[5.10,14/15] fs: use consistent setgid checks in is_sxid()

Message ID	20230318101529.1361673-15-amir73il@gmail.com (mailing list archive)
State	Deferred, archived
Headers	show Return-Path: <linux-xfs-owner@vger.kernel.org> From: Amir Goldstein <amir73il@gmail.com> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Sasha Levin <sashal@kernel.org>, "Darrick J . Wong" <djwong@kernel.org>, Leah Rumancik <leah.rumancik@gmail.com>, Chandan Babu R <chandan.babu@oracle.com>, Christian Brauner <brauner@kernel.org>, linux-fsdevel@vger.kernel.org, linux-xfs@vger.kernel.org, stable@vger.kernel.org, Miklos Szeredi <miklos@szeredi.hu> Subject: [PATCH 5.10 14/15] fs: use consistent setgid checks in is_sxid() Date: Sat, 18 Mar 2023 12:15:28 +0200 Message-Id: <20230318101529.1361673-15-amir73il@gmail.com> In-Reply-To: <20230318101529.1361673-1-amir73il@gmail.com> References: <20230318101529.1361673-1-amir73il@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	xfs backports for 5.10.y (from v5.15.103) \| expand [5.10,00/15] xfs backports for 5.10.y (from v5.15.103) [5.10,01/15] xfs: don't assert fail on perag references on teardown [5.10,02/15] xfs: purge dquots after inode walk fails during quotacheck [5.10,03/15] xfs: don't leak btree cursor when insrec fails after a split [5.10,04/15] xfs: remove XFS_PREALLOC_SYNC [5.10,05/15] xfs: fallocate() should call file_modified() [5.10,06/15] xfs: set prealloc flag in xfs_alloc_file_space() [5.10,07/15] xfs: use setattr_copy to set vfs inode attributes [5.10,08/15] fs: add mode_strip_sgid() helper [5.10,09/15] fs: move S_ISGID stripping into the vfs_*() helpers [5.10,10/15] attr: add in_group_or_capable() [5.10,11/15] fs: move should_remove_suid() [5.10,12/15] attr: add setattr_should_drop_sgid() [5.10,13/15] attr: use consistent sgid stripping checks [5.10,14/15] fs: use consistent setgid checks in is_sxid() [5.10,15/15] xfs: remove xfs_setattr_time() declaration

Message ID

20230318101529.1361673-15-amir73il@gmail.com (mailing list archive)

State

Deferred, archived

Headers

From: Amir Goldstein <amir73il@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Sasha Levin <sashal@kernel.org>,
        "Darrick J . Wong" <djwong@kernel.org>,
        Leah Rumancik <leah.rumancik@gmail.com>,
        Chandan Babu R <chandan.babu@oracle.com>,
        Christian Brauner <brauner@kernel.org>,
        linux-fsdevel@vger.kernel.org, linux-xfs@vger.kernel.org,
        stable@vger.kernel.org, Miklos Szeredi <miklos@szeredi.hu>
Subject: [PATCH 5.10 14/15] fs: use consistent setgid checks in is_sxid()
Date: Sat, 18 Mar 2023 12:15:28 +0200
Message-Id: <20230318101529.1361673-15-amir73il@gmail.com>
In-Reply-To: <20230318101529.1361673-1-amir73il@gmail.com>
References: <20230318101529.1361673-1-amir73il@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

xfs backports for 5.10.y (from v5.15.103) | expand

Commit Message

Amir Goldstein March 18, 2023, 10:15 a.m. UTC

From: Christian Brauner <brauner@kernel.org>

commit 8d84e39d76bd83474b26cb44f4b338635676e7e8 upstream.

Now that we made the VFS setgid checking consistent an inode can't be
marked security irrelevant even if the setgid bit is still set. Make
this function consistent with all other helpers.

Note that enforcing consistent setgid stripping checks for file
modification and mode- and ownership changes will cause the setgid bit
to be lost in more cases than useed to be the case. If an unprivileged
user wrote to a non-executable setgid file that they don't have
privilege over the setgid bit will be dropped. This will lead to
temporary failures in some xfstests until they have been updated.

Reported-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 include/linux/fs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 57afa4fa5e7b..8ce9e5c61ede 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -3408,7 +3408,7 @@  int __init get_filesystem_list(char *buf);
 
 static inline bool is_sxid(umode_t mode)
 {
-	return (mode & S_ISUID) || ((mode & S_ISGID) && (mode & S_IXGRP));
+	return mode & (S_ISUID | S_ISGID);
 }
 
 static inline int check_sticky(struct inode *dir, struct inode *inode)

[5.10,14/15] fs: use consistent setgid checks in is_sxid()

Commit Message

Patch