Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1511815

[PATCH 4.4 19/51] posix_acl: Clear SGID bit when setting file permissions

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 19/51] posix_acl: Clear SGID bit when setting file permissions
Date 2016-10-29 16:30 +0200
Message-ID <sxCNZ-7nb-71@gated-at.bofh.it> (permalink)
References <sxCkW-6TH-31@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <jack@suse.cz>

commit 073931017b49d9458aa351605b43a7e34598caef upstream.

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/9p/acl.c               |   40 +++++++++++++++++-----------------------
 fs/btrfs/acl.c            |    6 ++----
 fs/ceph/acl.c             |    6 ++----
 fs/ext2/acl.c             |   12 ++++--------
 fs/ext4/acl.c             |   12 ++++--------
 fs/f2fs/acl.c             |    6 ++----
 fs/gfs2/acl.c             |   12 +++---------
 fs/hfsplus/posix_acl.c    |    4 ++--
 fs/jffs2/acl.c            |    9 ++++-----
 fs/jfs/acl.c              |    6 ++----
 fs/ocfs2/acl.c            |   10 ++++------
 fs/posix_acl.c            |   31 +++++++++++++++++++++++++++++++
 fs/reiserfs/xattr_acl.c   |    8 ++------
 fs/xfs/xfs_acl.c          |   13 ++++---------
 include/linux/posix_acl.h |    1 +
 15 files changed, 84 insertions(+), 92 deletions(-)

--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -282,32 +282,26 @@ static int v9fs_xattr_set_acl(const stru
 	switch (handler->flags) {
 	case ACL_TYPE_ACCESS:
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			retval = posix_acl_equiv_mode(acl, &mode);
-			if (retval < 0)
+			struct iattr iattr;
+
+			retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
+			if (retval)
 				goto err_out;
-			else {
-				struct iattr iattr;
-				if (retval == 0) {
-					/*
-					 * ACL can be represented
-					 * by the mode bits. So don't
-					 * update ACL.
-					 */
-					acl = NULL;
-					value = NULL;
-					size = 0;
-				}
-				/* Updte the mode bits */
-				iattr.ia_mode = ((mode & S_IALLUGO) |
-						 (inode->i_mode & ~S_IALLUGO));
-				iattr.ia_valid = ATTR_MODE;
-				/* FIXME should we update ctime ?
-				 * What is the following setxattr update the
-				 * mode ?
+			if (!acl) {
+				/*
+				 * ACL can be represented
+				 * by the mode bits. So don't
+				 * update ACL.
 				 */
-				v9fs_vfs_setattr_dotl(dentry, &iattr);
+				value = NULL;
+				size = 0;
 			}
+			iattr.ia_valid = ATTR_MODE;
+			/* FIXME should we update ctime ?
+			 * What is the following setxattr update the
+			 * mode ?
+			 */
+			v9fs_vfs_setattr_dotl(dentry, &iattr);
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -83,11 +83,9 @@ static int __btrfs_set_acl(struct btrfs_
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			ret = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (ret < 0)
+			ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (ret)
 				return ret;
-			if (ret == 0)
-				acl = NULL;
 		}
 		ret = 0;
 		break;
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -94,11 +94,9 @@ int ceph_set_acl(struct inode *inode, st
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			ret = posix_acl_equiv_mode(acl, &new_mode);
-			if (ret < 0)
+			ret = posix_acl_update_mode(inode, &new_mode, &acl);
+			if (ret)
 				goto out;
-			if (ret == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
--- a/fs/ext2/acl.c
+++ b/fs/ext2/acl.c
@@ -193,15 +193,11 @@ ext2_set_acl(struct inode *inode, struct
 		case ACL_TYPE_ACCESS:
 			name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
 			if (acl) {
-				error = posix_acl_equiv_mode(acl, &inode->i_mode);
-				if (error < 0)
+				error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+				if (error)
 					return error;
-				else {
-					inode->i_ctime = CURRENT_TIME_SEC;
-					mark_inode_dirty(inode);
-					if (error == 0)
-						acl = NULL;
-				}
+				inode->i_ctime = CURRENT_TIME_SEC;
+				mark_inode_dirty(inode);
 			}
 			break;
 
--- a/fs/ext4/acl.c
+++ b/fs/ext4/acl.c
@@ -196,15 +196,11 @@ __ext4_set_acl(handle_t *handle, struct
 	case ACL_TYPE_ACCESS:
 		name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
-			else {
-				inode->i_ctime = ext4_current_time(inode);
-				ext4_mark_inode_dirty(handle, inode);
-				if (error == 0)
-					acl = NULL;
-			}
+			inode->i_ctime = ext4_current_time(inode);
+			ext4_mark_inode_dirty(handle, inode);
 		}
 		break;
 
