| Message ID | 1483690375-40718-1-git-send-email-guzheng1@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri 06-01-17 16:12:55, Gu Zheng wrote: > This change was missed the tmpfs modification in In CVE-2016-7097 > commit 073931017b49d9458aa351605b43a7e34598caef > posix_acl: Clear SGID bit when setting file permissions. > It can test by xfstest generic/375, which failed to clear > setgid bit in the following test case on tmpfs: > > touch $testfile > chown 100:100 $testfile > chmod 2755 $testfile > _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile > > Signed-off-by: Gu Zheng <guzheng1@huawei.com> Ah, good catch. One comment below: > diff --git a/fs/posix_acl.c b/fs/posix_acl.c > index 5955220..d014dff 100644 > --- a/fs/posix_acl.c > +++ b/fs/posix_acl.c > @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) > int error; > > if (type == ACL_TYPE_ACCESS) { > - error = posix_acl_equiv_mode(acl, &inode->i_mode); > - if (error < 0) > - return 0; > - if (error == 0) > - acl = NULL; > + error = posix_acl_update_mode(inode, > + &inode->i_mode, &acl); > + if (error > 0) > + return error; Uh, why this error > 0 check? AFAIU it should be: if (error < 0) return 0; As it used to be before... Honza
thanks, I will update it. 在 2017/1/6 18:10, Jan Kara 写道: > On Fri 06-01-17 16:12:55, Gu Zheng wrote: >> This change was missed the tmpfs modification in In CVE-2016-7097 >> commit 073931017b49d9458aa351605b43a7e34598caef >> posix_acl: Clear SGID bit when setting file permissions. >> It can test by xfstest generic/375, which failed to clear >> setgid bit in the following test case on tmpfs: >> >> touch $testfile >> chown 100:100 $testfile >> chmod 2755 $testfile >> _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile >> >> Signed-off-by: Gu Zheng <guzheng1@huawei.com> > > Ah, good catch. One comment below: > >> diff --git a/fs/posix_acl.c b/fs/posix_acl.c >> index 5955220..d014dff 100644 >> --- a/fs/posix_acl.c >> +++ b/fs/posix_acl.c >> @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) >> int error; >> >> if (type == ACL_TYPE_ACCESS) { >> - error = posix_acl_equiv_mode(acl, &inode->i_mode); >> - if (error < 0) >> - return 0; >> - if (error == 0) >> - acl = NULL; >> + error = posix_acl_update_mode(inode, >> + &inode->i_mode, &acl); >> + if (error > 0) >> + return error; > > Uh, why this error > 0 check? AFAIU it should be: > > if (error < 0) > return 0; > > As it used to be before... > > Honza > -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/posix_acl.c b/fs/posix_acl.c index 5955220..d014dff 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) int error; if (type == ACL_TYPE_ACCESS) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) - return 0; - if (error == 0) - acl = NULL; + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error > 0) + return error; } inode->i_ctime = current_time(inode);
This change was missed the tmpfs modification in In CVE-2016-7097 commit 073931017b49d9458aa351605b43a7e34598caef posix_acl: Clear SGID bit when setting file permissions. It can test by xfstest generic/375, which failed to clear setgid bit in the following test case on tmpfs: touch $testfile chown 100:100 $testfile chmod 2755 $testfile _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile Signed-off-by: Gu Zheng <guzheng1@huawei.com> --- fs/posix_acl.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)