From patchwork Fri Oct 28 12:54:57 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miklos Szeredi X-Patchwork-Id: 9401935 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 60CE060231 for ; Fri, 28 Oct 2016 12:55:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 524BB2A7F3 for ; Fri, 28 Oct 2016 12:55:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 46D952A7F8; Fri, 28 Oct 2016 12:55:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2C6C72A7F3 for ; Fri, 28 Oct 2016 12:55:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760699AbcJ1MzK (ORCPT ); Fri, 28 Oct 2016 08:55:10 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:34198 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756597AbcJ1MzJ (ORCPT ); Fri, 28 Oct 2016 08:55:09 -0400 Received: by mail-wm0-f66.google.com with SMTP id p190so1066397wmp.1 for ; Fri, 28 Oct 2016 05:55:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=szeredi.hu; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=pryKWQl9CMW6xeIdTRbrS3zqrq8pX4HWRLbS5stO13U=; b=GNMjJzsoThSUE8VRd7qL6CaWG8nGKjujxj2UoZvTO5LJX0EGCgDU3AsUftVSfB85L0 blU+QxryypsozPCsr8a4Ue+kg+Z8bcNgErevCRbfdeq2VMcfC48+hhnWUmHUxvYAqh9y /1MNq+4edHaO2yNmduLjPJxpFV+O5Ijsxn1Hs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=pryKWQl9CMW6xeIdTRbrS3zqrq8pX4HWRLbS5stO13U=; b=XvwCXWmOslKoopJJ0IGmfVUtS+VVTd1HWvSKeTUPeajo9CosXnO590+Ts3j/mJgJDp Em/rbcQ6Ay3v6pF5/Y5Z933PWWhBC/EGTCT6bkyArgumcc1xCfTvtXiK71xuhurCHOCx 5JsuJm5s6HnFfN4gG+eH4wZ8kjkOHMMkKF//csARXwc+TRgz4doh32A70U1jWlJo4dHz y+3ew/wsj3tAAYZEAnbKL/7xtHNOSNAnhGSxpGrBS7OSK6eBVuY3zQmd2lNbbyKvt6kP npihmFwI8wqX+ecYCgUrEJifkL/XmM2l/ZhKU6nPTr98mBNUi95o+OobdPKujzu9vH+n Ue6g== X-Gm-Message-State: ABUngveqUXkl+5M1rkd1xZ+I4J70W8cFTi/EQCfIsD+Bsu4PXYEB8bi1lXf7E9U3yINfEA== X-Received: by 10.194.43.73 with SMTP id u9mr1513823wjl.109.1477659307598; Fri, 28 Oct 2016 05:55:07 -0700 (PDT) Received: from veci.piliscsaba.szeredi.hu (pool-dsl-2c-0018.externet.hu. [217.173.44.24]) by smtp.gmail.com with ESMTPSA id jb2sm14004695wjb.44.2016.10.28.05.55.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Oct 2016 05:55:06 -0700 (PDT) Date: Fri, 28 Oct 2016 14:54:57 +0200 From: Miklos Szeredi To: Amir Goldstein Cc: Vivek Goyal , Andreas Gruenbacher , linux-unionfs@vger.kernel.org, linux-fsdevel Subject: Re: [PATCH v2] ovl: update S_ISGID when setting posix ACLs Message-ID: <20161028125457.GA8412@veci.piliscsaba.szeredi.hu> References: <1477501840-25066-1-git-send-email-amir73il@gmail.com> <1477506616-14061-1-git-send-email-amir73il@gmail.com> <20161027223742.GC4819@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.1 (2016-10-04) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Fri, Oct 28, 2016 at 07:47:12AM +0300, Amir Goldstein wrote: > On Fri, Oct 28, 2016 at 1:37 AM, Vivek Goyal wrote: > > On Wed, Oct 26, 2016 at 09:30:16PM +0300, Amir Goldstein wrote: > >> Since operations on upper are performed using mounter's credentials, > >> we need to call posix_acl_update_mode() with current credentials on > >> overlay inode to possibly copy-up and clear setgid bit, before setting > >> posix ACLs on upper inode. > >> > >> Also wrap posix acl handlers with #ifdef CONFIG_FS_POSIX_ACL to > >> avoid compiler warning for implicit declaration of function > >> 'posix_acl_update_mode' on build without that config option. > >> > >> This change fixes xfstest generic/375, which failed to clear the > >> setgid bit in the following test case over overlayfs: > >> > >> touch $testfile > >> chown 100:100 $testfile > >> chmod 2755 $testfile > >> _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile Instead of calculating and setting the equivalent mode in overlayfs code (as well as in the upper layer later), how about just clearing the sgid bit when necessary? Untested patch follows. Thanks, Miklos --- fs/overlayfs/super.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -562,6 +562,21 @@ ovl_posix_acl_xattr_set(const struct xat posix_acl_release(acl); + /* + * Check if sgid bit needs to be cleared (actual setacl operation will + * be done with mounter's capabilities and so that won't do it for us). + */ + if (unlikely(inode->i_mode & S_ISGID) && + handler->flags == ACL_TYPE_ACCESS && + !in_group_p(inode->i_gid) && + !capable_wrt_inode_uidgid(inode, CAP_FSETID)) { + struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; + + err = ovl_setattr(dentry, &iattr); + if (err) + return err; + } + err = ovl_xattr_set(dentry, handler->name, value, size, flags); if (!err) ovl_copyattr(ovl_inode_real(inode, NULL), inode);