diff options
| author | Gu Zheng <guzheng1@huawei.com> | 2017-01-09 09:34:48 +0800 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2017-01-27 17:15:02 +0100 |
| commit | b0369e53c851f8cd87afd059d360a4f646840c8c (patch) | |
| tree | b71aa2505f3e6bc6e3e7a4a26fa5b49afcca43ac | |
| parent | ded56d6d88168cb8cb46a50456929fb5f8aae600 (diff) | |
tmpfs: clear S_ISGID when setting posix ACLs
commit 497de07d89c1410d76a15bec2bb41f24a2a89f31 upstream.
This change was missed the tmpfs modification in In CVE-2016-7097
commit 073931017b49 ("posix_acl: Clear SGID bit when setting
file permissions")
It can test by xfstest generic/375, which failed to clear
setgid bit in the following test case on tmpfs:
touch $testfile
chown 100:100 $testfile
chmod 2755 $testfile
_runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile
Signed-off-by: Gu Zheng <guzheng1@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
| -rw-r--r-- | fs/generic_acl.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/fs/generic_acl.c b/fs/generic_acl.c index b3f3676796d3..7855cfb938f6 100644 --- a/fs/generic_acl.c +++ b/fs/generic_acl.c @@ -82,19 +82,21 @@ generic_acl_set(struct dentry *dentry, const char *name, const void *value, return PTR_ERR(acl); } if (acl) { + struct posix_acl *old_acl; + error = posix_acl_valid(acl); if (error) goto failed; switch (type) { case ACL_TYPE_ACCESS: - error = posix_acl_equiv_mode(acl, &inode->i_mode); + old_acl = acl; + error = posix_acl_update_mode(inode, &inode->i_mode, + &acl); if (error < 0) goto failed; + if (!acl) + posix_acl_release(old_acl); inode->i_ctime = CURRENT_TIME; - if (error == 0) { - posix_acl_release(acl); - acl = NULL; - } break; case ACL_TYPE_DEFAULT: if (!S_ISDIR(inode->i_mode)) { |