From patchwork Thu Mar 2 20:34:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157852 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DCCAC678D4 for ; Thu, 2 Mar 2023 20:35:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229946AbjCBUfV (ORCPT ); Thu, 2 Mar 2023 15:35:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229709AbjCBUfT (ORCPT ); Thu, 2 Mar 2023 15:35:19 -0500 Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 17B88231D1 for ; Thu, 2 Mar 2023 12:35:18 -0800 (PST) Received: by mail-pj1-x102c.google.com with SMTP id 6-20020a17090a190600b00237c5b6ecd7so4001417pjg.4 for ; Thu, 02 Mar 2023 12:35:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789317; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=KpTn71q10PlrZaut4RnEO+V9i+XJKvvLlGCAzu/zgaA=; b=kUbqFlk5hYAQLMlYnwnwP+zjaBIMWYStJOFBTpPDAlo9a0ITOsONsqkd2+fTq2gEmG BdVC8Vb7nQwgylSamRABGMY0q+Oc/06+YGCrDfgft8Gj5O4DEbpIzO/YxQbE6DPj5hpv 2ocomRTtws+YcA3JjhEdAFggBdCWDTosLWh1dG/dgoNi6DPvIWV4B7rTIKJCa/HlDgkn sr+YnMFboO68SrHpd06dXA/UiFalncKiKmIcMOJ5uTQly+ifUJXaGWPZx1bQ/4pkGG5X ynVwt9Gsaqqif2gML5WdoxKTaSNRFFh71brmmulwN2A3/4RxZFbzzp/zQvcFjal3tvja pzwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789317; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=KpTn71q10PlrZaut4RnEO+V9i+XJKvvLlGCAzu/zgaA=; b=XxyT3PeOTzx93O3IhNze4eJQJtmMNIc3lza0uLWi/5VqqgPJoZq21W1T7yScFDq5oB wxrEYfafv3MB4W5GsM+GdFMpaMCIvPa3EbmNLt5NjQIYy2A1PfyxNbF8Y75+eonNgiYv Wu/XHvd0s1hNsN+g6T1F4CnesNo7kNXLdsMYscK/OaM6GQuglTowT9BhrKcVu1R8DTQY iBSMLZA/hLd+wtUQ2xqgbyYh6ONbXWwoC3WWgwyZbkIdXQmnI24WRz/EqhLVX9sHHQbA nuJB7MXLG6d4BPWbPnZNEcDBSDXV0Qs3IPgV7irAaG6PEflHRUQsps2zsIOUKIkQHNUo DOlQ== X-Gm-Message-State: AO0yUKXiybrOn37JLwZY/ShJNZpVRIc5zItIRaAlTEGLl2mrGRqcRKr7 ERUHJMrdZF0FV5f0bpO3SctDNlQMuhAo6w== X-Google-Smtp-Source: AK7set/w0FqEFkpjS0LsVFi4CW59Yu4yJog4H4nEPeoxUEIYZQ4b7bgoH1WrgVlYRJaDFTIlijnsiw== X-Received: by 2002:a05:6a21:32a5:b0:cc:9b29:f61d with SMTP id yt37-20020a056a2132a500b000cc9b29f61dmr14219883pzb.6.1677789317327; Thu, 02 Mar 2023 12:35:17 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:16 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, "Darrick J. Wong" , Dave Chinner , Christoph Hellwig , Christian Brauner , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 01/11] xfs: use setattr_copy to set vfs inode attributes Date: Thu, 2 Mar 2023 12:34:54 -0800 Message-Id: <20230302203504.2998773-2-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: "Darrick J. Wong" commit e014f37db1a2d109afa750042ac4d69cf3e3d88e upsream. Filipe Manana pointed out that XFS' behavior w.r.t. setuid/setgid revocation isn't consistent with btrfs[1] or ext4. Those two filesystems use the VFS function setattr_copy to convey certain attributes from struct iattr into the VFS inode structure. Andrey Zhadchenko reported[2] that XFS uses the wrong user namespace to decide if it should clear setgid and setuid on a file attribute update. This is a second symptom of the problem that Filipe noticed. XFS, on the other hand, open-codes setattr_copy in xfs_setattr_mode, xfs_setattr_nonsize, and xfs_setattr_time. Regrettably, setattr_copy is /not/ a simple copy function; it contains additional logic to clear the setgid bit when setting the mode, and XFS' version no longer matches. The VFS implements its own setuid/setgid stripping logic, which establishes consistent behavior. It's a tad unfortunate that it's scattered across notify_change, should_remove_suid, and setattr_copy but XFS should really follow the Linux VFS. Adapt XFS to use the VFS functions and get rid of the old functions. [1] https://lore.kernel.org/fstests/CAL3q7H47iNQ=Wmk83WcGB-KBJVOEtR9+qGczzCeXJ9Y2KCV25Q@mail.gmail.com/ [2] https://lore.kernel.org/linux-xfs/20220221182218.748084-1-andrey.zhadchenko@virtuozzo.com/ Fixes: 7fa294c8991c ("userns: Allow chown and setgid preservation") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/xfs/xfs_iops.c | 56 +++-------------------------------------------- fs/xfs/xfs_pnfs.c | 3 ++- 2 files changed, 5 insertions(+), 54 deletions(-) diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index a607d6aca5c4..1eb71275e5b0 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -634,37 +634,6 @@ xfs_vn_getattr( return 0; } -static void -xfs_setattr_mode( - struct xfs_inode *ip, - struct iattr *iattr) -{ - struct inode *inode = VFS_I(ip); - umode_t mode = iattr->ia_mode; - - ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); - - inode->i_mode &= S_IFMT; - inode->i_mode |= mode & ~S_IFMT; -} - -void -xfs_setattr_time( - struct xfs_inode *ip, - struct iattr *iattr) -{ - struct inode *inode = VFS_I(ip); - - ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); - - if (iattr->ia_valid & ATTR_ATIME) - inode->i_atime = iattr->ia_atime; - if (iattr->ia_valid & ATTR_CTIME) - inode->i_ctime = iattr->ia_ctime; - if (iattr->ia_valid & ATTR_MTIME) - inode->i_mtime = iattr->ia_mtime; -} - static int xfs_vn_change_ok( struct user_namespace *mnt_userns, @@ -763,16 +732,6 @@ xfs_setattr_nonsize( gid = (mask & ATTR_GID) ? iattr->ia_gid : igid; uid = (mask & ATTR_UID) ? iattr->ia_uid : iuid; - /* - * CAP_FSETID overrides the following restrictions: - * - * The set-user-ID and set-group-ID bits of a file will be - * cleared upon successful return from chown() - */ - if ((inode->i_mode & (S_ISUID|S_ISGID)) && - !capable(CAP_FSETID)) - inode->i_mode &= ~(S_ISUID|S_ISGID); - /* * Change the ownerships and register quota modifications * in the transaction. @@ -784,7 +743,6 @@ xfs_setattr_nonsize( olddquot1 = xfs_qm_vop_chown(tp, ip, &ip->i_udquot, udqp); } - inode->i_uid = uid; } if (!gid_eq(igid, gid)) { if (XFS_IS_GQUOTA_ON(mp)) { @@ -795,15 +753,10 @@ xfs_setattr_nonsize( olddquot2 = xfs_qm_vop_chown(tp, ip, &ip->i_gdquot, gdqp); } - inode->i_gid = gid; } } - if (mask & ATTR_MODE) - xfs_setattr_mode(ip, iattr); - if (mask & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME)) - xfs_setattr_time(ip, iattr); - + setattr_copy(mnt_userns, inode, iattr); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); XFS_STATS_INC(mp, xs_ig_attrchg); @@ -1028,11 +981,8 @@ xfs_setattr_size( xfs_inode_clear_eofblocks_tag(ip); } - if (iattr->ia_valid & ATTR_MODE) - xfs_setattr_mode(ip, iattr); - if (iattr->ia_valid & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME)) - xfs_setattr_time(ip, iattr); - + ASSERT(!(iattr->ia_valid & (ATTR_UID | ATTR_GID))); + setattr_copy(mnt_userns, inode, iattr); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); XFS_STATS_INC(mp, xs_ig_attrchg); diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c index 5e1d29d8b2e7..8865f7d4404a 100644 --- a/fs/xfs/xfs_pnfs.c +++ b/fs/xfs/xfs_pnfs.c @@ -283,7 +283,8 @@ xfs_fs_commit_blocks( xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL); xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); - xfs_setattr_time(ip, iattr); + ASSERT(!(iattr->ia_valid & (ATTR_UID | ATTR_GID))); + setattr_copy(&init_user_ns, inode, iattr); if (update_isize) { i_size_write(inode, iattr->ia_size); ip->i_disk_size = iattr->ia_size; From patchwork Thu Mar 2 20:34:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157853 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38B3DC7EE30 for ; Thu, 2 Mar 2023 20:35:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229941AbjCBUfX (ORCPT ); Thu, 2 Mar 2023 15:35:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229899AbjCBUfT (ORCPT ); Thu, 2 Mar 2023 15:35:19 -0500 Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D57730285 for ; Thu, 2 Mar 2023 12:35:19 -0800 (PST) Received: by mail-pj1-x1035.google.com with SMTP id oj5so358616pjb.5 for ; Thu, 02 Mar 2023 12:35:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789318; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=n/bEWH+U8Y2Dq4zNfoM47whXgwcdRl+8McABR13FG/s=; b=oUo1uswTE0FuWV2tnqOgboISuseqCs5KdeR0Xg957zwhvx4o4aleH5crYhAsIx0vem LQUKBds1iLNlA9AZ/nKxWMFJ1XrjksFudJqkgy3cbJ6uzR/PBL2hpXiXFFP5uoElegzc OSSuNQg8Zg/GjgYVftlOSa1jlMeBKGoyHFbxzjP4FJlagZWWgcsCjWH8iaABk5XOKmrf m/3zXrF2Lhbb0HqbrXMWXBz3+yDPAWxkB9lJQ/M6BZihnAB2JBVkYLNFVLI8ZDz6CzaA AifrzPxwCaEQI1Sc1yPektWLe5QGpbgUFVaCrrTv3MN3KqbKKfQW5liiv/q0tj6viXhP D/8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789318; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n/bEWH+U8Y2Dq4zNfoM47whXgwcdRl+8McABR13FG/s=; b=NMCbPT9vTCOGbXAaYS6m2bPybPR+91OoxD8h/t2XUilWBqI4dXul+VfJVeGbHSeoSW vs0yhJbOVI0ytPWWChHQFXw0rngi4ZQ3r8SIIu5gJ2aV1IHN2riPBo9zUL006mfVV/VE GJIlFZgwyUANPGo6vrZBUH79CLMSk0WGwQ9bm+O6O9DEUn6rT1oEWpGX5AIWQDuOF4Rg 8Dn1U2pOzAxknyKXwBTiHZ0B8I/PWz9g93sc/Dn8mAMZp6L1Wg1xKjzgz703SN7FHr8w 9h12Qbgia9vl3DXnm/YhwpIj7vbG6Yn73kZ3OydPL7e9OHLLiV3VF72jtcGa98MXfSKR oWLA== X-Gm-Message-State: AO0yUKUJqhzxT/eLJnfwzg1b4RjR62ZWDsAPdbhYXBZazOmZP5ZqD9On A8w7okZ2DqQx9ssC2s9zLf/b96xiriql5Q== X-Google-Smtp-Source: AK7set/4fGtUXDYX+d3hLWoPttfEDixWzNpN8sVDQsUyr1urVp5z4gItHsT7WzOD2DB+ZdIi0v4vNQ== X-Received: by 2002:a05:6a20:12c6:b0:cb:98e5:de33 with SMTP id v6-20020a056a2012c600b000cb98e5de33mr14911276pzg.3.1677789318248; Thu, 02 Mar 2023 12:35:18 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:17 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 02/11] xfs: remove XFS_PREALLOC_SYNC Date: Thu, 2 Mar 2023 12:34:55 -0800 Message-Id: <20230302203504.2998773-3-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Dave Chinner commit 472c6e46f589c26057596dcba160712a5b3e02c5 upstream. [partial backport for dependency - xfs_ioc_space() still uses XFS_PREALLOC_SYNC] Callers can acheive the same thing by calling xfs_log_force_inode() after making their modifications. There is no need for xfs_update_prealloc_flags() to do this. