linux-stable.git/fs/attr.c, branch linux-4.1.y

fs: Avoid premature clearing of capabilities

2016-12-23T13:56:35+00:00

[ Upstream commit 030b533c4fd4d2ec3402363323de4bb2983c9cee ]

Currently, notify_change() clears capabilities or IMA attributes by
calling security_inode_killpriv() before calling into ->setattr. Thus it
happens before any other permission checks in inode_change_ok() and user
is thus allowed to trigger clearing of capabilities or IMA attributes
for any file he can look up e.g. by calling chown for that file. This is
unexpected and can lead to user DoSing a system.

Fix the problem by calling security_inode_killpriv() at the end of
inode_change_ok() instead of from notify_change(). At that moment we are
sure user has permissions to do the requested change.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Philipp Hahn 
Signed-off-by: Sasha Levin

fs: Give dentry to inode_change_ok() instead of inode

2016-12-23T13:56:35+00:00

[ Upstream commit 31051c85b5e2aaaf6315f74c72a732673632a905 ]

inode_change_ok() will be resposible for clearing capabilities and IMA
extended attributes and as such will need dentry. Give it as an argument
to inode_change_ok() instead of an inode. Also rename inode_change_ok()
to setattr_prepare() to better relect that it does also some
modifications in addition to checks.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Philipp Hahn 
Signed-off-by: Sasha Levin

fs,userns: Change inode_capable to capable_wrt_inode_uidgid

2014-06-10T20:57:22+00:00

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example, inode_capable(inode,
CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Cc: Theodore Ts'o 
Cc: Serge Hallyn 
Cc: "Eric W. Biederman" 
Cc: Dave Chinner 
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski 
Signed-off-by: Linus Torvalds

fs: fix iversion handling

2013-12-05T22:36:21+00:00

Currently notify_change directly updates i_version for size updates,
which not only is counter to how all other fields are updated through
struct iattr, but also breaks XFS, which need inode updates to happen
under its own lock, and synchronized to the structure that gets written
to the log.

Remove the update in the common code, and it to btrfs and ext4,
XFS already does a proper updaste internally and currently gets a
double update with the existing code.

IMHO this is 3.13 and -stable material and should go in through the XFS
tree.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Andreas Dilger 
Acked-by: Jan Kara 
Reviewed-by: Dave Chinner 
Signed-off-by: Chris Mason 
Signed-off-by: Ben Myers

locks: break delegations on any attribute modification

2013-11-09T05:16:44+00:00

NFSv4 uses leases to guarantee that clients can cache metadata as well
as data.

Cc: Mikulas Patocka 
Cc: David Howells 
Cc: Tyler Hicks 
Cc: Dustin Kirkland 
Acked-by: Jeff Layton 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Al Viro

userns: Allow chown and setgid preservation

2012-11-20T12:17:24+00:00

- Allow chown if CAP_CHOWN is present in the current user namespace
  and the uid of the inode maps into the current user namespace, and
  the destination uid or gid maps into the current user namespace.

- Allow perserving setgid when changing an inode if CAP_FSETID is
  present in the current user namespace and the owner of the file has
  a mapping into the current user namespace.

Acked-by: Serge E. Hallyn 
Signed-off-by: "Eric W. Biederman"

ima: add inode_post_setattr call

2012-09-07T18:57:46+00:00

Changing an inode's metadata may result in our not needing to appraise
the file.  In such cases, we must remove 'security.ima'.

Changelog v1:
- use ima_inode_post_setattr() stub function, if IMA_APPRAISE not configured

Signed-off-by: Mimi Zohar 
Acked-by: Serge Hallyn 
Acked-by: Dmitry Kasatkin

notify_change(): check that i_mutex is held

2012-07-14T12:35:42+00:00

Cc: Djalal Harouni 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Al Viro

vfs: increment iversion when a file is truncated

2012-05-31T01:04:53+00:00

When a file is truncated with truncate()/ftruncate() and then closed,
iversion is not updated.  This patch uses ATTR_SIZE flag as an indication
to increment iversion.

Mimi said:

On fput(), i_version is used to detect and flag files that have changed
and need to be re-measured in the IMA measurement policy.  When a file
is truncated with truncate()/ftruncate() and then closed, i_version is
not updated.  As a result, although the file has changed, it will not be
re-measured and added to the IMA measurement list on subsequent access.

Signed-off-by: Dmitry Kasatkin 
Acked-by: Mimi Zohar 
Cc: Al Viro 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Al Viro

userns: Use uid_eq gid_eq helpers when comparing kuids and kgids in the vfs

2012-05-03T10:29:34+00:00

Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman