From patchwork Thu Jan 3 21:42:29 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Weston Andros Adamson X-Patchwork-Id: 1929531 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id E253CDF25A for ; Thu, 3 Jan 2013 21:42:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754230Ab3ACVmb (ORCPT ); Thu, 3 Jan 2013 16:42:31 -0500 Received: from mx12.netapp.com ([216.240.18.77]:17637 "EHLO mx12.netapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753643Ab3ACVmb (ORCPT ); Thu, 3 Jan 2013 16:42:31 -0500 X-IronPort-AV: E=Sophos;i="4.84,405,1355126400"; d="scan'208";a="4550126" Received: from smtp1.corp.netapp.com ([10.57.156.124]) by mx12-out.netapp.com with ESMTP; 03 Jan 2013 13:42:31 -0800 Received: from vpn2ntap-610999.vpn.netapp.com (vpn2ntap-610999.vpn.netapp.com [10.55.64.236]) by smtp1.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id r03LgUsC021080; Thu, 3 Jan 2013 13:42:30 -0800 (PST) From: Weston Andros Adamson To: Trond.Myklebust@netapp.com Cc: linux-nfs@vger.kernel.org, Weston Andros Adamson Subject: [PATCH] NFS: Fix access to suid/sgid executables Date: Thu, 3 Jan 2013 16:42:29 -0500 Message-Id: <1357249349-12074-1-git-send-email-dros@netapp.com> X-Mailer: git-send-email 1.7.9.6 (Apple Git-31.1) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org nfs_open_permission_mask() should only check MAY_EXEC for files that are opened with __FMODE_EXEC. Also fix NFSv4 access-in-open path in a similar way -- openflags must be used because fmode will not always have FMODE_EXEC set. Signed-off-by: Weston Andros Adamson --- This patch fixes https://bugzilla.kernel.org/show_bug.cgi?id=49101 Patch v2 - apply Trond's comment: only check MAY_EXEC when openflags has __FMODE_EXEC. fs/nfs/dir.c | 16 ++++++++++------ fs/nfs/nfs4proc.c | 18 ++++++++++++------ 2 files changed, 22 insertions(+), 12 deletions(-) diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index 32e6c53..1b2d7eb 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -2153,12 +2153,16 @@ static int nfs_open_permission_mask(int openflags) { int mask = 0; - if ((openflags & O_ACCMODE) != O_WRONLY) - mask |= MAY_READ; - if ((openflags & O_ACCMODE) != O_RDONLY) - mask |= MAY_WRITE; - if (openflags & __FMODE_EXEC) - mask |= MAY_EXEC; + if (openflags & __FMODE_EXEC) { + /* ONLY check exec rights */ + mask = MAY_EXEC; + } else { + if ((openflags & O_ACCMODE) != O_WRONLY) + mask |= MAY_READ; + if ((openflags & O_ACCMODE) != O_RDONLY) + mask |= MAY_WRITE; + } + return mask; } diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 5d864fb..3b70588 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -1626,7 +1626,8 @@ static int _nfs4_recover_proc_open(struct nfs4_opendata *data) static int nfs4_opendata_access(struct rpc_cred *cred, struct nfs4_opendata *opendata, - struct nfs4_state *state, fmode_t fmode) + struct nfs4_state *state, fmode_t fmode, + int openflags) { struct nfs_access_entry cache; u32 mask; @@ -1637,12 +1638,17 @@ static int nfs4_opendata_access(struct rpc_cred *cred, return 0; mask = 0; + + /* use openflags to check for exec, because fmode won't + * always have FMODE_EXEC set when file open for exec. */ + if (openflags & __FMODE_EXEC) + /* ONLY check for exec rights */ + mask = MAY_EXEC; + /* don't check MAY_WRITE - a newly created file may not have * write mode bits, but POSIX allows the creating process to write */ - if (fmode & FMODE_READ) - mask |= MAY_READ; - if (fmode & FMODE_EXEC) - mask |= MAY_EXEC; + else if (fmode & FMODE_READ) + mask = MAY_READ; cache.cred = cred; cache.jiffies = jiffies; @@ -1896,7 +1902,7 @@ static int _nfs4_do_open(struct inode *dir, if (server->caps & NFS_CAP_POSIX_LOCK) set_bit(NFS_STATE_POSIX_LOCKS, &state->flags); - status = nfs4_opendata_access(cred, opendata, state, fmode); + status = nfs4_opendata_access(cred, opendata, state, fmode, flags); if (status != 0) goto err_opendata_put;