+	my $help = &backquote_command("$setfacl --help 2>&1 </dev/null");
+	$physical_restore_cache{$setfacl} =
+		$help =~ /\[-P\]\s+--restore(?:=|\b)/ ? 1 : 0;
+	}
+my $physical = $physical_restore_cache{$setfacl} ? "-P " : "";
+return "$setfacl ${physical}--restore=-";
+}
+
 =head2 get_clear_file_attributes(file)
 
 Finds file attributes that may prevent writing, clears them and returns them