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/xfs/xfs_file.c | 13 +++++++------ fs/xfs/xfs_pnfs.c | 6 ++++-- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index 240eb932c014..752b676c92e3 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -95,8 +95,6 @@ xfs_update_prealloc_flags( ip->i_diflags &= ~XFS_DIFLAG_PREALLOC; xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); - if (flags & XFS_PREALLOC_SYNC) - xfs_trans_set_sync(tp); return xfs_trans_commit(tp); } @@ -1059,9 +1057,6 @@ xfs_file_fallocate( } } - if (file->f_flags & O_DSYNC) - flags |= XFS_PREALLOC_SYNC; - error = xfs_update_prealloc_flags(ip, flags); if (error) goto out_unlock; @@ -1084,8 +1079,14 @@ xfs_file_fallocate( * leave shifted extents past EOF and hence losing access to * the data that is contained within them. */ - if (do_file_insert) + if (do_file_insert) { error = xfs_insert_file_space(ip, offset, len); + if (error) + goto out_unlock; + } + + if (file->f_flags & O_DSYNC) + error = xfs_log_force_inode(ip); out_unlock: xfs_iunlock(ip, iolock); diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c index 8865f7d4404a..3a82a13d880c 100644 --- a/fs/xfs/xfs_pnfs.c +++ b/fs/xfs/xfs_pnfs.c @@ -164,10 +164,12 @@ xfs_fs_map_blocks( * that the blocks allocated and handed out to the client are * guaranteed to be present even after a server crash. */ - error = xfs_update_prealloc_flags(ip, - XFS_PREALLOC_SET | XFS_PREALLOC_SYNC); + error = xfs_update_prealloc_flags(ip, XFS_PREALLOC_SET); + if (!error) + error = xfs_log_force_inode(ip); if (error) goto out_unlock; + } else { xfs_iunlock(ip, lock_flags); } From patchwork Thu Mar 2 20:34:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157854 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D669C7EE36 for ; Thu, 2 Mar 2023 20:35:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229993AbjCBUfX (ORCPT ); Thu, 2 Mar 2023 15:35:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229919AbjCBUfU (ORCPT ); Thu, 2 Mar 2023 15:35:20 -0500 Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE762303E2 for ; Thu, 2 Mar 2023 12:35:19 -0800 (PST) Received: by mail-pj1-x102c.google.com with SMTP id 6-20020a17090a190600b00237c5b6ecd7so4001486pjg.4 for ; Thu, 02 Mar 2023 12:35:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789319; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=L6OtFpioQcuNL/EmIHlDW/bfrHDMVOXrKommZPDv0K0=; b=XPw3/GrZeZsbumGSNne6nRExE30dSSlOQ42quoiUliJ6lFpZeY1qgat7mUXMdEmhGd KqYK6fzrGHkeYof5dWkj4ksuJgk1YzSQkKcMwpOVTLA/zg+3O5uIRO9UAlMX39UI71XE im0KCCVUOO7JxEDYlI6D8PWVDid07QlvyhUaCb00gYeo07DtT5qkEjoR+1r0slwoE+RM 0AMQ9RuOG52Qqu26fH7kS7XXx0opSRKhYX47JhoIUGl88dwlCxksmppf2MjQf+o8Wj0V cpQ5mvQYs7zRMONLtl9J5JlwjwZQHXWtS37CVY1d1JBssjiv9MFdc0fSawIUBs8x9f4E HwVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789319; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=L6OtFpioQcuNL/EmIHlDW/bfrHDMVOXrKommZPDv0K0=; b=qqyupG4IrORbZzJEJEuHUgPPPYnFVYi2FA3NnBcT6tPpFp1ctzwv/5aBwpr2UzMzWQ cp6870L4vM0QXn/diSZR2uIl862wUsNlF8RFGQs/V08ennIdEFRJeS5bZyo3qUE1qdv0 IrRjpy5Psae2YTPawFomZ8hYXnALtNx929QothpKW0mN04R3ehkGXn1k7zrAi5Y7A+Zy w/ah5Hq3I/9zLCV52GjyBKsPrigIdoe49Oa0v8+LvnnQuKaOFGZkaCkRRy5EH+4QDVis 75K+2OZemTeHkEmW2Mv9spP9l68hF6TnQbwr4op2Z6sgvVldbG7E+flk7r9PlE8E7x7u hNRQ== X-Gm-Message-State: AO0yUKUn7LCntF6ZRQ677sEfnGv9HT3yxpgxKkAVZZ23zJj9gFTppxL5 d2KO6fjuISVkij6oEZQ8UFC21DZGGpfzAA== X-Google-Smtp-Source: AK7set+KhtVOJ+rSX1u0WEklcPml1xY1db37CeB4KFnoXTMdml2eiIG+LHimDuFZm5iLFb6kzg0GAQ== X-Received: by 2002:a05:6a21:6da1:b0:cc:c69b:f7e5 with SMTP id wl33-20020a056a216da100b000ccc69bf7e5mr13758600pzb.9.1677789319357; Thu, 02 Mar 2023 12:35:19 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:18 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 03/11] xfs: fallocate() should call file_modified() Date: Thu, 2 Mar 2023 12:34:56 -0800 Message-Id: <20230302203504.2998773-4-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Dave Chinner commit fbe7e520036583a783b13ff9744e35c2a329d9a4 upsream. In XFS, we always update the inode change and modification time when any fallocate() operation succeeds. Furthermore, as various fallocate modes can change the file contents (extending EOF, punching holes, zeroing things, shifting extents), we should drop file privileges like suid just like we do for a regular write(). There's already a VFS helper that figures all this out for us, so use that. The net effect of this is that we no longer drop suid/sgid if the caller is root, but we also now drop file capabilities. We also move the xfs_update_prealloc_flags() function so that it now is only called by the scope that needs to set the the prealloc flag. Based on a patch from Darrick Wong. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/xfs/xfs_file.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index 752b676c92e3..020e0a412287 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -954,6 +954,10 @@ xfs_file_fallocate( goto out_unlock; } + error = file_modified(file); + if (error) + goto out_unlock; + if (mode & FALLOC_FL_PUNCH_HOLE) { error = xfs_free_file_space(ip, offset, len); if (error) @@ -1055,11 +1059,12 @@ xfs_file_fallocate( if (error) goto out_unlock; } - } - error = xfs_update_prealloc_flags(ip, flags); - if (error) - goto out_unlock; + error = xfs_update_prealloc_flags(ip, XFS_PREALLOC_SET); + if (error) + goto out_unlock; + + } /* Change file size if needed */ if (new_size) { From patchwork Thu Mar 2 20:34:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67DDEC678D4 for ; Thu, 2 Mar 2023 20:35:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229919AbjCBUfY (ORCPT ); Thu, 2 Mar 2023 15:35:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229948AbjCBUfW (ORCPT ); Thu, 2 Mar 2023 15:35:22 -0500 Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D863C3644E for ; Thu, 2 Mar 2023 12:35:20 -0800 (PST) Received: by mail-pj1-x1035.google.com with SMTP id oj5so358712pjb.5 for ; Thu, 02 Mar 2023 12:35:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789320; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=z4WpNmWp/owzMHNA+RAMNdVLVQ750os1p8Tw/jbG7Fw=; b=cntb3iP/Ukpau6IFtcwqcVsAp/gqvAS8nBIswQXAK8DLVve8AbaHdhVAljrpH8X98U gwfFtbTQa01/Zfdi/fG3SgZN81cHWV+wP5tX22y6NhfprTMYqIy6MVpdt1ZbGl6x4oBR 73GDHITbFWYdzIO/7C2LQJehvQSLFxdCt0/bFk8j4XsQs3Rjabrwjt0DTNkWefYqejsm sFbTA/JQyEnrVSPu18LjoROZ38v2T0F3rmbPwDyOv//qzKUmmWhPBjoJDvJCK9e7pD2U CFAkQTPQ5Q1IhFeLnW0nSdOHoTJ1QcLidN28hl+SHp2TB0Ybw+RlEvpjKV9ddb8ExQvL w97Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789320; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=z4WpNmWp/owzMHNA+RAMNdVLVQ750os1p8Tw/jbG7Fw=; b=gwm0vlmXwe/S8lUub5iIFYkV9X/w1VegKZCGmJ05vCczxJHz7MU7Wi738XhrK/Pl/5 6zMHO/mAce1BlGu4HLamJQhUAsWcRsB1qxZdhqmFxFN1igMwvQhPiRm4QNHwNukl1DSH CvlSjUaxoPpWMWb1rTCchbxZ87PH28s74yWwvbHNyz5OGI91rrX6hkRyWzgd+6e1aARx fItf0kcKzzOi9QG2COr8FxvQtNZrZUnI1zZE97z70ENLUoDhzU9i3Wme8Xmia5DkMuMH nxX34nudImQleDuDbjW/SCHhklh6Y28ijc2ZQXddnrO5zvyGsuRYVMwUcbA/KyZGNaVd A5zQ== X-Gm-Message-State: AO0yUKXbRxfbbG4wOvz3WmIILUZKzCyOhqQ5pToOQD8iPtsRkCO9dyZC cN8bgfkOnOYeBc79ymLp2AQYTLQ8b3YOHA== X-Google-Smtp-Source: AK7set//ypfzWvOzim6/G3l28dzxYWX/8CjR7hLsOmw73L3La4IXaq8BmcRkcfXBYhQ+5EEtHJoY0w== X-Received: by 2002:a05:6a21:6d89:b0:cd:ed5c:4ac with SMTP id wl9-20020a056a216d8900b000cded5c04acmr11336640pzb.17.1677789320276; Thu, 02 Mar 2023 12:35:20 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:19 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 04/11] xfs: set prealloc flag in xfs_alloc_file_space() Date: Thu, 2 Mar 2023 12:34:57 -0800 Message-Id: <20230302203504.2998773-5-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Dave Chinner commit 0b02c8c0d75a738c98c35f02efb36217c170d78c upsream. Now that we only call xfs_update_prealloc_flags() from xfs_file_fallocate() in the case where we need to set the preallocation flag, do this in xfs_alloc_file_space() where we already have the inode joined into a transaction and get rid of the call to xfs_update_prealloc_flags() from the fallocate code. This also means that we now correctly avoid setting the XFS_DIFLAG_PREALLOC flag when xfs_is_always_cow_inode() is true, as these inodes will never have preallocated extents. