Message ID | 20220616182749.1200971-9-leah.rumancik@gmail.com (mailing list archive) |
---|---|
State | Superseded |
Headers | show |
Series | xfs stable candidate patches for 5.15.y (part 1) | expand |
On Thu, Jun 16, 2022 at 9:29 PM Leah Rumancik <leah.rumancik@gmail.com> wrote: > > From: "Darrick J. Wong" <djwong@kernel.org> > > [ Upstream commit e014f37db1a2d109afa750042ac4d69cf3e3d88e ] > > Filipe Manana pointed out that XFS' behavior w.r.t. setuid/setgid > revocation isn't consistent with btrfs[1] or ext4. Those two > filesystems use the VFS function setattr_copy to convey certain > attributes from struct iattr into the VFS inode structure. > > Andrey Zhadchenko reported[2] that XFS uses the wrong user namespace to > decide if it should clear setgid and setuid on a file attribute update. > This is a second symptom of the problem that Filipe noticed. > > XFS, on the other hand, open-codes setattr_copy in xfs_setattr_mode, > xfs_setattr_nonsize, and xfs_setattr_time. Regrettably, setattr_copy is > /not/ a simple copy function; it contains additional logic to clear the > setgid bit when setting the mode, and XFS' version no longer matches. > > The VFS implements its own setuid/setgid stripping logic, which > establishes consistent behavior. It's a tad unfortunate that it's > scattered across notify_change, should_remove_suid, and setattr_copy but > XFS should really follow the Linux VFS. Adapt XFS to use the VFS > functions and get rid of the old functions. > > [1] https://lore.kernel.org/fstests/CAL3q7H47iNQ=Wmk83WcGB-KBJVOEtR9+qGczzCeXJ9Y2KCV25Q@mail.gmail.com/ > [2] https://lore.kernel.org/linux-xfs/20220221182218.748084-1-andrey.zhadchenko@virtuozzo.com/ > > Fixes: 7fa294c8991c ("userns: Allow chown and setgid preservation") > Signed-off-by: Darrick J. Wong <djwong@kernel.org> > Reviewed-by: Dave Chinner <dchinner@redhat.com> > Reviewed-by: Christoph Hellwig <hch@lst.de> > Reviewed-by: Christian Brauner <brauner@kernel.org> > Signed-off-by: Leah Rumancik <leah.rumancik@gmail.com> > --- Hi Leah, Dave has raised a concern [1] about backporting fixes in this area because there are other vfs fixes still in work. For the fix "xfs: fix up non-directory creation in SGID directories", both Christian and Christoph said it should be backported regardless [2]. I am not sure what they would have to say about this one though? Christian, Christoph, In your opinion, is this one also worth backporting regardless of possible future vfs fixes? I did test the 5.10 backports both with and without these two patches, so I could go either way. Thanks, Amir. [1] https://lore.kernel.org/linux-xfs/20220602005238.GK227878@dread.disaster.area/ [2] https://lore.kernel.org/linux-xfs/CAOQ4uxg4=m9zEFbDAKXx7CP7HYiMwtsYSJvq076oKpy-OhK1uw@mail.gmail.com/
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index a607d6aca5c4..1eb71275e5b0 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -634,37 +634,6 @@ xfs_vn_getattr( return 0; } -static void -xfs_setattr_mode( - struct xfs_inode *ip, - struct iattr *iattr) -{ - struct inode *inode = VFS_I(ip); - umode_t mode = iattr->ia_mode; - - ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); - - inode->i_mode &= S_IFMT; - inode->i_mode |= mode & ~S_IFMT; -} - -void -xfs_setattr_time( - struct xfs_inode *ip, - struct iattr *iattr) -{ - struct inode *inode = VFS_I(ip); - - ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); - - if (iattr->ia_valid & ATTR_ATIME) - inode->i_atime = iattr->ia_atime; - if (iattr->ia_valid & ATTR_CTIME) - inode->i_ctime = iattr->ia_ctime; - if (iattr->ia_valid & ATTR_MTIME) - inode->i_mtime = iattr->ia_mtime; -} - static int xfs_vn_change_ok( struct user_namespace *mnt_userns, @@ -763,16 +732,6 @@ xfs_setattr_nonsize( gid = (mask & ATTR_GID) ? iattr->ia_gid : igid; uid = (mask & ATTR_UID) ? iattr->ia_uid : iuid; - /* - * CAP_FSETID overrides the following restrictions: - * - * The set-user-ID and set-group-ID bits of a file will be - * cleared upon successful return from chown() - */ - if ((inode->i_mode & (S_ISUID|S_ISGID)) && - !capable(CAP_FSETID)) - inode->i_mode &= ~(S_ISUID|S_ISGID); - /* * Change the ownerships and register quota modifications * in the transaction. @@ -784,7 +743,6 @@ xfs_setattr_nonsize( olddquot1 = xfs_qm_vop_chown(tp, ip, &ip->i_udquot, udqp); } - inode->i_uid = uid; } if (!gid_eq(igid, gid)) { if (XFS_IS_GQUOTA_ON(mp)) { @@ -795,15 +753,10 @@ xfs_setattr_nonsize( olddquot2 = xfs_qm_vop_chown(tp, ip, &ip->i_gdquot, gdqp); } - inode->i_gid = gid; } } - if (mask & ATTR_MODE) - xfs_setattr_mode(ip, iattr); - if (mask & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME)) - xfs_setattr_time(ip, iattr); - + setattr_copy(mnt_userns, inode, iattr); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); XFS_STATS_INC(mp, xs_ig_attrchg); @@ -1028,11 +981,8 @@ xfs_setattr_size( xfs_inode_clear_eofblocks_tag(ip); } - if (iattr->ia_valid & ATTR_MODE) - xfs_setattr_mode(ip, iattr); - if (iattr->ia_valid & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME)) - xfs_setattr_time(ip, iattr); - + ASSERT(!(iattr->ia_valid & (ATTR_UID | ATTR_GID))); + setattr_copy(mnt_userns, inode, iattr); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); XFS_STATS_INC(mp, xs_ig_attrchg); diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c index 5e1d29d8b2e7..8865f7d4404a 100644 --- a/fs/xfs/xfs_pnfs.c +++ b/fs/xfs/xfs_pnfs.c @@ -283,7 +283,8 @@ xfs_fs_commit_blocks( xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); - xfs_setattr_time(ip, iattr); + ASSERT(!(iattr->ia_valid & (ATTR_UID | ATTR_GID))); + setattr_copy(&init_user_ns, inode, iattr); if (update_isize) { i_size_write(inode, iattr->ia_size); ip->i_disk_size = iattr->ia_size;