kernel.git/fs/jffs2/acl.c, branch linux-3.2.y

posix_acl: Clear SGID bit when setting file permissions

2016-11-20T01:01:44Z

commit 073931017b49d9458aa351605b43a7e34598caef upstream. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Jan Kara Signed-off-by: Andreas Gruenbacher [bwh: Backported to 3.2: - Drop changes to ceph, f2fs, hfsplus, orangefs - Use capable() instead of capable_wrt_inode_uidgid() - Update ext3 and generic_acl.c as well - In gfs2, jfs, and xfs, take care to avoid leaking the allocated ACL if posix_acl_update_mode() determines it's not needed - Adjust context] Signed-off-by: Ben Hutchings

switch posix_acl_equiv_mode() to umode_t *

2011-08-01T06:10:06Z

... so that &inode->i_mode could be passed to it Signed-off-by: Al Viro

switch posix_acl_create() to umode_t *

2011-08-01T06:09:42Z

so we can pass &inode->i_mode to it Signed-off-by: Al Viro

fs: take the ACL checks to common code

2011-07-25T18:30:23Z

Replace the ->check_acl method with a ->get_acl method that simply reads an ACL from disk after having a cache miss. This means we can replace the ACL checking boilerplate code with a single implementation in namei.c. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro

kill boilerplates around posix_acl_create_masq()

2011-07-25T18:27:32Z

new helper: posix_acl_create(&acl, gfp, mode_p). Replaces acl with modified clone, on failure releases acl and replaces with NULL. Returns 0 or -ve on error. All callers of posix_acl_create_masq() switched. Signed-off-by: Al Viro

kill boilerplate around posix_acl_chmod_masq()

2011-07-25T18:27:30Z

new helper: posix_acl_chmod(&acl, gfp, mode). Replaces acl with modified clone or with NULL if that has failed; returns 0 or -ve on error. All callers of posix_acl_chmod_masq() switched to that - they'd been doing exactly the same thing. Signed-off-by: Al Viro

vfs: move ACL cache lookup into generic code

2011-07-25T18:23:39Z

This moves logic for checking the cached ACL values from low-level filesystems into generic code. The end result is a streamlined ACL check that doesn't need to load the inode->i_op->check_acl pointer at all for the common cached case. The filesystems also don't need to check for a non-blocking RCU walk case in their acl_check() functions, because that is all handled at a VFS layer. Signed-off-by: Linus Torvalds Signed-off-by: Al Viro

fix jffs2 ACLs on big-endian with 16bit mode_t

2011-07-24T14:12:01Z

casting int * to mode_t * is not a good thing - on a *lot* of big-endian architectures mode_t happens to be smaller than int and there it breaks quite spectaculary... Fucked-up-by: commit cfc8dc6f6f69ede939e09c2af06a01adee577285 Signed-off-by: Al Viro

->permission() sanitizing: don't pass flags to ->check_acl()

2011-07-20T05:43:21Z

not used in the instances anymore. Signed-off-by: Al Viro

->permission() sanitizing: pass MAY_NOT_BLOCK to ->check_acl()

2011-07-20T05:43:19Z

Signed-off-by: Al Viro