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/xfs/xfs_bmap_util.c | 9 +++------ fs/xfs/xfs_file.c | 8 -------- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c index 73a36b7be3bd..fd2ad6a3019c 100644 --- a/fs/xfs/xfs_bmap_util.c +++ b/fs/xfs/xfs_bmap_util.c @@ -851,9 +851,6 @@ xfs_alloc_file_space( rblocks = 0; } - /* - * Allocate and setup the transaction. - */ error = xfs_trans_alloc_inode(ip, &M_RES(mp)->tr_write, dblocks, rblocks, false, &tp); if (error) @@ -870,9 +867,9 @@ xfs_alloc_file_space( if (error) goto error; - /* - * Complete the transaction - */ + ip->i_diflags |= XFS_DIFLAG_PREALLOC; + xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE); + error = xfs_trans_commit(tp); xfs_iunlock(ip, XFS_ILOCK_EXCL); if (error) diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index 020e0a412287..8cd0c3df253f 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -909,7 +909,6 @@ xfs_file_fallocate( struct inode *inode = file_inode(file); struct xfs_inode *ip = XFS_I(inode); long error; - enum xfs_prealloc_flags flags = 0; uint iolock = XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL; loff_t new_size = 0; bool do_file_insert = false; @@ -1007,8 +1006,6 @@ xfs_file_fallocate( } do_file_insert = true; } else { - flags |= XFS_PREALLOC_SET; - if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > i_size_read(inode)) { new_size = offset + len; @@ -1059,11 +1056,6 @@ xfs_file_fallocate( if (error) goto out_unlock; } - - error = xfs_update_prealloc_flags(ip, XFS_PREALLOC_SET); - if (error) - goto out_unlock; - } /* Change file size if needed */ From patchwork Thu Mar 2 20:34:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAC1EC678D4 for ; Thu, 2 Mar 2023 20:35:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229899AbjCBUf2 (ORCPT ); Thu, 2 Mar 2023 15:35:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229756AbjCBUfX (ORCPT ); Thu, 2 Mar 2023 15:35:23 -0500 Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32C8237578 for ; Thu, 2 Mar 2023 12:35:22 -0800 (PST) Received: by mail-pf1-x429.google.com with SMTP id fd25so266701pfb.1 for ; Thu, 02 Mar 2023 12:35:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789321; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Y5DAo6RoTpyDLR7cV5ESavM8boSIcTHziYnivYOeXIk=; b=ghNzOXilJY3CVs3dnABE0xhqW0FpvMrfLhoaBb0Hh4gcpUMrREPBw3ff921y/a4Mda veMAAoTdVkasccPdF308IYLm1XqnTqcUbgii8ml9SUwlOHKCWOgT45xGMRicwDLy7JX5 YHgqBbcVZQQSaLnXyLKDg/qRTGH1h78oO7SneVZZCI9b0FvCbEXUzRMT2rr3OZq1chph JRSUp/pClFnge8gAhEFDdeFHH9x98vitEkoW0crif8NyknWovfvz0yKKEvT08OMo4Enw +N5znkt/N50hr7B4XfBL3Vk0t8j9jb9mvW3vdaz66+gO4yjrySfjZ9AwGJH3elN3Qzzv WStg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789321; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Y5DAo6RoTpyDLR7cV5ESavM8boSIcTHziYnivYOeXIk=; b=QwZi8EhC0Nt/83eL6I4CvfF7tfgQvvOGyYJ+Mt7v9PdedaIlPF2AQjjs80PDTKt7n4 fOvIsYyIHJbMmuGqMcgQWqu3g84/RJYf+DNgkkkTT9RDeblJ3uvGHIdiiKo2nkxmgKaq Ah2SIxfpD3ue++nYJO/ul199eR+p3HWpcYLIH+ADnZDcJhtdHNb6vlwtuNCp2ukiLoHL 6DdffFHwQrOiBbMDkGySKqi+NTB3DmSBLgkO7oxjUJn1u7PIk4+VYWM5/zKUMzz5/Ssg Z/jH33Vi47YpAByN+rRWg6uOSUqKGIS17pb7NuTxsX4G//bT2y0Jg1eVSX1HeDgh/na3 Ba7Q== X-Gm-Message-State: AO0yUKXFobBg29y9NTrJdA87zcoo0G5HOKr7tjS/wi3Ln4Vvc+KQywZ9 qgYaleQN68U9DwtwFw2/ewTHpI68J2Y38A== X-Google-Smtp-Source: AK7set8+b0aaGn/2ZTm2Qk8UYoypU/OxaEOaishRkAYsfKjGkKVdTSZKV2LWsGaT3QZHN4kjGsI3XA== X-Received: by 2002:a62:4ecb:0:b0:5a8:bbac:1cf2 with SMTP id c194-20020a624ecb000000b005a8bbac1cf2mr8843244pfb.1.1677789321421; Thu, 02 Mar 2023 12:35:21 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:21 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Yang Xu , "Darrick J . Wong" , Christian Brauner , Jeff Layton , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 05/11] fs: add mode_strip_sgid() helper Date: Thu, 2 Mar 2023 12:34:58 -0800 Message-Id: <20230302203504.2998773-6-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Yang Xu commit 2b3416ceff5e6bd4922f6d1c61fb68113dd82302 upsream. Add a dedicated helper to handle the setgid bit when creating a new file in a setgid directory. This is a preparatory patch for moving setgid stripping into the vfs. The patch contains no functional changes. Currently the setgid stripping logic is open-coded directly in inode_init_owner() and the individual filesystems are responsible for handling setgid inheritance. Since this has proven to be brittle as evidenced by old issues we uncovered over the last months (see [1] to [3] below) we will try to move this logic into the vfs. Link: e014f37db1a2 ("xfs: use setattr_copy to set vfs inode attributes") [1] Link: 01ea173e103e ("xfs: fix up non-directory creation in SGID directories") [2] Link: fd84bfdddd16 ("ceph: fix up non-directory creation in SGID directories") [3] Link: https://lore.kernel.org/r/1657779088-2242-1-git-send-email-xuyang2018.jy@fujitsu.com Reviewed-by: Darrick J. Wong Reviewed-by: Christian Brauner (Microsoft) Reviewed-and-Tested-by: Jeff Layton Signed-off-by: Yang Xu Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/inode.c | 36 ++++++++++++++++++++++++++++++++---- include/linux/fs.h | 2 ++ 2 files changed, 34 insertions(+), 4 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index 8279c700a2b7..3740102c9bd5 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -2165,10 +2165,8 @@ void inode_init_owner(struct user_namespace *mnt_userns, struct inode *inode, /* Directories are special, and always inherit S_ISGID */ if (S_ISDIR(mode)) mode |= S_ISGID; - else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && - !in_group_p(i_gid_into_mnt(mnt_userns, dir)) && - !capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID)) - mode &= ~S_ISGID; + else + mode = mode_strip_sgid(mnt_userns, dir, mode); } else inode_fsgid_set(inode, mnt_userns); inode->i_mode = mode; @@ -2324,3 +2322,33 @@ struct timespec64 current_time(struct inode *inode) return timestamp_truncate(now, inode); } EXPORT_SYMBOL(current_time); + +/** + * mode_strip_sgid - handle the sgid bit for non-directories + * @mnt_userns: User namespace of the mount the inode was created from + * @dir: parent directory inode + * @mode: mode of the file to be created in @dir + * + * If the @mode of the new file has both the S_ISGID and S_IXGRP bit + * raised and @dir has the S_ISGID bit raised ensure that the caller is + * either in the group of the parent directory or they have CAP_FSETID + * in their user namespace and are privileged over the parent directory. + * In all other cases, strip the S_ISGID bit from @mode. + * + * Return: the new mode to use for the file + */ +umode_t mode_strip_sgid(struct user_namespace *mnt_userns, + const struct inode *dir, umode_t mode) +{ + if ((mode & (S_ISGID | S_IXGRP)) != (S_ISGID | S_IXGRP)) + return mode; + if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID)) + return mode; + if (in_group_p(i_gid_into_mnt(mnt_userns, dir))) + return mode; + if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID)) + return mode; + + return mode & ~S_ISGID; +} +EXPORT_SYMBOL(mode_strip_sgid); diff --git a/include/linux/fs.h b/include/linux/fs.h index 1e1ac116dd13..be9be4a7216c 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1941,6 +1941,8 @@ extern long compat_ptr_ioctl(struct file *file, unsigned int cmd, void inode_init_owner(struct user_namespace *mnt_userns, struct inode *inode, const struct inode *dir, umode_t mode); extern bool may_open_dev(const struct path *path); +umode_t mode_strip_sgid(struct user_namespace *mnt_userns, + const struct inode *dir, umode_t mode); /* * This is the "filldir" function type, used by readdir() to let From patchwork Thu Mar 2 20:34:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 762F3C7EE30 for ; Thu, 2 Mar 2023 20:35:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230001AbjCBUf3 (ORCPT ); Thu, 2 Mar 2023 15:35:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229948AbjCBUfZ (ORCPT ); Thu, 2 Mar 2023 15:35:25 -0500 Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1A83231D1 for ; Thu, 2 Mar 2023 12:35:23 -0800 (PST) Received: by mail-pf1-x42a.google.com with SMTP id a7so232915pfx.10 for ; Thu, 02 Mar 2023 12:35:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HPD1lA0UjlirRZ/iYM+1pzqyy1tVcZoX6xtT6Grj7Z0=; b=Q9RxP8pVa4TgKCtJl4qajfOZb4BtmS/XMbULFGDuNsH1iVHqxTZ2e/jAux9qhn4Sw5 rbstuq9JW5rueTNVzCxwcyZtUrxCHNrtaU1K4bi7gBjZJ8DHTX+Yp7+I7O00LcgwHIj5 D/fPLinJuSZXSO6UQpQWiklPmjzb8oOMjI8BWz582HX4Ib4ubwiqzBR3WWgzm4N6icbW sFhBnTolJW2bP9qm9kOSRFHG+cnDAbWeKxQBmyl4gPQEItkUTCJtb7kVyHpejQP8wMTx FijUCgEcVQMmb5jb5dOvUj2vIQPTcvyB0JthBafUPcDq9BlJg3Um5InhFOT/D0wrxUP6 aEIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=HPD1lA0UjlirRZ/iYM+1pzqyy1tVcZoX6xtT6Grj7Z0=; b=xP0xDIs200IasOAPtPav1dZv3YpTZ92OvC2N8pJClKzm/huZLd1B7uU+cmdReY46GV 90ec7oizEyMR+JgAZYyFme1fk3WIYTSmUBcRJhIgWXrPnrJTCrYxm9FAV7HmwoRtL53f tf2YMZ/hbPIMM3rxemOGyxHBXvTxmFGT1X12ot4Jc2Qi9fIVd+4hn4Nhrr6daYrAX0sC erta3wxphPpUC/pUmQrz1sCan4pMz3HgZE8iLXbfJK5qpIwYqsiCZHoEB3lPBC0xoOyk df7m5Fhg8Rp7z5VUPxbrn+cPn0oMsQVoxjoBRGaP1vJ1zFXv1WzO8cHp1QBJpFtX6ha+ F6mQ== X-Gm-Message-State: AO0yUKUzL+ZhtfwmCcAns9SknjbGrq5XGjzFmXWw68s6xiGPIRSDSdNg WPHvTJKOWLXEoR6uVoJ71XXKWZHRET3G+A== X-Google-Smtp-Source: AK7set/qcN7nOTIXCfBtdNIgPbUpY+kODAVq7D2TDNUPK9+Ds7SboGtGDqfTIGF3gNvur8aln4Wa2A== X-Received: by 2002:aa7:8bd6:0:b0:5a8:ba74:7a7b with SMTP id s22-20020aa78bd6000000b005a8ba747a7bmr11192614pfd.1.1677789322797; Thu, 02 Mar 2023 12:35:22 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:22 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Yang Xu , Dave Chinner , Christian Brauner , "Darrick J . Wong" , Jeff Layton , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 06/11] fs: move S_ISGID stripping into the vfs_*() helpers Date: Thu, 2 Mar 2023 12:34:59 -0800 Message-Id: <20230302203504.2998773-7-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Yang Xu commit 1639a49ccdce58ea248841ed9b23babcce6dbb0b upsream. Move setgid handling out of individual filesystems and into the VFS itself to stop the proliferation of setgid inheritance bugs. Creating files that have both the S_IXGRP and S_ISGID bit raised in directories that themselves have the S_ISGID bit set requires additional privileges to avoid security issues. When a filesystem creates a new inode it needs to take care that the caller is either in the group of the newly created inode or they have CAP_FSETID in their current user namespace and are privileged over the parent directory of the new inode. If any of these two conditions is true then the S_ISGID bit can be raised for an S_IXGRP file and if not it needs to be stripped. However, there are several key issues with the current implementation: * S_ISGID stripping logic is entangled with umask stripping. If a filesystem doesn't support or enable POSIX ACLs then umask stripping is done directly in the vfs before calling into the filesystem. If the filesystem does support POSIX ACLs then unmask stripping may be done in the filesystem itself when calling posix_acl_create(). Since umask stripping has an effect on S_ISGID inheritance, e.g., by stripping the S_IXGRP bit from the file to be created and all relevant filesystems have to call posix_acl_create() before inode_init_owner() where we currently take care of S_ISGID handling S_ISGID handling is order dependent. IOW, whether or not you get a setgid bit depends on POSIX ACLs and umask and in what order they are called. Note that technically filesystems are free to impose their own ordering between posix_acl_create() and inode_init_owner() meaning that there's additional ordering issues that influence S_SIGID inheritance. * Filesystems that don't rely on inode_init_owner() don't get S_ISGID stripping logic. While that may be intentional (e.g. network filesystems might just defer setgid stripping to a server) it is often just a security issue. This is not just ugly it's unsustainably messy especially since we do still have bugs in this area years after the initial round of setgid bugfixes. So the current state is quite messy and while we won't be able to make it completely clean as posix_acl_create() is still a filesystem specific call we can improve the S_SIGD stripping situation quite a bit by hoisting it out of inode_init_owner() and into the vfs creation operations. This means we alleviate the burden for filesystems to handle S_ISGID stripping correctly and can standardize the ordering between S_ISGID and umask stripping in the vfs. We add a new helper vfs_prepare_mode() so S_ISGID handling is now done in the VFS before umask handling. This has S_ISGID handling is unaffected unaffected by whether umask stripping is done by the VFS itself (if no POSIX ACLs are supported or enabled) or in the filesystem in posix_acl_create() (if POSIX ACLs are supported). The vfs_prepare_mode() helper is called directly in vfs_*() helpers that create new filesystem objects. We need to move them into there to make sure that filesystems like overlayfs hat have callchains like: sys_mknod() -> do_mknodat(mode) -> .mknod = ovl_mknod(mode) -> ovl_create(mode) -> vfs_mknod(mode) get S_ISGID stripping done when calling into lower filesystems via vfs_*() creation helpers. Moving vfs_prepare_mode() into e.g. vfs_mknod() takes care of that. This is in any case semantically cleaner because S_ISGID stripping is VFS security requirement. Security hooks so far have seen the mode with the umask applied but without S_ISGID handling done. The relevant hooks are called outside of vfs_*() creation helpers so by calling vfs_prepare_mode() from vfs_*() helpers the security hooks would now see the mode without umask stripping applied. For now we fix this by passing the mode with umask settings applied to not risk any regressions for LSM hooks. IOW, nothing changes for LSM hooks. It is worth pointing out that security hooks never saw the mode that is seen by the filesystem when actually creating the file. They have always been completely misplaced for that to work. The following filesystems use inode_init_owner() and thus relied on S_ISGID stripping: spufs, 9p, bfs, btrfs, ext2, ext4, f2fs, hfsplus, hugetlbfs, jfs, minix, nilfs2, ntfs3, ocfs2, omfs, overlayfs, ramfs, reiserfs, sysv, ubifs, udf, ufs, xfs, zonefs, bpf, tmpfs. All of the above filesystems end up calling inode_init_owner() when new filesystem objects are created through the ->mkdir(), ->mknod(), ->create(), ->tmpfile(), ->rename() inode operations. Since directories always inherit the S_ISGID bit with the exception of xfs when irix_sgid_inherit mode is turned on S_ISGID stripping doesn't apply. The ->symlink() and ->link() inode operations trivially inherit the mode from the target and the ->rename() inode operation inherits the mode from the source inode. All other creation inode operations will get S_ISGID handling via vfs_prepare_mode() when called from their relevant vfs_*() helpers. In addition to this there are filesystems which allow the creation of filesystem objects through ioctl()s or - in the case of spufs - circumventing the vfs in other ways. If filesystem objects are created through ioctl()s the vfs doesn't know about it and can't apply regular permission checking including S_ISGID logic. Therfore, a filesystem relying on S_ISGID stripping in inode_init_owner() in their ioctl() callpath will be affected by moving this logic into the vfs. We audited those filesystems: * btrfs allows the creation of filesystem objects through various ioctls(). Snapshot creation literally takes a snapshot and so the mode is fully preserved and S_ISGID stripping doesn't apply. Creating a new subvolum relies on inode_init_owner() in btrfs_new_subvol_inode() but only creates directories and doesn't raise S_ISGID. * ocfs2 has a peculiar implementation of reflinks. In contrast to e.g. xfs and btrfs FICLONE/FICLONERANGE ioctl() that is only concerned with the actual extents ocfs2 uses a separate ioctl() that also creates the target file. Iow, ocfs2 circumvents the vfs entirely here and did indeed rely on inode_init_owner() to strip the S_ISGID bit. This is the only place where a filesystem needs to call mode_strip_sgid() directly but this is self-inflicted pain. * spufs doesn't go through the vfs at all and doesn't use ioctl()s either. Instead it has a dedicated system call spufs_create() which allows the creation of filesystem objects. But spufs only creates directories and doesn't allo S_SIGID bits, i.e. it specifically only allows 0777 bits. * bpf uses vfs_mkobj() but also doesn't allow S_ISGID bits to be created. The patch will have an effect on ext2 when the EXT2_MOUNT_GRPID mount option is used, on ext4 when the EXT4_MOUNT_GRPID mount option is used, and on xfs when the XFS_FEAT_GRPID mount option is used. When any of these filesystems are mounted with their respective GRPID option then newly created files inherit the parent directories group unconditionally. In these cases non of the filesystems call inode_init_owner() and thus did never strip the S_ISGID bit for newly created files. Moving this logic into the VFS means that they now get the S_ISGID bit stripped. This is a user visible change. If this leads to regressions we will either need to figure out a better way or we need to revert. However, given the various setgid bugs that we found just in the last two years this is a regression risk we should take. Associated with this change is a new set of fstests to enforce the semantics for all new filesystems. Link: https://lore.kernel.org/ceph-devel/20220427092201.wvsdjbnc7b4dttaw@wittgenstein [1] Link: e014f37db1a2 ("xfs: use setattr_copy to set vfs inode attributes") [2] Link: 01ea173e103e ("xfs: fix up non-directory creation in SGID directories") [3] Link: fd84bfdddd16 ("ceph: fix up non-directory creation in SGID directories") [4] Link: https://lore.kernel.org/r/1657779088-2242-3-git-send-email-xuyang2018.jy@fujitsu.com Suggested-by: Dave Chinner Suggested-by: Christian Brauner (Microsoft) Reviewed-by: Darrick J. Wong Reviewed-and-Tested-by: Jeff Layton Signed-off-by: Yang Xu [: rewrote commit message] Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/inode.c | 2 -- fs/namei.c | 82 ++++++++++++++++++++++++++++++++++++++++-------- fs/ocfs2/namei.c | 1 + 3 files changed, 70 insertions(+), 15 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index 3740102c9bd5..957b2d18ec29 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -2165,8 +2165,6 @@ void inode_init_owner(struct user_namespace *mnt_userns, struct inode *inode, /* Directories are special, and always inherit S_ISGID */ if (S_ISDIR(mode)) mode |= S_ISGID; - else - mode = mode_strip_sgid(mnt_userns, dir, mode); } else inode_fsgid_set(inode, mnt_userns); inode->i_mode = mode; diff --git a/fs/namei.c b/fs/namei.c index 81b31d9a063f..02e99606c65b 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3000,6 +3000,65 @@ void unlock_rename(struct dentry *p1, struct dentry *p2) } EXPORT_SYMBOL(unlock_rename); +/** + * mode_strip_umask - handle vfs umask stripping + * @dir: parent directory of the new inode + * @mode: mode of the new inode to be created in @dir + * + * Umask stripping depends on whether or not the filesystem supports POSIX + * ACLs. If the filesystem doesn't support it umask stripping is done directly + * in here. If the filesystem does support POSIX ACLs umask stripping is + * deferred until the filesystem calls posix_acl_create(). + * + * Returns: mode + */ +static inline umode_t mode_strip_umask(const struct inode *dir, umode_t mode) +{ + if (!IS_POSIXACL(dir)) + mode &= ~current_umask(); + return mode; +} + +/** + * vfs_prepare_mode - prepare the mode to be used for a new inode + * @mnt_userns: user namespace of the mount the inode was found from + * @dir: parent directory of the new inode + * @mode: mode of the new inode + * @mask_perms: allowed permission by the vfs + * @type: type of file to be created + * + * This helper consolidates and enforces vfs restrictions on the @mode of a new + * object to be created. + * + * Umask stripping depends on whether the filesystem supports POSIX ACLs (see + * the kernel documentation for mode_strip_umask()). Moving umask stripping + * after setgid