--- a/fs/f2fs/acl.c
+++ b/fs/f2fs/acl.c
@@ -214,12 +214,10 @@ static int __f2fs_set_acl(struct inode *
 	case ACL_TYPE_ACCESS:
 		name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
 			set_acl_inode(fi, inode->i_mode);
-			if (error == 0)
-				acl = NULL;
 		}
 		break;
 
--- a/fs/gfs2/acl.c
+++ b/fs/gfs2/acl.c
@@ -79,17 +79,11 @@ int gfs2_set_acl(struct inode *inode, st
 	if (type == ACL_TYPE_ACCESS) {
 		umode_t mode = inode->i_mode;
 
-		error = posix_acl_equiv_mode(acl, &mode);
-		if (error < 0)
+		error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+		if (error)
 			return error;
-
-		if (error == 0)
-			acl = NULL;
-
-		if (mode != inode->i_mode) {
-			inode->i_mode = mode;
+		if (mode != inode->i_mode)
 			mark_inode_dirty(inode);
-		}
 	}
 
 	if (acl) {
--- a/fs/hfsplus/posix_acl.c
+++ b/fs/hfsplus/posix_acl.c
@@ -68,8 +68,8 @@ int hfsplus_set_posix_acl(struct inode *
 	case ACL_TYPE_ACCESS:
 		xattr_name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			err = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (err < 0)
+			err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (err)
 				return err;
 		}
 		err = 0;
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -235,9 +235,10 @@ int jffs2_set_acl(struct inode *inode, s
 	case ACL_TYPE_ACCESS:
 		xprefix = JFFS2_XPREFIX_ACL_ACCESS;
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			rc = posix_acl_equiv_mode(acl, &mode);
-			if (rc < 0)
+			umode_t mode;
+
+			rc = posix_acl_update_mode(inode, &mode, &acl);
+			if (rc)
 				return rc;
 			if (inode->i_mode != mode) {
 				struct iattr attr;
@@ -249,8 +250,6 @@ int jffs2_set_acl(struct inode *inode, s
 				if (rc < 0)
 					return rc;
 			}
-			if (rc == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -84,13 +84,11 @@ static int __jfs_set_acl(tid_t tid, stru
 	case ACL_TYPE_ACCESS:
 		ea_name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			rc = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (rc < 0)
+			rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (rc)
 				return rc;
 			inode->i_ctime = CURRENT_TIME;
 			mark_inode_dirty(inode);
-			if (rc == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -241,13 +241,11 @@ int ocfs2_set_acl(handle_t *handle,
 	case ACL_TYPE_ACCESS:
 		name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			ret = posix_acl_equiv_mode(acl, &mode);
-			if (ret < 0)
-				return ret;
+			umode_t mode;
 
-			if (ret == 0)
-				acl = NULL;
+			ret = posix_acl_update_mode(inode, &mode, &acl);
+			if (ret)
+				return ret;
 
 			ret = ocfs2_acl_set_mode(inode, di_bh,
 						 handle, mode);
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -592,6 +592,37 @@ no_mem:
 }
 EXPORT_SYMBOL_GPL(posix_acl_create);
 
+/**
+ * posix_acl_update_mode  -  update mode in set_acl
+ *
+ * Update the file mode when setting an ACL: compute the new file permission
+ * bits based on the ACL.  In addition, if the ACL is equivalent to the new
+ * file mode, set *acl to NULL to indicate that no ACL should be set.
+ *
+ * As with chmod, clear the setgit bit if the caller is not in the owning group
+ * or capable of CAP_FSETID (see inode_change_ok).
+ *
+ * Called from set_acl inode operations.
+ */
+int posix_acl_update_mode(struct inode *inode, umode_t *mode_p,
+			  struct posix_acl **acl)
+{
+	umode_t mode = inode->i_mode;
+	int error;
+
+	error = posix_acl_equiv_mode(*acl, &mode);
+	if (error < 0)
+		return error;
+	if (error == 0)
+		*acl = NULL;
+	if (!in_group_p(inode->i_gid) &&
+	    !capable_wrt_inode_uidgid(inode, CAP_FSETID))
+		mode &= ~S_ISGID;
+	*mode_p = mode;
+	return 0;
+}
+EXPORT_SYMBOL(posix_acl_update_mode);
+
 /*
  * Fix up the uids and gids in posix acl extended attributes in place.
  */
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -246,13 +246,9 @@ __reiserfs_set_acl(struct reiserfs_trans
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
-			else {
-				if (error == 0)
-					acl = NULL;
-			}
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -288,16 +288,11 @@ xfs_set_acl(struct inode *inode, struct
 		return error;
 
