Jan Kara
073931017b
posix_acl: Clear SGID bit when setting file permissions
...
When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2). Fix that.
References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de >
Reviewed-by: Jeff Layton <jlayton@redhat.com >
Signed-off-by: Jan Kara <jack@suse.cz >
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com >
2016-09-22 10:55:32 +02:00
..
2016-07-25 11:09:19 -07:00
2016-07-28 15:32:53 +02:00
2016-08-02 16:11:27 -04:00
2016-07-28 09:34:47 +05:30
2016-08-06 00:01:33 -04:00
2016-08-04 20:10:31 -04:00
2016-08-04 20:10:31 -04:00
2016-07-25 10:34:47 +02:00
2016-08-05 09:48:22 -04:00
2016-07-25 11:47:52 +01:00
2016-08-04 19:59:06 -04:00
2016-07-31 02:25:02 -07:00
2016-08-04 14:19:16 -06:00
2016-08-04 14:19:16 -06:00
2016-07-26 16:19:19 -07:00
2016-07-25 16:51:49 +10:00
2016-08-07 14:41:02 -06:00
2016-08-04 08:50:07 -04:00
2016-08-07 14:41:02 -06:00
2016-08-07 14:41:02 -06:00
2016-08-07 14:41:02 -06:00
2016-07-25 10:34:11 -07:00
2016-07-26 15:03:07 -07:00
2016-08-02 17:31:41 -04:00
2016-07-30 11:20:02 -07:00
2016-07-28 16:07:41 -07:00
2016-07-28 17:38:16 -07:00
2016-08-02 16:11:27 -04:00
2016-07-28 18:56:22 +02:00
2016-08-02 19:35:24 -04:00
2016-07-26 16:19:19 -07:00
2016-08-07 10:01:14 -04:00
2016-07-26 16:19:19 -07:00
2016-07-28 17:38:16 -07:00
2016-08-04 08:50:07 -04:00
2016-08-04 08:50:07 -04:00
2016-08-04 08:50:07 -04:00
2016-08-01 18:55:31 -04:00
2016-08-04 10:16:56 +09:30
2016-08-04 08:50:07 -04:00
2016-08-02 19:35:10 -04:00
2016-07-26 16:19:19 -07:00
2016-08-07 14:41:02 -06:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-07-27 14:20:09 -07:00
2016-08-02 17:31:41 -04:00
2016-08-02 19:35:44 -04:00
2016-07-27 10:24:38 -05:00
2016-08-04 08:50:07 -04:00
2016-08-02 17:31:41 -04:00
2016-07-28 16:07:41 -07:00
2016-08-02 19:35:03 -04:00
2016-08-02 19:35:30 -04:00
2016-07-26 16:19:19 -07:00
2016-07-26 16:19:19 -07:00
2016-08-04 13:59:56 +02:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-07-26 16:19:19 -07:00
2016-07-28 16:07:41 -07:00
2016-07-26 16:19:19 -07:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-08-02 19:35:02 -04:00
2016-07-26 16:19:19 -07:00
2016-08-08 14:48:14 -07:00
2016-08-04 10:16:55 +09:30
2016-07-29 12:17:52 -07:00
2016-08-06 09:49:02 -04:00
2016-07-31 02:25:02 -07:00
2016-07-28 16:07:41 -07:00
2016-07-26 16:19:19 -07:00
2016-07-26 16:19:19 -07:00
2016-07-26 16:19:19 -07:00
2016-08-07 14:41:02 -06:00
2016-08-02 17:12:29 -04:00
2016-07-29 13:55:30 -07:00
2016-09-22 10:55:32 +02:00
2016-08-02 19:35:06 -04:00
2016-07-25 16:23:39 +02:00
2016-07-29 15:54:19 -07:00
2016-08-02 19:35:08 -04:00
2016-08-02 19:35:06 -04:00
2016-07-27 12:03:20 -07:00
2016-08-02 19:35:38 -04:00
2016-08-02 19:35:37 -04:00
2016-08-02 19:35:37 -04:00
2016-07-26 16:19:19 -07:00
2016-08-02 19:35:23 -04:00
2016-07-27 14:20:09 -07:00
2016-07-26 16:19:19 -07:00
2016-07-28 16:07:41 -07:00
2016-08-08 14:48:14 -07:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-08-04 08:50:07 -04:00
2016-08-02 17:31:41 -04:00
2016-08-08 14:48:14 -07:00
2016-07-28 16:07:41 -07:00
2016-08-08 13:02:01 -07:00
2016-07-26 16:19:19 -07:00
2016-08-01 21:44:52 +03:00
2016-08-02 02:57:29 +03:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-07-28 16:07:41 -07:00
2016-08-04 08:50:07 -04:00