linux-stable.git/include/linux/posix_acl.h, branch v3.2.102

posix_acl: Clear SGID bit when setting file permissions

2016-11-20T01:01:44+00:00

commit 073931017b49d9458aa351605b43a7e34598caef upstream.

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig 
Reviewed-by: Jeff Layton 
Signed-off-by: Jan Kara 
Signed-off-by: Andreas Gruenbacher 
[bwh: Backported to 3.2:
 - Drop changes to ceph, f2fs, hfsplus, orangefs
 - Use capable() instead of capable_wrt_inode_uidgid()
 - Update ext3 and generic_acl.c as well
 - In gfs2, jfs, and xfs, take care to avoid leaking the allocated ACL if
   posix_acl_update_mode() determines it's not needed
 - Adjust context]
Signed-off-by: Ben Hutchings

RCUify freeing acls, let check_acl() go ahead in RCU mode if acl is cached

2011-08-03T04:58:42+00:00

Signed-off-by: Al Viro

get rid of boilerplate switches in posix_acl.h

2011-08-03T04:47:21+00:00

the only potentially subtle thing here: get_cached_acl()
is never called with the second argument other than
ACL_TYPE_{ACCESS,DEFAULT}.  IOW, that return ERR_PTR(-EINVAL)
in there might as well be BUG().

Signed-off-by: Al Viro

switch posix_acl_chmod() to umode_t

2011-08-01T06:10:32+00:00

again, that's what all callers pass to it

Signed-off-by: Al Viro

switch posix_acl_from_mode() to umode_t

2011-08-01T06:10:20+00:00

... seeing that this is what all callers pass to it anyway.

Signed-off-by: Al Viro

switch posix_acl_equiv_mode() to umode_t *

2011-08-01T06:10:06+00:00

... so that &inode->i_mode could be passed to it

Signed-off-by: Al Viro

switch posix_acl_create() to umode_t *

2011-08-01T06:09:42+00:00

so we can pass &inode->i_mode to it

Signed-off-by: Al Viro

bury posix_acl_..._masq() variants

2011-07-25T18:27:32+00:00

made static; no callers left outside of posix_acl.c.  posix_acl_clone() also
has lost all external callers and became static...

Signed-off-by: Al Viro

kill boilerplates around posix_acl_create_masq()

2011-07-25T18:27:32+00:00

new helper: posix_acl_create(&acl, gfp, mode_p).  Replaces acl with
modified clone, on failure releases acl and replaces with NULL.
Returns 0 or -ve on error.  All callers of posix_acl_create_masq()
switched.

Signed-off-by: Al Viro

kill boilerplate around posix_acl_chmod_masq()

2011-07-25T18:27:30+00:00

new helper: posix_acl_chmod(&acl, gfp, mode).  Replaces acl with modified
clone or with NULL if that has failed; returns 0 or -ve on error.  All
callers of posix_acl_chmod_masq() switched to that - they'd been doing
exactly the same thing.

Signed-off-by: Al Viro