migrate: keep the greeter ACL when merging legacy dirs

core/internal/utils/dirs.go

@@ -64,6 +64,8 @@ func migrateLegacyDir(oldDir, newDir string) error {
 		}
 		return err
 	}
+	// dms-greeter sync grants the greeter group read access through an ACL on the legacy dir.
+	copyDirACL(oldDir, newDir)
 	if err := os.Remove(oldDir); err != nil {
 		return errors.New("legacy dir " + oldDir + " still has entries that also exist in " + newDir)
 	}

core/internal/utils/dirs_acl_linux.go

@@ -0,0 +1,33 @@
+//go:build linux
+
+package utils
+
+import "golang.org/x/sys/unix"
+
+var dirACLXattrs = []string{"system.posix_acl_access", "system.posix_acl_default"}
+
+func copyDirACL(src, dst string) {
+	for _, name := range dirACLXattrs {
+		value, ok := readXattr(src, name)
+		if !ok {
+			continue
+		}
+		if _, exists := readXattr(dst, name); exists {
+			continue
+		}
+		_ = unix.Setxattr(dst, name, value, 0)
+	}
+}
+
+func readXattr(path, name string) ([]byte, bool) {
+	size, err := unix.Getxattr(path, name, nil)
+	if err != nil || size <= 0 {
+		return nil, false
+	}
+	buf := make([]byte, size)
+	n, err := unix.Getxattr(path, name, buf)
+	if err != nil {
+		return nil, false
+	}
+	return buf[:n], true
+}

core/internal/utils/dirs_acl_other.go

@@ -0,0 +1,5 @@
+//go:build !linux
+
+package utils
+
+func copyDirACL(src, dst string) {}