Jan Kara 57c9cfdb61 posix_acl: Clear SGID bit when setting file permissions ...

commit 073931017b49d9458aa351605b43a7e34598caef upstream.

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-10-31 04:13:58 -06:00

..

acl.c

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

addr.c

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

cache.c

ceph: fix a comment typo

2015-11-02 23:36:47 +01:00

cache.h

ceph: fscache: add an interface to synchronize object store limit

2014-04-03 10:33:53 +08:00

caps.c

ceph: make fsync() wait unsafe requests that created/modified inode

2015-11-02 23:36:48 +01:00

ceph_frag.c

…

debugfs.c

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00

dir.c

ceph: rework dcache readdir

2015-06-25 11:49:32 +03:00

export.c

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00

file.c

ceph: fix error handling in ceph_read_iter

2016-10-28 03:01:35 -04:00

inode.c

ceph: fix race during filling readdir cache

2016-10-07 15:23:42 +02:00

ioctl.c

ceph: fix divide-by-zero in __validate_layout()

2014-10-14 12:57:05 -07:00

ioctl.h

ceph: fully initialize new layout

2012-05-16 14:28:27 -05:00

Kconfig

ceph: add acl for cephfs

2013-12-31 20:32:01 +02:00

locks.c

Move locks API users to locks_lock_inode_wait()

2015-10-22 14:57:36 -04:00

Makefile

ceph: add acl for cephfs

2013-12-31 20:32:01 +02:00

mds_client.c

libceph: msg signing callouts don't need con argument

2015-11-02 23:37:45 +01:00

mds_client.h

ceph: make fsync() wait unsafe requests that created/modified inode

2015-11-02 23:36:48 +01:00

mdsmap.c

fs/ceph: replace pr_warning by pr_warn

2014-06-06 16:08:06 -07:00

snap.c

ceph: fix queuing inode to mdsdir's snaprealm

2015-09-08 23:14:29 +03:00

strings.c

ceph: rename snapshot support

2015-04-22 18:33:41 +03:00

super.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

2015-09-11 12:33:03 -07:00

super.h

ceph: make fsync() wait unsafe requests that created/modified inode

2015-11-02 23:36:48 +01:00

xattr.c

ceph: pre-allocate data structure that tracks caps flushing

2015-06-25 11:49:31 +03:00