stripping allows the same ordering for both non-POSIX ACL and + * POSIX ACL supporting filesystems. + * + * Note that it's currently valid for @type to be 0 if a directory is created. + * Filesystems raise that flag individually and we need to check whether each + * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a + * non-zero type. + * + * Returns: mode to be passed to the filesystem + */ +static inline umode_t vfs_prepare_mode(struct user_namespace *mnt_userns, + const struct inode *dir, umode_t mode, + umode_t mask_perms, umode_t type) +{ + mode = mode_strip_sgid(mnt_userns, dir, mode); + mode = mode_strip_umask(dir, mode); + + /* + * Apply the vfs mandated allowed permission mask and set the type of + * file to be created before we call into the filesystem. + */ + mode &= (mask_perms & ~S_IFMT); + mode |= (type & S_IFMT); + + return mode; +} + /** * vfs_create - create new file * @mnt_userns: user namespace of the mount the inode was found from @@ -3025,8 +3084,8 @@ int vfs_create(struct user_namespace *mnt_userns, struct inode *dir, if (!dir->i_op->create) return -EACCES; /* shouldn't it be ENOSYS? */ - mode &= S_IALLUGO; - mode |= S_IFREG; + + mode = vfs_prepare_mode(mnt_userns, dir, mode, S_IALLUGO, S_IFREG); error = security_inode_create(dir, dentry, mode); if (error) return error; @@ -3291,8 +3350,7 @@ static struct dentry *lookup_open(struct nameidata *nd, struct file *file, if (open_flag & O_CREAT) { if (open_flag & O_EXCL) open_flag &= ~O_TRUNC; - if (!IS_POSIXACL(dir->d_inode)) - mode &= ~current_umask(); + mode = vfs_prepare_mode(mnt_userns, dir->d_inode, mode, mode, mode); if (likely(got_write)) create_error = may_o_create(mnt_userns, &nd->path, dentry, mode); @@ -3525,8 +3583,7 @@ struct dentry *vfs_tmpfile(struct user_namespace *mnt_userns, child = d_alloc(dentry, &slash_name); if (unlikely(!child)) goto out_err; - if (!IS_POSIXACL(dir)) - mode &= ~current_umask(); + mode = vfs_prepare_mode(mnt_userns, dir, mode, mode, mode); error = dir->i_op->tmpfile(mnt_userns, dir, child, mode); if (error) goto out_err; @@ -3804,6 +3861,7 @@ int vfs_mknod(struct user_namespace *mnt_userns, struct inode *dir, if (!dir->i_op->mknod) return -EPERM; + mode = vfs_prepare_mode(mnt_userns, dir, mode, mode, mode); error = devcgroup_inode_mknod(mode, dev); if (error) return error; @@ -3854,9 +3912,8 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode, if (IS_ERR(dentry)) goto out1; - if (!IS_POSIXACL(path.dentry->d_inode)) - mode &= ~current_umask(); - error = security_path_mknod(&path, dentry, mode, dev); + error = security_path_mknod(&path, dentry, + mode_strip_umask(path.dentry->d_inode, mode), dev); if (error) goto out2; @@ -3926,7 +3983,7 @@ int vfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir, if (!dir->i_op->mkdir) return -EPERM; - mode &= (S_IRWXUGO|S_ISVTX); + mode = vfs_prepare_mode(mnt_userns, dir, mode, S_IRWXUGO | S_ISVTX, 0); error = security_inode_mkdir(dir, dentry, mode); if (error) return error; @@ -3954,9 +4011,8 @@ int do_mkdirat(int dfd, struct filename *name, umode_t mode) if (IS_ERR(dentry)) goto out_putname; - if (!IS_POSIXACL(path.dentry->d_inode)) - mode &= ~current_umask(); - error = security_path_mkdir(&path, dentry, mode); + error = security_path_mkdir(&path, dentry, + mode_strip_umask(path.dentry->d_inode, mode)); if (!error) { struct user_namespace *mnt_userns; mnt_userns = mnt_user_ns(path.mnt); diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 11807034dd48..5b8237ceb8cc 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -197,6 +197,7 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) * callers. */ if (S_ISDIR(mode)) set_nlink(inode, 2); + mode = mode_strip_sgid(&init_user_ns, dir, mode); inode_init_owner(&init_user_ns, inode, dir, mode); status = dquot_initialize(inode); if (status) From patchwork Thu Mar 2 20:35:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157858 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 765C5C6FA8E for ; Thu, 2 Mar 2023 20:35:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230009AbjCBUfa (ORCPT ); Thu, 2 Mar 2023 15:35:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230025AbjCBUf1 (ORCPT ); Thu, 2 Mar 2023 15:35:27 -0500 Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2CCE3C796 for ; Thu, 2 Mar 2023 12:35:24 -0800 (PST) Received: by mail-pf1-x42b.google.com with SMTP id a7so232942pfx.10 for ; Thu, 02 Mar 2023 12:35:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789324; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ffHjllkvVvRGZ1w2VQreYrwPABI5RgMVuGLe+1NrrCo=; b=kP2yJ6cFfDxLYG6HQLR4KZrcmJz+EMZo9P6iMOEXw31ezqECmn+rrcRFglcSIfpbU7 xy5Tao0NFxHR1EDGUcJc37oFUD59e22WR/uXJ3mERcR14Blk0i+02sCacTLUvtHWh3W6 w5WaS+WgyH4TYd5rZGG0cba0trz2qgib9P2C7R7jf/AEwe9rIhmKA4BX2/isJieBJj7N 5gi++0tXcqnKOClJ3o0uLl0MDpbeUy/irrRjeP/pXDjW8YdE7PqoVGwH7BPZq8i4kztI Ho7qq1X1X2JuEJ+Z8iD+kyg5JUajYEBlLyyZ9/teZVluzMOP41KXtGY85t4YOEpt88Rx TTtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789324; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ffHjllkvVvRGZ1w2VQreYrwPABI5RgMVuGLe+1NrrCo=; b=Wp6VxpZiF0e1MhBd7Ubw//cK8t9/JpwJLqxgDWCbmKB9us+y9M0pOwMwKbTSmFfs2m HzzdqCEPv8KECD/uOaF0M/R3vpo+XsCS3AlFNu5h5KST/OCzdJH9/eq3GRJUd8eTe9D4 cVhzX6aKSa2Rilhdcpn7bptFIQ0t1VqRj1w48n6Xjn+V/ZBvORdEMBOpM19TjNh6TIUC NUm+SQPd1sYQO1cr4xyhRir/Rbxd+lEOpEsQQzwTkp6w6sfghapSrVVY1yVSHiOGDepf kf2SQzLJ5ezWPrSmtTiqEv7to91ULsjPusvUYsFQlNdROhbdxgH3WQbI1iARmft3Zax0 F58g== X-Gm-Message-State: AO0yUKWCdLVH/Fv6k5ysMn6ftObx15Em98m78K9Gn3FX4f2ClOyIokuj zAX9p0HOxCxIyor2EU9EwJBI121GENQZtA== X-Google-Smtp-Source: AK7set9HdnYHfXy6oLoZ9o9Xce1/FBNSbKPRVCLGt1JxVkIYysQ+qtf4ANsB5UpX3fAYc5wavBavWw== X-Received: by 2002:aa7:9821:0:b0:5aa:9ef7:4f7f with SMTP id q1-20020aa79821000000b005aa9ef74f7fmr11447498pfl.9.1677789323717; Thu, 02 Mar 2023 12:35:23 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:23 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Christian Brauner , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 07/11] attr: add in_group_or_capable() Date: Thu, 2 Mar 2023 12:35:00 -0800 Message-Id: <20230302203504.2998773-8-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Christian Brauner commit 11c2a8700cdcabf9b639b7204a1e38e2a0b6798e upstream. [backport to 5.15.y, prior to vfsgid_t] In setattr_{copy,prepare}() we need to perform the same permission checks to determine whether we need to drop the setgid bit or not. Instead of open-coding it twice add a simple helper the encapsulates the logic. We will reuse this helpers to make dropping the setgid bit during write operations more consistent in a follow up patch. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/attr.c | 8 ++++---- fs/inode.c | 28 ++++++++++++++++++++++++---- fs/internal.h | 2 ++ 3 files changed, 30 insertions(+), 8 deletions(-) diff --git a/fs/attr.c b/fs/attr.c index f581c4d00897..686840aa91c8 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -18,6 +18,8 @@ #include #include +#include "internal.h" + /** * chown_ok - verify permissions to chown inode * @mnt_userns: user namespace of the mount @inode was found from @@ -141,8 +143,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry, mapped_gid = i_gid_into_mnt(mnt_userns, inode); /* Also check the setgid bit! */ - if (!in_group_p(mapped_gid) && - !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID)) + if (!in_group_or_capable(mnt_userns, inode, mapped_gid)) attr->ia_mode &= ~S_ISGID; } @@ -257,8 +258,7 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode, if (ia_valid & ATTR_MODE) { umode_t mode = attr->ia_mode; kgid_t kgid = i_gid_into_mnt(mnt_userns, inode); - if (!in_group_p(kgid) && - !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID)) + if (!in_group_or_capable(mnt_userns, inode, kgid)) mode &= ~S_ISGID; inode->i_mode = mode; } diff --git a/fs/inode.c b/fs/inode.c index 957b2d18ec29..a71fb82279bb 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -2321,6 +2321,28 @@ struct timespec64 current_time(struct inode *inode) } EXPORT_SYMBOL(current_time); +/** + * in_group_or_capable - check whether caller is CAP_FSETID privileged + * @mnt_userns: user namespace of the mount @inode was found from + * @inode: inode to check + * @gid: the new/current gid of @inode + * + * Check wether @gid is in the caller's group list or if the caller is + * privileged with CAP_FSETID over @inode. This can be used to determine + * whether the setgid bit can be kept or must be dropped. + * + * Return: true if the caller is sufficiently privileged, false if not. + */ +bool in_group_or_capable(struct user_namespace *mnt_userns, + const struct inode *inode, kgid_t gid) +{ + if (in_group_p(gid)) + return true; + if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID)) + return true; + return false; +} + /** * mode_strip_sgid - handle the sgid bit for non-directories * @mnt_userns: User namespace of the mount the inode was created from @@ -2342,11 +2364,9 @@ umode_t mode_strip_sgid(struct user_namespace *mnt_userns, return mode; if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID)) return mode; - if (in_group_p(i_gid_into_mnt(mnt_userns, dir))) - return mode; - if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID)) + if (in_group_or_capable(mnt_userns, dir, + i_gid_into_mnt(mnt_userns, dir))) return mode; - return mode & ~S_ISGID; } EXPORT_SYMBOL(mode_strip_sgid); diff --git a/fs/internal.h b/fs/internal.h index 9075490f21a6..c89814727281 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -150,6 +150,8 @@ extern int vfs_open(const struct path *, struct file *); extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc); extern void inode_add_lru(struct inode *inode); extern int dentry_needs_remove_privs(struct dentry *dentry); +bool in_group_or_capable(struct user_namespace *mnt_userns, + const struct inode *inode, kgid_t gid); /* * fs-writeback.c From patchwork Thu Mar 2 20:35:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157859 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 660A3C678D4 for ; Thu, 2 Mar 2023 20:35:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230085AbjCBUfb (ORCPT ); Thu, 2 Mar 2023 15:35:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230040AbjCBUf1 (ORCPT ); Thu, 2 Mar 2023 15:35:27 -0500 Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B13F3B3D6 for ; Thu, 2 Mar 2023 12:35:25 -0800 (PST) Received: by mail-pj1-x1036.google.com with SMTP id h17-20020a17090aea9100b0023739b10792so232457pjz.1 for ; Thu, 02 Mar 2023 12:35:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789325; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=haZ42m0/l8xy8tqqGax15bMFS6+aIr3FtSypMBK7kbk=; b=hDSNVZK62lBg8np2+PDAEugUgzwPO6m8aaN0X6YnPVYZFWYrx4yMXZnJb+hmYhPPrF y87iy7IogyoGa0tLPaPYB0XOOuBfL84AQLGX99bkXDZTzEuLLEJcxtS1Lbd9xSgV6tUU qjEZMV3+dKc5MwAfDX9yspIuIjCQBA8xhNJnBDQLqZmIFaWaPMXBGNzmGtTjwqw6AE3c zoUuSu6ES7TaYQRz+6UrCVfE+MjjEQrkvL8oFnoiaECzfEn45zqTHe31r+YxCICucm3o ODBHFMYBp0m/bR1ne1SJUb6V6DmjSYB7CAWD+JrRxlkH6tYnnBM5kU/cJO2YWvu5RJTG 5hZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789325; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=haZ42m0/l8xy8tqqGax15bMFS6+aIr3FtSypMBK7kbk=; b=63/pQNfXx9mPOLlSdWWyYqEwG21Oj+3jC6phEqKC2QxT19drfkKJdqtrilQ2/yUYQq ECtGRr7D41rG+kAgiYIOKMxEY+eWKtxaB3kTrDYnfTkDsZH4LJukHTQD8W+Zj76Djncw uiUQDFUX2D8UHgghViZs9ZJBoba1QBjfOn4v7rPctEA0lrXRgQS7N2OWmlx40dSd9QM3 OBI82vpGzmU3cTC1if8Rv+29S+6xQn6m+0WgcUhsrxA+EnCH3WH61B2nKtt48eTePnlR iGKMHxLEzOSRupQ4Nz80WCN6rr/rV6UFoSiMDus/wPmONGW3vCelHKAawKMsyheBC7YK xRsg== X-Gm-Message-State: AO0yUKXYd+aWvRgGOY1i7VDiT2Dp3fcEZvDvs0wjtO73cf/bs0+k3JMw 0bx+oFa/VWfu4dvv9fLK3+1VLgeMYto4bQ== X-Google-Smtp-Source: AK7set8WWb5h0X75vPpeSLGGn+361Z2gsHEmQo/zPL7LMf99IIv7wyrRrfU9nZ7eiWwySYuBUBGNVw== X-Received: by 2002:a05:6a20:7f8c:b0:bf:8ee2:2009 with SMTP id d12-20020a056a207f8c00b000bf8ee22009mr4411881pzj.26.1677789325029; Thu, 02 Mar 2023 12:35:25 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:24 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Christian Brauner , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 08/11] fs: move should_remove_suid() Date: Thu, 2 Mar 2023 12:35:01 -0800 Message-Id: <20230302203504.2998773-9-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Christian Brauner commit e243e3f94c804ecca9a8241b5babe28f35258ef4 upstream. Move the helper from inode.c to attr.c. This keeps the the core of the set{g,u}id stripping logic in one place when we add follow-up changes. It is the better place anyway, since should_remove_suid() returns ATTR_KILL_S{G,U}ID flags. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/attr.c | 29 +++++++++++++++++++++++++++++ fs/inode.c | 29 ----------------------------- 2 files changed, 29 insertions(+), 29 deletions(-) diff --git a/fs/attr.c b/fs/attr.c index 686840aa91c8..f045431bab1a 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -20,6 +20,35 @@ #include "internal.h" +/* + * The logic we want is + * + * if suid or (sgid and xgrp) + * remove privs + */ +int should_remove_suid(struct dentry *dentry) +{ + umode_t mode = d_inode(dentry)->i_mode; + int kill = 0; + + /* suid always must be killed */ + if (unlikely(mode & S_ISUID)) + kill = ATTR_KILL_SUID; + + /* + * sgid without any exec bits is just a mandatory locking mark; leave + * it alone. If some exec bits are set, it's a real sgid; kill it. + */ + if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) + kill |= ATTR_KILL_SGID; + + if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode))) + return kill; + + return 0; +} +EXPORT_SYMBOL(should_remove_suid); + /** * chown_ok - verify permissions to chown inode * @mnt_userns: user namespace of the mount @inode was found from diff --git a/fs/inode.c b/fs/inode.c index a71fb82279bb..3811269259e1 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1864,35 +1864,6 @@ void touch_atime(const struct path *path) } EXPORT_SYMBOL(touch_atime); -/* - * The logic we want is - * - * if suid or (sgid and xgrp) - * remove privs - */ -int should_remove_suid(struct dentry *dentry) -{ - umode_t mode = d_inode(dentry)->i_mode; - int kill = 0; - - /* suid always must be killed */ - if (unlikely(mode & S_ISUID)) - kill = ATTR_KILL_SUID; - - /* - * sgid without any exec bits is just a mandatory locking mark; leave - * it alone. If some exec bits are set, it's a real sgid; kill it. - */ - if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) - kill |= ATTR_KILL_SGID; - - if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode))) - return kill; - - return 0; -} -EXPORT_SYMBOL(should_remove_suid); - /* * Return mask of changes for notify_change() that need to be done as a * response to write or truncate. Return 0 if nothing has to be changed. From patchwork Thu Mar 2 20:35:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157860 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEC85C7EE36 for ; Thu, 2 Mar 2023 20:35:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229756AbjCBUfb (ORCPT ); Thu, 2 Mar 2023 15:35:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230086AbjCBUf2 (ORCPT ); Thu, 2 Mar 2023 15:35:28 -0500 Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F205E38037 for ; Thu, 2 Mar 2023 12:35:26 -0800 (PST) Received: by mail-pj1-x102f.google.com with SMTP id cp7-20020a17090afb8700b0023756229427so4038168pjb.1 for ; Thu, 02 Mar 2023 12:35:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789326; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=IqrzJFbimxZ2WoVp2Bt8iAhYxULGlkKFADFBXR9h2W4=; b=F6wF60EcW1KdHsDkSyBkOPWaZKm8cWsmLjd+KJrm+dbjUhW7ZiqEPH2vo0npKZDbfI tRFT5wih1WFBLyFsin9Hzak7a8b4NBoflMFWnMsSqo10Y41hGPr0DHt+4veltHnJyLKr LelbNCV6hq52vSsYyRWvm8/H3+2RRIbQvePeRGzBnYIvaxbQeUWqrihp7KSxOsbe4MGV gqFVvcJGyaNiZ3OSVHJubbEl4W/5xWcNtR1EMhEHhX5t5wr2ZYhNK2++ch4R/oNkYH4i 9NGOedmXoZSJ/FmAhK+4Vz1NJr+iEyvCAVXSXgMMI1rU8wJa/0HaRPNlDvamvNsidKDF G42Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789326; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IqrzJFbimxZ2WoVp2Bt8iAhYxULGlkKFADFBXR9h2W4=; b=Uz9XCyVXx6E97nWdoYO3L/Ukd7AnDDvaMTfa9z8ueRi1CouBeabwOI29yQvjbmPLzj kV+hHOFUUy5ldtnPniy2Aurxc08gXaElIapLswFa3vDPXT61mYWIZQypTx4khZkTVxP3 8gO8V74d4oIpJGt58YSk8DcoItIt8GDKJnqLal3BjbFbZFrJ8WOVIkogXOPDOCovfmHt 0/IrUx0yM9c7FEqdZSIYjMhUmPoOxboy/+2EG/Kj9SEa1DZYVlgSGgfgHb46TN3mlb2F vv6oIgpmeW06kSsiK9HlJHuK1vrxBVxST+gTOYhdkEwUkZIAPRC56+f1h1cwwn4E/lIe yYQg== X-Gm-Message-State: AO0yUKWV+bJoM7T5Ztf9C13ZAviPKyrr0SCAUm9CcWEv6yeA6GBV7eTg yD3yX+w/yFvcp6/AN9vyGz7CWB1WrFrKXw== X-Google-Smtp-Source: AK7set+B2o4cSJy4u2i/WMHGNdVBciuTGEzxpEAdxp5s7t18GPPo3xBqZq4C05UgTyfiqPe5KJ2iAQ== X-Received: by 2002:a05:6a20:8c1f:b0:cc:a62f:1a9d with SMTP id j31-20020a056a208c1f00b000cca62f1a9dmr10532626pzh.23.1677789326165; Thu, 02 Mar 2023 12:35:26 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:25 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Christian Brauner , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 09/11] attr: add setattr_should_drop_sgid() Date: Thu, 2 Mar 2023 12:35:02 -0800 Message-Id: <20230302203504.2998773-10-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Christian Brauner commit 72ae017c5451860443a16fb2a8c243bff3e396b8 upstream. [backport to 5.15.y, prior to vfsgid_t] The current setgid stripping logic during write and ownership change operations is inconsistent and strewn over multiple places. In order to consolidate it and make more consistent we'll add a new helper setattr_should_drop_sgid(). The function retains the old behavior where we remove the S_ISGID bit unconditionally when S_IXGRP is set but also when it isn't set and the caller is neither in the group of the inode nor privileged over the inode. We will use this helper both in write operation permission removal such as file_remove_privs() as well as in ownership change operations. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- fs/attr.c | 28 ++++++++++++++++++++++++++++ fs/internal.h | 6 ++++++ 2 files changed, 34 insertions(+) diff --git a/fs/attr.c b/fs/attr.c index f045431bab1a..965be68ed8fa 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -20,6 +20,34 @@ #include "internal.h" +/** + * setattr_should_drop_sgid - determine whether the setgid bit needs to be + * removed + * @mnt_userns: user namespace of the mount @inode was found from + * @inode: inode to check + * + * This function determines whether the setgid bit needs to be removed. + * We retain backwards compatibility and require setgid bit to be removed + * unconditionally if S_IXGRP is set. Otherwise we have the exact same + * requirements as setattr_prepare() and setattr_copy(). + * + * Return: ATTR_KILL_SGID if setgid bit needs to be removed, 0 otherwise. + */ +int setattr_should_drop_sgid(struct user_namespace *mnt_userns, + const struct inode *inode) +{ + umode_t mode = inode->i_mode; + + if (!