linux-stable.git/fs/generic_acl.c, branch v3.2.89

posix_acl: Clear SGID bit when setting file permissions

2016-11-20T01:01:44+00:00

commit 073931017b49d9458aa351605b43a7e34598caef upstream.

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig 
Reviewed-by: Jeff Layton 
Signed-off-by: Jan Kara 
Signed-off-by: Andreas Gruenbacher 
[bwh: Backported to 3.2:
 - Drop changes to ceph, f2fs, hfsplus, orangefs
 - Use capable() instead of capable_wrt_inode_uidgid()
 - Update ext3 and generic_acl.c as well
 - In gfs2, jfs, and xfs, take care to avoid leaking the allocated ACL if
   posix_acl_update_mode() determines it's not needed
 - Adjust context]
Signed-off-by: Ben Hutchings

switch posix_acl_equiv_mode() to umode_t *

2011-08-01T06:10:06+00:00

... so that &inode->i_mode could be passed to it

Signed-off-by: Al Viro

switch posix_acl_create() to umode_t *

2011-08-01T06:09:42+00:00

so we can pass &inode->i_mode to it

Signed-off-by: Al Viro

fs: take the ACL checks to common code

2011-07-25T18:30:23+00:00

Replace the ->check_acl method with a ->get_acl method that simply reads an
ACL from disk after having a cache miss.  This means we can replace the ACL
checking boilerplate code with a single implementation in namei.c.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

kill boilerplates around posix_acl_create_masq()

2011-07-25T18:27:32+00:00

new helper: posix_acl_create(&acl, gfp, mode_p).  Replaces acl with
modified clone, on failure releases acl and replaces with NULL.
Returns 0 or -ve on error.  All callers of posix_acl_create_masq()
switched.

Signed-off-by: Al Viro

generic_acl: no need to clone acl just to push it to set_cached_acl()

2011-07-25T18:27:31+00:00

In-core acls are copy-on-write, so the reference taken by set_cached_acl() will
do just fine.

Signed-off-by: Al Viro

kill boilerplate around posix_acl_chmod_masq()

2011-07-25T18:27:30+00:00

new helper: posix_acl_chmod(&acl, gfp, mode).  Replaces acl with modified
clone or with NULL if that has failed; returns 0 or -ve on error.  All
callers of posix_acl_chmod_masq() switched to that - they'd been doing
exactly the same thing.

Signed-off-by: Al Viro

vfs: move ACL cache lookup into generic code

2011-07-25T18:23:39+00:00

This moves logic for checking the cached ACL values from low-level
filesystems into generic code.  The end result is a streamlined ACL
check that doesn't need to load the inode->i_op->check_acl pointer at
all for the common cached case.

The filesystems also don't need to check for a non-blocking RCU walk
case in their acl_check() functions, because that is all handled at a
VFS layer.

Signed-off-by: Linus Torvalds 
Signed-off-by: Al Viro

->permission() sanitizing: don't pass flags to ->check_acl()

2011-07-20T05:43:21+00:00

not used in the instances anymore.

Signed-off-by: Al Viro

->permission() sanitizing: pass MAY_NOT_BLOCK to ->check_acl()

2011-07-20T05:43:19+00:00

Signed-off-by: Al Viro