[PATCH 3.10 008/250] tmpfs: clear S_ISGID when setting posix ACLs

Path	csiph.com!news.mixmin.net!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	Willy Tarreau <w@1wt.eu>
Newsgroups	linux.kernel
Subject	[PATCH 3.10 008/250] tmpfs: clear S_ISGID when setting posix ACLs
Date	Thu, 08 Jun 2017 01:10:04 +0200
Message-ID	<tPSfq-4Fa-73@gated-at.bofh.it> (permalink)
References	<tPSfn-4Fa-3@gated-at.bofh.it>
X-Mailer	git-send-email 2.8.0.rc2.1.gbe9624a
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	56
Organization	linux.* mail to news gateway
X-Original-Cc	Gu Zheng <guzheng1@huawei.com>, Al Viro <viro@zeniv.linux.org.uk>, Jan Kara <jack@suse.cz>, Willy Tarreau <w@1wt.eu>
X-Original-Date	Thu, 8 Jun 2017 00:56:34 +0200
X-Original-Message-ID	<1496876436-32402-9-git-send-email-w@1wt.eu>
X-Original-References	<1496876436-32402-1-git-send-email-w@1wt.eu>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1660339

Show key headers only | View raw

From: Gu Zheng <guzheng1@huawei.com>

commit 497de07d89c1410d76a15bec2bb41f24a2a89f31 upstream.

This change was missed the tmpfs modification in In CVE-2016-7097
commit 073931017b49 ("posix_acl: Clear SGID bit when setting
file permissions")
It can test by xfstest generic/375, which failed to clear
setgid bit in the following test case on tmpfs:

  touch $testfile
  chown 100:100 $testfile
  chmod 2755 $testfile
  _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile

Signed-off-by: Gu Zheng <guzheng1@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 fs/generic_acl.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/generic_acl.c b/fs/generic_acl.c
index b3f3676..7855cfb 100644
--- a/fs/generic_acl.c
+++ b/fs/generic_acl.c
@@ -82,19 +82,21 @@ generic_acl_set(struct dentry *dentry, const char *name, const void *value,
 			return PTR_ERR(acl);
 	}
 	if (acl) {
+		struct posix_acl *old_acl;
+
 		error = posix_acl_valid(acl);
 		if (error)
 			goto failed;
 		switch (type) {
 		case ACL_TYPE_ACCESS:
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
+			old_acl = acl;
+			error = posix_acl_update_mode(inode, &inode->i_mode,
+						      &acl);
 			if (error < 0)
 				goto failed;
+			if (!acl)
+				posix_acl_release(old_acl);
 			inode->i_ctime = CURRENT_TIME;
-			if (error == 0) {
-				posix_acl_release(acl);
-				acl = NULL;
-			}
 			break;
 		case ACL_TYPE_DEFAULT:
 			if (!S_ISDIR(inode->i_mode)) {
-- 
2.8.0.rc2.1.gbe9624a

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.10 008/250] tmpfs: clear S_ISGID when setting posix ACLs Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200

csiph-web