forked from Minki/linux
073931017b
When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
161 lines
3.6 KiB
C
161 lines
3.6 KiB
C
/*
|
|
* Copyright (C) 2007 Red Hat. All rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public
|
|
* License v2 as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public
|
|
* License along with this program; if not, write to the
|
|
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
|
|
* Boston, MA 021110-1307, USA.
|
|
*/
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/string.h>
|
|
#include <linux/xattr.h>
|
|
#include <linux/posix_acl_xattr.h>
|
|
#include <linux/posix_acl.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/slab.h>
|
|
|
|
#include "ctree.h"
|
|
#include "btrfs_inode.h"
|
|
#include "xattr.h"
|
|
|
|
struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
|
|
{
|
|
int size;
|
|
const char *name;
|
|
char *value = NULL;
|
|
struct posix_acl *acl;
|
|
|
|
switch (type) {
|
|
case ACL_TYPE_ACCESS:
|
|
name = XATTR_NAME_POSIX_ACL_ACCESS;
|
|
break;
|
|
case ACL_TYPE_DEFAULT:
|
|
name = XATTR_NAME_POSIX_ACL_DEFAULT;
|
|
break;
|
|
default:
|
|
BUG();
|
|
}
|
|
|
|
size = __btrfs_getxattr(inode, name, "", 0);
|
|
if (size > 0) {
|
|
value = kzalloc(size, GFP_KERNEL);
|
|
if (!value)
|
|
return ERR_PTR(-ENOMEM);
|
|
size = __btrfs_getxattr(inode, name, value, size);
|
|
}
|
|
if (size > 0) {
|
|
acl = posix_acl_from_xattr(&init_user_ns, value, size);
|
|
} else if (size == -ERANGE || size == -ENODATA || size == 0) {
|
|
acl = NULL;
|
|
} else {
|
|
acl = ERR_PTR(-EIO);
|
|
}
|
|
kfree(value);
|
|
|
|
return acl;
|
|
}
|
|
|
|
/*
|
|
* Needs to be called with fs_mutex held
|
|
*/
|
|
static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
|
|
struct inode *inode, struct posix_acl *acl, int type)
|
|
{
|
|
int ret, size = 0;
|
|
const char *name;
|
|
char *value = NULL;
|
|
|
|
switch (type) {
|
|
case ACL_TYPE_ACCESS:
|
|
name = XATTR_NAME_POSIX_ACL_ACCESS;
|
|
if (acl) {
|
|
ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
|
|
if (ret)
|
|
return ret;
|
|
}
|
|
ret = 0;
|
|
break;
|
|
case ACL_TYPE_DEFAULT:
|
|
if (!S_ISDIR(inode->i_mode))
|
|
return acl ? -EINVAL : 0;
|
|
name = XATTR_NAME_POSIX_ACL_DEFAULT;
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (acl) {
|
|
size = posix_acl_xattr_size(acl->a_count);
|
|
value = kmalloc(size, GFP_KERNEL);
|
|
if (!value) {
|
|
ret = -ENOMEM;
|
|
goto out;
|
|
}
|
|
|
|
ret = posix_acl_to_xattr(&init_user_ns, acl, value, size);
|
|
if (ret < 0)
|
|
goto out;
|
|
}
|
|
|
|
ret = __btrfs_setxattr(trans, inode, name, value, size, 0);
|
|
out:
|
|
kfree(value);
|
|
|
|
if (!ret)
|
|
set_cached_acl(inode, type, acl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
|
|
{
|
|
return __btrfs_set_acl(NULL, inode, acl, type);
|
|
}
|
|
|
|
/*
|
|
* btrfs_init_acl is already generally called under fs_mutex, so the locking
|
|
* stuff has been fixed to work with that. If the locking stuff changes, we
|
|
* need to re-evaluate the acl locking stuff.
|
|
*/
|
|
int btrfs_init_acl(struct btrfs_trans_handle *trans,
|
|
struct inode *inode, struct inode *dir)
|
|
{
|
|
struct posix_acl *default_acl, *acl;
|
|
int ret = 0;
|
|
|
|
/* this happens with subvols */
|
|
if (!dir)
|
|
return 0;
|
|
|
|
ret = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (default_acl) {
|
|
ret = __btrfs_set_acl(trans, inode, default_acl,
|
|
ACL_TYPE_DEFAULT);
|
|
posix_acl_release(default_acl);
|
|
}
|
|
|
|
if (acl) {
|
|
if (!ret)
|
|
ret = __btrfs_set_acl(trans, inode, acl,
|
|
ACL_TYPE_ACCESS);
|
|
posix_acl_release(acl);
|
|
}
|
|
|
|
if (!default_acl && !acl)
|
|
cache_no_acl(inode);
|
|
return ret;
|
|
}
|