(mode & S_ISGID)) + return 0; + if (mode & S_IXGRP) + return ATTR_KILL_SGID; + if (!in_group_or_capable(mnt_userns, inode, + i_gid_into_mnt(mnt_userns, inode))) + return ATTR_KILL_SGID; + return 0; +} + /* * The logic we want is * diff --git a/fs/internal.h b/fs/internal.h index c89814727281..45cf31d7380b 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -231,3 +231,9 @@ struct xattr_ctx { int setxattr_copy(const char __user *name, struct xattr_ctx *ctx); int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry, struct xattr_ctx *ctx); + +/* + * fs/attr.c + */ +int setattr_should_drop_sgid(struct user_namespace *mnt_userns, + const struct inode *inode); From patchwork Thu Mar 2 20:35:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157862 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42E82C7EE30 for ; Thu, 2 Mar 2023 20:35:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229997AbjCBUfd (ORCPT ); Thu, 2 Mar 2023 15:35:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230045AbjCBUfa (ORCPT ); Thu, 2 Mar 2023 15:35:30 -0500 Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53B90231D1 for ; Thu, 2 Mar 2023 12:35:28 -0800 (PST) Received: by mail-pf1-x433.google.com with SMTP id b20so247450pfo.6 for ; Thu, 02 Mar 2023 12:35:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oL+V9UIB+laehwkeVuFBUdE1PhkTjvrzmXHa6OQTpuA=; b=BPo6XDNvtqXyRYawqJGfWInxUWMw+MDf4VDaFDvGvTK7fpRnmomF3Du5gwW7/8y5rN ubPNJqwDF+UmY6E/jbS/eSsRiQmB4RGk65Ckqm6P3I5BlgUeY5ACl4DWBI7KDhyz4Xpk SzHiCWKzLQ18SWipuWlCNxj6Vvwec8NOq/Y40S5nE6ejwcLvd7a3Xv1Wi0QFfRxLJ9R8 pgN6ipcimFs5zmUvkWTV0QpyvRqR9ZD/VwYpcUTgQdKinz80P9LKq9SlVJVqcb0x+6af NUreEkNAHiL7e0VynFr1j9QHoPUF926O3kHl/hD3oGCCFTWWWJ5WYf0F28HUBUkPEwlH Bo+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oL+V9UIB+laehwkeVuFBUdE1PhkTjvrzmXHa6OQTpuA=; b=Uka+dLFPkA6zbC2Fv/kf7Pgz6uSMq16OQMfe5M42SHoo7eSXEMCztEVcAN0f3CZgfg Aez9gBgGwa1VPx6vQuoyIZf/OiN3/ojacxTyPMbwjp8kEF5mWDDBoqG3F1l2X66sicvc KLkJ7LZ7iwtLIIaNa1RLkPSqHIbBK5GXpnH3MY8SBBU4yKqqxhNIjYRKn5XswJDeJaRc Y1OYQKvS5sMYEElnI+FZL8CxO+nbxVNZ5kpILLOkI8m9W9Htp8Jy0MkdF1R01cl02kVj tt7Y7TEQ3PAREbSYgjCjzDY4Y5gfuqKYHvNBqe47cpriOKyIIAZXcyXEObGncv4IOjb1 WO+Q== X-Gm-Message-State: AO0yUKWOtvhNM34ohqW1yLVHTo3f23A3ILQz2RadIxXfSejY7CzU65F4 MuBl15Lk0FwTOJjkKbHxxwcxGxx7Rp7iHg== X-Google-Smtp-Source: AK7set9CnY4fcEHClgder9w+/ULyLtXi3ML29cKe84lxUTfRfOKuxdGt1e97KZqBQBrErq+bM5knfA== X-Received: by 2002:a62:8387:0:b0:5a8:473e:2fdc with SMTP id h129-20020a628387000000b005a8473e2fdcmr3142893pfe.12.1677789327397; Thu, 02 Mar 2023 12:35:27 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:26 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Christian Brauner , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 10/11] attr: use consistent sgid stripping checks Date: Thu, 2 Mar 2023 12:35:03 -0800 Message-Id: <20230302203504.2998773-11-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Christian Brauner commit ed5a7047d2011cb6b2bf84ceb6680124cc6a7d95 upstream. [backport to 5.15.y, prior to vfsgid_t] Currently setgid stripping in file_remove_privs()'s should_remove_suid() helper is inconsistent with other parts of the vfs. Specifically, it only raises ATTR_KILL_SGID if the inode is S_ISGID and S_IXGRP but not if the inode isn't in the caller's groups and the caller isn't privileged over the inode although we require this already in setattr_prepare() and setattr_copy() and so all filesystem implement this requirement implicitly because they have to use setattr_{prepare,copy}() anyway. But the inconsistency shows up in setgid stripping bugs for overlayfs in xfstests (e.g., generic/673, generic/683, generic/685, generic/686, generic/687). For example, we test whether suid and setgid stripping works correctly when performing various write-like operations as an unprivileged user (fallocate, reflink, write, etc.): echo "Test 1 - qa_user, non-exec file $verb" setup_testfile chmod a+rws $junk_file commit_and_check "$qa_user" "$verb" 64k 64k The test basically creates a file with 6666 permissions. While the file has the S_ISUID and S_ISGID bits set it does not have the S_IXGRP set. On a regular filesystem like xfs what will happen is: sys_fallocate() -> vfs_fallocate() -> xfs_file_fallocate() -> file_modified() -> __file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = ATTR_FORCE | kill; -> notify_change() -> setattr_copy() In should_remove_suid() we can see that ATTR_KILL_SUID is raised unconditionally because the file in the test has S_ISUID set. But we also see that ATTR_KILL_SGID won't be set because while the file is S_ISGID it is not S_IXGRP (see above) which is a condition for ATTR_KILL_SGID being raised. So by the time we call notify_change() we have attr->ia_valid set to ATTR_KILL_SUID | ATTR_FORCE. Now notify_change() sees that ATTR_KILL_SUID is set and does: ia_valid = attr->ia_valid |= ATTR_MODE attr->ia_mode = (inode->i_mode & ~S_ISUID); which means that when we call setattr_copy() later we will definitely update inode->i_mode. Note that attr->ia_mode still contains S_ISGID. Now we call into the filesystem's ->setattr() inode operation which will end up calling setattr_copy(). Since ATTR_MODE is set we will hit: if (ia_valid & ATTR_MODE) { umode_t mode = attr->ia_mode; vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode); if (!vfsgid_in_group_p(vfsgid) && !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID)) mode &= ~S_ISGID; inode->i_mode = mode; } and since the caller in the test is neither capable nor in the group of the inode the S_ISGID bit is stripped. But assume the file isn't suid then ATTR_KILL_SUID won't be raised which has the consequence that neither the setgid nor the suid bits are stripped even though it should be stripped because the inode isn't in the caller's groups and the caller isn't privileged over the inode. If overlayfs is in the mix things become a bit more complicated and the bug shows up more clearly. When e.g., ovl_setattr() is hit from ovl_fallocate()'s call to file_remove_privs() then ATTR_KILL_SUID and ATTR_KILL_SGID might be raised but because the check in notify_change() is questioning the ATTR_KILL_SGID flag again by requiring S_IXGRP for it to be stripped the S_ISGID bit isn't removed even though it should be stripped: sys_fallocate() -> vfs_fallocate() -> ovl_fallocate() -> file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = ATTR_FORCE | kill; -> notify_change() -> ovl_setattr() // TAKE ON MOUNTER'S CREDS -> ovl_do_notify_change() -> notify_change() // GIVE UP MOUNTER'S CREDS // TAKE ON MOUNTER'S CREDS -> vfs_fallocate() -> xfs_file_fallocate() -> file_modified() -> __file_remove_privs() -> dentry_needs_remove_privs() -> should_remove_suid() -> __remove_privs() newattrs.ia_valid = attr_force | kill; -> notify_change() The fix for all of this is to make file_remove_privs()'s should_remove_suid() helper to perform the same checks as we already require in setattr_prepare() and setattr_copy() and have notify_change() not pointlessly requiring S_IXGRP again. It doesn't make any sense in the first place because the caller must calculate the flags via should_remove_suid() anyway which would raise ATTR_KILL_SGID. While we're at it we move should_remove_suid() from inode.c to attr.c where it belongs with the rest of the iattr helpers. Especially since it returns ATTR_KILL_S{G,U}ID flags. We also rename it to setattr_should_drop_suidgid() to better reflect that it indicates both setuid and setgid bit removal and also that it returns attr flags. Running xfstests with this doesn't report any regressions. We should really try and use consistent checks. Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- Documentation/trace/ftrace.rst | 2 +- fs/attr.c | 33 +++++++++++++++++++-------------- fs/fuse/file.c | 2 +- fs/inode.c | 7 ++++--- fs/internal.h | 2 +- fs/ocfs2/file.c | 4 ++-- fs/open.c | 8 ++++---- include/linux/fs.h | 2 +- 8 files changed, 33 insertions(+), 27 deletions(-) diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst index 4e5b26f03d5b..d036946bce7a 100644 --- a/Documentation/trace/ftrace.rst +++ b/Documentation/trace/ftrace.rst @@ -2929,7 +2929,7 @@ Produces:: bash-1994 [000] .... 4342.324898: ima_get_action <-process_measurement bash-1994 [000] .... 4342.324898: ima_match_policy <-ima_get_action bash-1994 [000] .... 4342.324899: do_truncate <-do_last - bash-1994 [000] .... 4342.324899: should_remove_suid <-do_truncate + bash-1994 [000] .... 4342.324899: setattr_should_drop_suidgid <-do_truncate bash-1994 [000] .... 4342.324899: notify_change <-do_truncate bash-1994 [000] .... 4342.324900: current_fs_time <-notify_change bash-1994 [000] .... 4342.324900: current_kernel_time <-current_fs_time diff --git a/fs/attr.c b/fs/attr.c index 965be68ed8fa..0ca14cbd4b8b 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -48,34 +48,39 @@ int setattr_should_drop_sgid(struct user_namespace *mnt_userns, return 0; } -/* - * The logic we want is +/** + * setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to + * be dropped + * @mnt_userns: user namespace of the mount @inode was found from + * @inode: inode to check * - * if suid or (sgid and xgrp) - * remove privs + * This function determines whether the set{g,u}id bits need to be removed. + * If the setuid bit needs to be removed ATTR_KILL_SUID is returned. If the + * setgid bit needs to be removed ATTR_KILL_SGID is returned. If both + * set{g,u}id bits need to be removed the corresponding mask of both flags is + * returned. + * + * Return: A mask of ATTR_KILL_S{G,U}ID indicating which - if any - setid bits + * to remove, 0 otherwise. */ -int should_remove_suid(struct dentry *dentry) +int setattr_should_drop_suidgid(struct user_namespace *mnt_userns, + struct inode *inode) { - umode_t mode = d_inode(dentry)->i_mode; + umode_t mode = inode->i_mode; int kill = 0; /* suid always must be killed */ if (unlikely(mode & S_ISUID)) kill = ATTR_KILL_SUID; - /* - * sgid without any exec bits is just a mandatory locking mark; leave - * it alone. If some exec bits are set, it's a real sgid; kill it. - */ - if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) - kill |= ATTR_KILL_SGID; + kill |= setattr_should_drop_sgid(mnt_userns, inode); if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode))) return kill; return 0; } -EXPORT_SYMBOL(should_remove_suid); +EXPORT_SYMBOL(setattr_should_drop_suidgid); /** * chown_ok - verify permissions to chown inode @@ -440,7 +445,7 @@ int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry, } } if (ia_valid & ATTR_KILL_SGID) { - if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { + if (mode & S_ISGID) { if (!