iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduce is_owner_or_cap() to wrap CAP_FOWNER use with fsuid check

Browse Source 
Introduce is_owner_or_cap() macro in fs.h, and convert over relevant
users to it. This is done because we want to avoid bugs in the future
where we check for only effective fsuid of the current task against a
file's owning uid, without simultaneously checking for CAP_FOWNER as
well, thus violating its semantics.
[ XFS uses special macros and structures, and in general looked ...
untouchable, so we leave it alone -- but it has been looked over. ]

The (current->fsuid != inode->i_uid) check in generic_permission() and
exec_permission_lite() is left alone, because those operations are
covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH. Similarly operations
falling under the purview of CAP_CHOWN and CAP_LEASE are also left alone.

Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Cc: Al Viro <viro@ftp.linux.org.uk>
Acked-by: Serge E. Hallyn <serge@hallyn.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Satyam Sharma 2007-07-17 15:00:08 +05:30 committed by Linus Torvalds
parent 49c13b51a1
commit 3bd858ab1c
22 changed files with 32 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/attr.c
View File

@ -42,7 +42,7 @@ int inode_change_ok(struct inode *inode, struct iattr *attr)
/* Make sure a caller can chmod. */
if (ia_valid & ATTR_MODE) {
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
goto error;
/* Also check the setgid bit! */
if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
@ -52,7 +52,7 @@ int inode_change_ok(struct inode *inode, struct iattr *attr)
/* Check for setting the inode time. */
if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET)) {
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
goto error;
}
fine:

2
fs/ext2/acl.c
View File

@ -464,7 +464,7 @@ ext2_xattr_set_acl(struct inode *inode, int type, const void *value,
if (!test_opt(inode->i_sb, POSIX_ACL))
return -EOPNOTSUPP;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {

4
fs/ext2/ioctl.c
View File

@ -36,7 +36,7 @@ int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(flags, (int __user *) arg))
@ -74,7 +74,7 @@ int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
case EXT2_IOC_GETVERSION:
return put_user(inode->i_generation, (int __user *) arg);
case EXT2_IOC_SETVERSION:
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (IS_RDONLY(inode))
return -EROFS;

2
fs/ext3/acl.c
View File

@ -489,7 +489,7 @@ ext3_xattr_set_acl(struct inode *inode, int type, const void *value,
if (!test_opt(inode->i_sb, POSIX_ACL))
return -EOPNOTSUPP;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {

6
fs/ext3/ioctl.c
View File

@ -41,7 +41,7 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(flags, (int __user *) arg))
@ -122,7 +122,7 @@ flags_err:
__u32 generation;
int err;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (IS_RDONLY(inode))
return -EROFS;
@ -181,7 +181,7 @@ flags_err:
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(rsv_window_size, (int __user *)arg))

2
fs/ext4/acl.c
View File

@ -489,7 +489,7 @@ ext4_xattr_set_acl(struct inode *inode, int type, const void *value,
if (!test_opt(inode->i_sb, POSIX_ACL))
return -EOPNOTSUPP;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {

6
fs/ext4/ioctl.c
View File

@ -40,7 +40,7 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(flags, (int __user *) arg))
@ -121,7 +121,7 @@ flags_err:
__u32 generation;
int err;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (IS_RDONLY(inode))
return -EROFS;
@ -180,7 +180,7 @@ flags_err:
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(rsv_window_size, (int __user *)arg))

2
fs/fcntl.c
View File

@ -215,7 +215,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
/* O_NOATIME can only be set by the owner or superuser */
if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
/* required for strict SunOS emulation */

2
fs/generic_acl.c
View File

@ -78,7 +78,7 @@ generic_acl_set(struct inode *inode, struct generic_acl_operations *ops,
if (S_ISLNK(inode->i_mode))
return -EOPNOTSUPP;
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {
acl = posix_acl_from_xattr(value, size);

