linux-stable.git/fs/attr.c, branch linux-3.16.y

fs: Give dentry to inode_change_ok() instead of inode

2017-02-23T03:53:52+00:00

commit 31051c85b5e2aaaf6315f74c72a732673632a905 upstream.

inode_change_ok() will be resposible for clearing capabilities and IMA
extended attributes and as such will need dentry. Give it as an argument
to inode_change_ok() instead of an inode. Also rename inode_change_ok()
to setattr_prepare() to better relect that it does also some
modifications in addition to checks.

Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
[bwh: Backported to 3.16:
 - Drop changes to orangefs, overlayfs
 - Adjust filenames, context
 - In nfsd, pass dentry to nfsd_sanitize_attrs()
 - Update ext3 as well]
Signed-off-by: Ben Hutchings

Revert "fs: Give dentry to inode_change_ok() instead of inode"

2017-02-23T03:53:52+00:00

This reverts commit be9df699432235753c3824b0f5a27d46de7fdc9e, which was
commit 31051c85b5e2aaaf6315f74c72a732673632a905 upstream.  The backport
breaks fuse and makes a mess of xfs, which can be improved by picking
further upstream commits as I should have done in the first place.

Signed-off-by: Ben Hutchings

fs: Avoid premature clearing of capabilities

2016-11-20T01:17:38+00:00

commit 030b533c4fd4d2ec3402363323de4bb2983c9cee upstream.

Currently, notify_change() clears capabilities or IMA attributes by
calling security_inode_killpriv() before calling into ->setattr. Thus it
happens before any other permission checks in inode_change_ok() and user
is thus allowed to trigger clearing of capabilities or IMA attributes
for any file he can look up e.g. by calling chown for that file. This is
unexpected and can lead to user DoSing a system.

Fix the problem by calling security_inode_killpriv() at the end of
inode_change_ok() instead of from notify_change(). At that moment we are
sure user has permissions to do the requested change.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

fs: Give dentry to inode_change_ok() instead of inode

2016-11-20T01:17:38+00:00

commit 31051c85b5e2aaaf6315f74c72a732673632a905 upstream.

inode_change_ok() will be resposible for clearing capabilities and IMA
extended attributes and as such will need dentry. Give it as an argument
to inode_change_ok() instead of an inode. Also rename inode_change_ok()
to setattr_prepare() to better relect that it does also some
modifications in addition to checks.

Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
[bwh: Backported to 3.16:
 - Drop changes to orangefs, overlayfs
 - Adjust filenames, context
 - In fuse, pass dentry to fuse_do_setattr()
 - In nfsd, pass dentry to nfsd_sanitize_attrs()
 - In xfs, pass dentry to xfs_setattr_nonsize() and xfs_setattr_size()
 - Update ext3 as well]
Signed-off-by: Ben Hutchings

fs,userns: Change inode_capable to capable_wrt_inode_uidgid

2014-06-10T20:57:22+00:00

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example, inode_capable(inode,
CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Cc: Theodore Ts'o 
Cc: Serge Hallyn 
Cc: "Eric W. Biederman" 
Cc: Dave Chinner 
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski 
Signed-off-by: Linus Torvalds

fs: fix iversion handling

2013-12-05T22:36:21+00:00

Currently notify_change directly updates i_version for size updates,
which not only is counter to how all other fields are updated through
struct iattr, but also breaks XFS, which need inode updates to happen
under its own lock, and synchronized to the structure that gets written
to the log.

Remove the update in the common code, and it to btrfs and ext4,
XFS already does a proper updaste internally and currently gets a
double update with the existing code.

IMHO this is 3.13 and -stable material and should go in through the XFS
tree.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Andreas Dilger 
Acked-by: Jan Kara 
Reviewed-by: Dave Chinner 
Signed-off-by: Chris Mason 
Signed-off-by: Ben Myers

locks: break delegations on any attribute modification

2013-11-09T05:16:44+00:00

NFSv4 uses leases to guarantee that clients can cache metadata as well
as data.

Cc: Mikulas Patocka 
Cc: David Howells 
Cc: Tyler Hicks 
Cc: Dustin Kirkland 
Acked-by: Jeff Layton 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Al Viro

userns: Allow chown and setgid preservation

2012-11-20T12:17:24+00:00

- Allow chown if CAP_CHOWN is present in the current user namespace
  and the uid of the inode maps into the current user namespace, and
  the destination uid or gid maps into the current user namespace.

- Allow perserving setgid when changing an inode if CAP_FSETID is
  present in the current user namespace and the owner of the file has
  a mapping into the current user namespace.

Acked-by: Serge E. Hallyn 
Signed-off-by: "Eric W. Biederman"

ima: add inode_post_setattr call

2012-09-07T18:57:46+00:00

Changing an inode's metadata may result in our not needing to appraise
the file.  In such cases, we must remove 'security.ima'.

Changelog v1:
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured

Signed-off-by: Mimi Zohar 
Acked-by: Serge Hallyn 
Acked-by: Dmitry Kasatkin

notify_change(): check that i_mutex is held

2012-07-14T12:35:42+00:00

Cc: Djalal Harouni 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Al Viro