From patchwork Tue Mar 3 10:38:35 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kara X-Patchwork-Id: 5921111 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id A063C9F380 for ; Tue, 3 Mar 2015 10:38:55 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D7F4A202BE for ; Tue, 3 Mar 2015 10:38:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 06EA0202B8 for ; Tue, 3 Mar 2015 10:38:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756209AbbCCKiw (ORCPT ); Tue, 3 Mar 2015 05:38:52 -0500 Received: from cantor2.suse.de ([195.135.220.15]:58877 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755855AbbCCKis (ORCPT ); Tue, 3 Mar 2015 05:38:48 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 6F979AEAC; Tue, 3 Mar 2015 10:38:46 +0000 (UTC) Received: by quack.suse.cz (Postfix, from userid 1000) id 1048C82754; Tue, 3 Mar 2015 11:38:43 +0100 (CET) From: Jan Kara To: Al Viro Cc: linux-fsdevel@vger.kernel.org, xfs@oss.sgi.com, Jan Kara , stable@vger.kernel.org Subject: [PATCH 1/5] fs: Fix S_NOSEC handling Date: Tue, 3 Mar 2015 11:38:35 +0100 Message-Id: <1425379119-3773-2-git-send-email-jack@suse.cz> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1425379119-3773-1-git-send-email-jack@suse.cz> References: <1425379119-3773-1-git-send-email-jack@suse.cz> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP file_remove_suid() could mistakenly set S_NOSEC inode bit when root was modifying the file. As a result following writes to the file by ordinary user would avoid clearing suid or sgid bits. Fix the bug by checking actual mode bits before setting S_NOSEC. CC: stable@vger.kernel.org Signed-off-by: Jan Kara --- fs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/inode.c b/fs/inode.c index f00b16f45507..be326ae7f880 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1693,7 +1693,8 @@ int file_remove_suid(struct file *file) error = security_inode_killpriv(dentry); if (!error && killsuid) error = __remove_suid(dentry, killsuid); - if (!error && (inode->i_sb->s_flags & MS_NOSEC)) + if (!error && (inode->i_sb->s_flags & MS_NOSEC) && + !is_sxid(inode->i_mode)) inode->i_flags |= S_NOSEC; return error;