 	if (type == ACL_TYPE_ACCESS) {
-		umode_t mode = inode->i_mode;
-		error = posix_acl_equiv_mode(acl, &mode);
-
-		if (error <= 0) {
-			acl = NULL;
-
-			if (error < 0)
-				return error;
-		}
+		umode_t mode;
 
+		error = posix_acl_update_mode(inode, &mode, &acl);
+		if (error)
+			return error;
 		error = xfs_set_mode(inode, mode);
 		if (error)
 			return error;
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -95,6 +95,7 @@ extern int set_posix_acl(struct inode *,
 extern int posix_acl_chmod(struct inode *, umode_t);
 extern int posix_acl_create(struct inode *, umode_t *, struct posix_acl **,
 		struct posix_acl **);
+extern int posix_acl_update_mode(struct inode *, umode_t *, struct posix_acl **);
 
 extern int simple_set_acl(struct inode *, struct posix_acl *, int);
 extern int simple_acl_create(struct inode *, struct inode *);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/51] 4.4.29-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 23/51] powerpc/eeh: Null check uses of eeh_pe_bus_get Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 36/51] ASoC: dapm: Fix kcontrol creation for output driver widget Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 28/51] spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 29/51] mwifiex: correct aid value during tdls setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 16/51] drm/i915: Unalias obj->phys_handle and obj->userptr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 13/51] drm/i915/gen9: fix the WaWmMemoryReadLatency implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 20/51] ipip: Properly mark ipip GRO packets as encapsulated. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 06/51] drm/amdgpu/dce11: add missing drm_mode_config_cleanup call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 46/51] perf hists browser: Fix event group display Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 03/51] drm/amdgpu/dce10: disable hpd on local panels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 41/51] s390/cio: fix accidental interrupt enabling during resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:00 +0200
  [PATCH 4.4 50/51] powerpc/nvram: Fix an incorrect partition merge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 34/51] ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 45/51] clk: divider: Fix clk_divider_round_rate() to use clk_readl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 47/51] perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 10/51] drm/radeon: change vblank_times calculation method to reduce computational error. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 21/51] tunnels: Dont apply GRO to multiple layers of encapsulation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 04/51] drm/amdgpu/dce8: disable hpd on local panels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 17/51] mm/hugetlb: fix memory offline with hugepage size > memory block size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 25/51] genirq/generic_chip: Add irq_unmap callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 02/51] drm/amdgpu: fix IB alignment for UVD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 14/51] Revert "drm/i915: Check live status before reading edid" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 42/51] s390/con3270: fix use of uninitialised data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 05/51] drm/amdgpu/dce11: disable hpd on local panels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 51/51] ARM: pxa: pxa_cplds: fix interrupt handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 44/51] clk: qoriq: fix a register offset error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 26/51] uio: fix dmem_region_start computation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 32/51] hwrng: omap - Only fail if pm_runtime_get_sync returns < 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 31/51] crypto: arm/ghash-ce - add missing async import/export Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 40/51] x86/mm: Expand the exception table logic to allow new handling options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 33/51] ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 22/51] tunnels: Remove encapsulation offloads on decap. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 08/51] drm/radeon: narrow asic_init for virtualization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 37/51] staging: r8188eu: Fix scheduling while atomic splat Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 07/51] drm/amdgpu: change vblank_times calculation method to reduce computational error. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 19/51] posix_acl: Clear SGID bit when setting file permissions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 09/51] drm/radeon/si/dpm: fix phase shedding setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 35/51] ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUXs second channel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 11/51] drm/vmwgfx: Limit the user-space command buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 43/51] s390/con3270: fix insufficient space padding Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 49/51] mpt3sas: Dont spam logs if logging level is 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 38/51] power: bq24257: Fix use of uninitialized pointer bq->charger Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  [PATCH 4.4 18/51] brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-29 16:30 +0200
  Re: [PATCH 4.4 00/51] 4.4.29-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-30 01:10 +0200
  Re: [PATCH 4.4 00/51] 4.4.29-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-30 02:50 +0200

csiph-web