| Message ID | 1483925688-8233-1-git-send-email-guzheng1@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon 09-01-17 09:34:48, Gu Zheng wrote: > This change was missed the tmpfs modification in In CVE-2016-7097 > commit 073931017b49 ("posix_acl: Clear SGID bit when setting > file permissions") > It can test by xfstest generic/375, which failed to clear > setgid bit in the following test case on tmpfs: > > touch $testfile > chown 100:100 $testfile > chmod 2755 $testfile > _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile > > Signed-off-by: Gu Zheng <guzheng1@huawei.com> Thanks. The patch looks good. You can add: Reviewed-by: Jan Kara <jack@suse.cz> Al, will you please merge it? Thanks! Honza > --- > fs/posix_acl.c | 9 ++++----- > 1 file changed, 4 insertions(+), 5 deletions(-) > > diff --git a/fs/posix_acl.c b/fs/posix_acl.c > index 5955220..d014dff 100644 > --- a/fs/posix_acl.c > +++ b/fs/posix_acl.c > @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) > int error; > > if (type == ACL_TYPE_ACCESS) { > - error = posix_acl_equiv_mode(acl, &inode->i_mode); > - if (error < 0) > - return 0; > - if (error == 0) > - acl = NULL; > + error = posix_acl_update_mode(inode, > + &inode->i_mode, &acl); > + if (error) > + return error; > } > > inode->i_ctime = current_time(inode); > -- > 2.5.0 >
On Tue, Jan 10, 2017 at 09:03:01AM +0100, Jan Kara wrote: > On Mon 09-01-17 09:34:48, Gu Zheng wrote: > > This change was missed the tmpfs modification in In CVE-2016-7097 > > commit 073931017b49 ("posix_acl: Clear SGID bit when setting > > file permissions") > > It can test by xfstest generic/375, which failed to clear > > setgid bit in the following test case on tmpfs: > > > > touch $testfile > > chown 100:100 $testfile > > chmod 2755 $testfile > > _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile > > > > Signed-off-by: Gu Zheng <guzheng1@huawei.com> > > Thanks. The patch looks good. You can add: > > Reviewed-by: Jan Kara <jack@suse.cz> > > Al, will you please merge it? Thanks! Already applied, actually... -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/posix_acl.c b/fs/posix_acl.c index 5955220..d014dff 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) int error; if (type == ACL_TYPE_ACCESS) { - error = posix_acl_equiv_mode(acl, &inode->i_mode); - if (error < 0) - return 0; - if (error == 0) - acl = NULL; + error = posix_acl_update_mode(inode, + &inode->i_mode, &acl); + if (error) + return error; } inode->i_ctime = current_time(inode);
This change was missed the tmpfs modification in In CVE-2016-7097 commit 073931017b49 ("posix_acl: Clear SGID bit when setting file permissions") It can test by xfstest generic/375, which failed to clear setgid bit in the following test case on tmpfs: touch $testfile chown 100:100 $testfile chmod 2755 $testfile _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile Signed-off-by: Gu Zheng <guzheng1@huawei.com> --- fs/posix_acl.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)