Jan Kara 073931017b posix_acl: Clear SGID bit when setting file permissions ...

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>

2016-09-22 10:55:32 +02:00

..

acl.c

posix_acl: Clear SGID bit when setting file permissions

2016-09-22 10:55:32 +02:00

acl.h

ext2/3/4: use generic posix ACL infrastructure

2014-01-25 23:58:19 -05:00

balloc.c

ext2: fix filesystem deadlock while reading corrupted xattr block

2016-07-05 22:02:41 -04:00

dir.c

qstr: constify instances in ext2

2016-07-30 12:25:49 -04:00

ext2.h

Merge branch 'work.const-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2016-08-06 09:49:02 -04:00

file.c

dax: remote unused fault wrappers

2016-07-26 16:19:19 -07:00

ialloc.c

ext2: Check return value from ext2_get_group_desc()

2016-08-09 10:12:28 +02:00

inode.c

ext2: fix filesystem deadlock while reading corrupted xattr block

2016-07-05 22:02:41 -04:00

ioctl.c

wrappers for ->i_mutex access

2016-01-22 18:04:28 -05:00

Kconfig

vfs,ext2: remove CONFIG_EXT2_FS_XIP and rename CONFIG_FS_XIP to CONFIG_FS_DAX

2015-02-16 17:56:04 -08:00

Makefile

ext2: remove xip.c and xip.h

2015-02-16 17:56:03 -08:00

namei.c

Merge getxattr prototype change into work.lookups

2016-05-02 19:45:47 -04:00

super.c

ext2: Add alignment check for DAX mount

2016-05-17 00:44:12 -06:00

symlink.c

switch ->get_link() to delayed_call, kill ->put_link()

2015-12-30 13:01:03 -05:00

xattr_security.c

switch xattr_handler->set() to passing dentry and inode separately

2016-05-27 15:39:43 -04:00

xattr_trusted.c

switch xattr_handler->set() to passing dentry and inode separately

2016-05-27 15:39:43 -04:00

xattr_user.c

switch xattr_handler->set() to passing dentry and inode separately

2016-05-27 15:39:43 -04:00

xattr.c

ext2: fix filesystem deadlock while reading corrupted xattr block

2016-07-05 22:02:41 -04:00

xattr.h

mbcache2: rename to mbcache

2016-02-22 22:35:22 -05:00