2
fs/gfs2/acl.c
View File

@ -74,7 +74,7 @@ int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access)
{
if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl)
return -EOPNOTSUPP;
if (current->fsuid != ip->i_inode.i_uid && !capable(CAP_FOWNER))
if (!is_owner_or_cap(&ip->i_inode))
return -EPERM;
if (S_ISLNK(ip->i_inode.i_mode))
return -EOPNOTSUPP;

2
fs/hfsplus/ioctl.c
View File

@ -38,7 +38,7 @@ int hfsplus_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(flags, (int __user *)arg))

2
fs/jffs2/acl.c
View File

@ -435,7 +435,7 @@ static int jffs2_acl_setxattr(struct inode *inode, int type, const void *value,
struct posix_acl *acl;
int rc;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {

2
fs/jfs/ioctl.c
View File

@ -69,7 +69,7 @@ int jfs_ioctl(struct inode * inode, struct file * filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EACCES;
if (get_user(flags, (int __user *) arg))

2
fs/jfs/xattr.c
View File

@ -697,7 +697,7 @@ static int can_set_system_xattr(struct inode *inode, const char *name,
struct posix_acl *acl;
int rc;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
/*

2
fs/namei.c
View File

@ -1576,7 +1576,7 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
/* O_NOATIME can only be set by the owner or superuser */
if (flag & O_NOATIME)
if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
/*

2
fs/ocfs2/ioctl.c
View File

@ -63,7 +63,7 @@ static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
goto bail_unlock;
status = -EACCES;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
goto bail_unlock;
if (!S_ISDIR(inode->i_mode))

5
fs/reiserfs/ioctl.c
View File

@ -51,8 +51,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
if (IS_RDONLY(inode))
return -EROFS;
if ((current->fsuid != inode->i_uid)
&& !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (get_user(flags, (int __user *)arg))
@ -81,7 +80,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
case REISERFS_IOC_GETVERSION:
return put_user(inode->i_generation, (int __user *)arg);
case REISERFS_IOC_SETVERSION:
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (IS_RDONLY(inode))
return -EROFS;

2
fs/reiserfs/xattr_acl.c
View File

@ -21,7 +21,7 @@ xattr_set_acl(struct inode *inode, int type, const void *value, size_t size)
if (!reiserfs_posixacl(inode->i_sb))
return -EOPNOTSUPP;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
if (value) {

2
fs/utimes.c
View File

@ -106,7 +106,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
if (IS_IMMUTABLE(inode))
goto dput_and_out;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER)) {
if (!is_owner_or_cap(inode)) {
if (f) {
if (!(f->f_mode & FMODE_WRITE))
goto dput_and_out;

3
fs/xattr.c
View File

@ -60,8 +60,7 @@ xattr_permission(struct inode *inode, const char *name, int mask)
if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
return -EPERM;
if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
(mask & MAY_WRITE) && (current->fsuid != inode->i_uid) &&
!capable(CAP_FOWNER))
(mask & MAY_WRITE) && !is_owner_or_cap(inode))
return -EPERM;
}

4
include/linux/fs.h
View File

@ -284,6 +284,7 @@ extern int dir_notify_enable;
#include <linux/pid.h>
#include <linux/mutex.h>
#include <linux/sysctl.h>
#include <linux/capability.h>
#include <asm/atomic.h>
#include <asm/semaphore.h>
@ -990,6 +991,9 @@ enum {
#define put_fs_excl() atomic_dec(&current->fs_excl)
#define has_fs_excl() atomic_read(&current->fs_excl)
#define is_owner_or_cap(inode) \
((current->fsuid == (inode)->i_uid) || capable(CAP_FOWNER))
/* not quite ready to be deprecated, but... */
extern void lock_super(struct super_block *);
extern void unlock_super(struct super_block *);

2
security/selinux/hooks.c
View File

@ -2318,7 +2318,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value
if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
return -EOPNOTSUPP;
if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
if (!is_owner_or_cap(inode))
return -EPERM;
AVC_AUDIT_DATA_INIT(&ad,FS);