(ia_valid & ATTR_MODE)) { ia_valid = attr->ia_valid |= ATTR_MODE; attr->ia_mode = inode->i_mode; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index cc95a1c37644..2b19d281351e 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -1295,7 +1295,7 @@ static ssize_t fuse_cache_write_iter(struct kiocb *iocb, struct iov_iter *from) return err; if (fc->handle_killpriv_v2 && - should_remove_suid(file_dentry(file))) { + setattr_should_drop_suidgid(&init_user_ns, file_inode(file))) { goto writethrough; } diff --git a/fs/inode.c b/fs/inode.c index 3811269259e1..079b64f9b756 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1869,7 +1869,8 @@ EXPORT_SYMBOL(touch_atime); * response to write or truncate. Return 0 if nothing has to be changed. * Negative value on error (change should be denied). */ -int dentry_needs_remove_privs(struct dentry *dentry) +int dentry_needs_remove_privs(struct user_namespace *mnt_userns, + struct dentry *dentry) { struct inode *inode = d_inode(dentry); int mask = 0; @@ -1878,7 +1879,7 @@ int dentry_needs_remove_privs(struct dentry *dentry) if (IS_NOSEC(inode)) return 0; - mask = should_remove_suid(dentry); + mask = setattr_should_drop_suidgid(mnt_userns, inode); ret = security_inode_need_killpriv(dentry); if (ret < 0) return ret; @@ -1920,7 +1921,7 @@ int file_remove_privs(struct file *file) if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode)) return 0; - kill = dentry_needs_remove_privs(dentry); + kill = dentry_needs_remove_privs(file_mnt_user_ns(file), dentry); if (kill < 0) return kill; if (kill) diff --git a/fs/internal.h b/fs/internal.h index 45cf31d7380b..46df4ce58e87 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -149,7 +149,7 @@ extern int vfs_open(const struct path *, struct file *); */ extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc); extern void inode_add_lru(struct inode *inode); -extern int dentry_needs_remove_privs(struct dentry *dentry); +int dentry_needs_remove_privs(struct user_namespace *, struct dentry *dentry); bool in_group_or_capable(struct user_namespace *mnt_userns, const struct inode *inode, kgid_t gid); diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index fc5f780fa235..92182d4be247 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1994,7 +1994,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, } } - if (file && should_remove_suid(file->f_path.dentry)) { + if (file && setattr_should_drop_suidgid(&init_user_ns, file_inode(file))) { ret = __ocfs2_write_remove_suid(inode, di_bh); if (ret) { mlog_errno(ret); @@ -2282,7 +2282,7 @@ static int ocfs2_prepare_inode_for_write(struct file *file, * inode. There's also the dinode i_size state which * can be lost via setattr during extending writes (we * set inode->i_size at the end of a write. */ - if (should_remove_suid(dentry)) { + if (setattr_should_drop_suidgid(&init_user_ns, inode)) { if (meta_level == 0) { ocfs2_inode_unlock_for_extent_tree(inode, &di_bh, diff --git a/fs/open.c b/fs/open.c index 5e322f188e83..e93c33069055 100644 --- a/fs/open.c +++ b/fs/open.c @@ -54,7 +54,7 @@ int do_truncate(struct user_namespace *mnt_userns, struct dentry *dentry, } /* Remove suid, sgid, and file capabilities on truncate too */ - ret = dentry_needs_remove_privs(dentry); + ret = dentry_needs_remove_privs(mnt_userns, dentry); if (ret < 0) return ret; if (ret) @@ -671,10 +671,10 @@ int chown_common(const struct path *path, uid_t user, gid_t group) newattrs.ia_valid |= ATTR_GID; newattrs.ia_gid = gid; } - if (!S_ISDIR(inode->i_mode)) - newattrs.ia_valid |= - ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV; inode_lock(inode); + if (!S_ISDIR(inode->i_mode)) + newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV | + setattr_should_drop_sgid(mnt_userns, inode); error = security_path_chown(path, uid, gid); if (!error) error = notify_change(mnt_userns, path->dentry, &newattrs, diff --git a/include/linux/fs.h b/include/linux/fs.h index be9be4a7216c..9601c2d774c8 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3133,7 +3133,7 @@ extern void __destroy_inode(struct inode *); extern struct inode *new_inode_pseudo(struct super_block *sb); extern struct inode *new_inode(struct super_block *sb); extern void free_inode_nonrcu(struct inode *inode); -extern int should_remove_suid(struct dentry *); +extern int setattr_should_drop_suidgid(struct user_namespace *, struct inode *); extern int file_remove_privs(struct file *); extern void __insert_inode_hash(struct inode *, unsigned long hashval); From patchwork Thu Mar 2 20:35:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13157861 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD67AC6FA8E for ; Thu, 2 Mar 2023 20:35:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229968AbjCBUfc (ORCPT ); Thu, 2 Mar 2023 15:35:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230005AbjCBUf3 (ORCPT ); Thu, 2 Mar 2023 15:35:29 -0500 Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D53873866E for ; Thu, 2 Mar 2023 12:35:28 -0800 (PST) Received: by mail-pj1-x102f.google.com with SMTP id cp7-20020a17090afb8700b0023756229427so4038259pjb.1 for ; Thu, 02 Mar 2023 12:35:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1677789328; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=BbfeXg3QbNcNSiHK4OP8vmntjHDkmbVWGqEY3WGb1vQ=; b=Eo8fmmJJlyVplNBHY0i4ZTDLtLLYPJQYeD9moZOIlxOY2rYUAieCp2k55tseRsS7vE ilcAeloHBGMj2Rv9Xi+PdCjk9oyJp40if8JiqhbMLrqCx7tki3+DUkQYz5/U27x/2K6k tTmDjLr5vQalNeQag9D+5pPvXLq4fx33ixf805oWL3d9Y0zfBohZPDa+QGebteibYS9R v0xfjzSe2FEIH3vzvNaGSAyhINVErJ8ogzoJ11yHCnRKQa+8dSMK4AIREJzqSY22fBSG K2npDVW2//bDrxssAKcx688mQHH0pF+pZPb52az0i0otxdvqDqF0MedJ1/eF5KHfl+OE qPmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677789328; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BbfeXg3QbNcNSiHK4OP8vmntjHDkmbVWGqEY3WGb1vQ=; b=xAcJZ6BDCYv362s6N+UiayfFlGIgLbWQ5U72DD2D0ZtfB6rJAcRFDqOriHcjtD5gAX ezb3dP2LzgwBqehQ+NSmmaH/dS8ETFt2eb9TJoGqz4MAxnvQjXad6a+gQOW27uNIyiC3 6Rt1Mnb0eiCDJindoQhr+MjELG5/bV/qYroiSSdVI7ePRFxQ5bHHy6RQG2XpMf7GJtnD H8szO3UDwdkqX7baIhShOTC8EVs0iE/NBdbiwj9A3fbpX6RqApNa5oBl818g97Gdvc07 cIWAUhRuyxTF3wF3XrM+iVgdQ2OSbJDrwSGAeUGmr4J9ooe1TVtMbyKBYRPLht9C+02S KjAQ== X-Gm-Message-State: AO0yUKU60vGvxQY7HYj+STrHs1KDe7/0gtVmJKDr5mlWTvFBDUsyVWsQ +q8JX2Odt3wfgLtFaO8xirvM+3uKN5BsCA== X-Google-Smtp-Source: AK7set8DN4Pf8gnZqX/2L+rla5NeoOirPwLFIylLx6Jm37YfZnRXFGVWvBqIACRgbuk+eIqtuOPKGQ== X-Received: by 2002:a05:6a21:338f:b0:cc:d891:b2ad with SMTP id yy15-20020a056a21338f00b000ccd891b2admr12726101pzb.20.1677789328317; Thu, 02 Mar 2023 12:35:28 -0800 (PST) Received: from lrumancik.svl.corp.google.com ([2620:15c:2d4:203:637a:4159:6b3f:42eb]) by smtp.gmail.com with ESMTPSA id b13-20020aa7870d000000b005ac86f7b87fsm113459pfo.77.2023.03.02.12.35.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Mar 2023 12:35:28 -0800 (PST) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, Christian Brauner , Miklos Szeredi , Leah Rumancik Subject: [PATCH 5.15 CANDIDATE 11/11] fs: use consistent setgid checks in is_sxid() Date: Thu, 2 Mar 2023 12:35:04 -0800 Message-Id: <20230302203504.2998773-12-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog In-Reply-To: <20230302203504.2998773-1-leah.rumancik@gmail.com> References: <20230302203504.2998773-1-leah.rumancik@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org From: Christian Brauner commit 8d84e39d76bd83474b26cb44f4b338635676e7e8 upstream. Now that we made the VFS setgid checking consistent an inode can't be marked security irrelevant even if the setgid bit is still set. Make this function consistent with all other helpers. Note that enforcing consistent setgid stripping checks for file modification and mode- and ownership changes will cause the setgid bit to be lost in more cases than useed to be the case. If an unprivileged user wrote to a non-executable setgid file that they don't have privilege over the setgid bit will be dropped. This will lead to temporary failures in some xfstests until they have been updated. Reported-by: Miklos Szeredi Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Amir Goldstein Tested-by: Leah Rumancik --- include/linux/fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/fs.h b/include/linux/fs.h index 9601c2d774c8..23ecfecdc450 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3571,7 +3571,7 @@ int __init list_bdev_fs_names(char *buf, size_t size); static inline bool is_sxid(umode_t mode) { - return (mode & S_ISUID) || ((mode & S_ISGID) && (mode & S_IXGRP)); + return mode & (S_ISUID | S_ISGID); } static inline int check_sticky(struct user_namespace *mnt_userns,