kernel.git/fs/9p/acl.c, branch linux-3.2.y

posix_acl: Clear SGID bit when setting file permissions

2016-11-20T01:01:44Z

commit 073931017b49d9458aa351605b43a7e34598caef upstream. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Jan Kara Signed-off-by: Andreas Gruenbacher [bwh: Backported to 3.2: - Drop changes to ceph, f2fs, hfsplus, orangefs - Use capable() instead of capable_wrt_inode_uidgid() - Update ext3 and generic_acl.c as well - In gfs2, jfs, and xfs, take care to avoid leaking the allocated ACL if posix_acl_update_mode() determines it's not needed - Adjust context] Signed-off-by: Ben Hutchings

switch posix_acl_equiv_mode() to umode_t *

2011-08-01T06:10:06Z

... so that &inode->i_mode could be passed to it Signed-off-by: Al Viro

switch posix_acl_create() to umode_t *

2011-08-01T06:09:42Z

so we can pass &inode->i_mode to it Signed-off-by: Al Viro

p9: avoid unused variable warning

2011-07-26T06:43:53Z

Commit 4e34e719e457 ("fs: take the ACL checks to common code") removed the use of the 'acl' variable in v9fs_iop_get_acl(), but left the variable definition around. Remove it to get rid of the warning: fs/9p/acl.c: In function ‘v9fs_iop_get_acl’: fs/9p/acl.c:101:20: warning: unused variable ‘acl’ Signed-off-by: Linus Torvalds

fs: take the ACL checks to common code

2011-07-25T18:30:23Z

Replace the ->check_acl method with a ->get_acl method that simply reads an ACL from disk after having a cache miss. This means we can replace the ACL checking boilerplate code with a single implementation in namei.c. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro

kill boilerplates around posix_acl_create_masq()

2011-07-25T18:27:32Z

new helper: posix_acl_create(&acl, gfp, mode_p). Replaces acl with modified clone, on failure releases acl and replaces with NULL. Returns 0 or -ve on error. All callers of posix_acl_create_masq() switched. Signed-off-by: Al Viro

kill boilerplate around posix_acl_chmod_masq()

2011-07-25T18:27:30Z

new helper: posix_acl_chmod(&acl, gfp, mode). Replaces acl with modified clone or with NULL if that has failed; returns 0 or -ve on error. All callers of posix_acl_chmod_masq() switched to that - they'd been doing exactly the same thing. Signed-off-by: Al Viro

9p: do no return 0 from ->check_acl without actually checking

2011-07-25T18:25:38Z

If we do not want to use ACLs we at least need to perform normal Unix permission checks. From the comment I'm not quite sure that's what is intended, but if 0p wants to do permission checks entirely on the server it needs to do so in ->permission, not in ->check_acl. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro

vfs: move ACL cache lookup into generic code

2011-07-25T18:23:39Z

This moves logic for checking the cached ACL values from low-level filesystems into generic code. The end result is a streamlined ACL check that doesn't need to load the inode->i_op->check_acl pointer at all for the common cached case. The filesystems also don't need to check for a non-blocking RCU walk case in their acl_check() functions, because that is all handled at a VFS layer. Signed-off-by: Linus Torvalds Signed-off-by: Al Viro

9p: close ACL leaks

2011-07-24T14:10:18Z

Signed-off-by: Al Viro