Jan Kara 073931017b posix_acl: Clear SGID bit when setting file permissions ...

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>

2016-09-22 10:55:32 +02:00

..

acl.c

posix_acl: Clear SGID bit when setting file permissions

2016-09-22 10:55:32 +02:00

addr.c

ceph: rados pool namespace support

2016-07-28 02:55:38 +02:00

cache.c

ceph: fix spelling mistake: "resgister" -> "register"

2016-07-28 02:55:40 +02:00

cache.h

ceph: improve fscache revalidation

2016-06-01 10:31:50 +02:00

caps.c

ceph: optimize cap flush waiting

2016-07-28 03:00:45 +02:00

ceph_frag.c

ceph: factor out libceph from Ceph file system

2010-10-20 15:37:28 -07:00

debugfs.c

ceph: don't show symlink target in debugfs/mdsc

2016-05-26 01:15:32 +02:00

dir.c

ceph: handle LOOKUP_RCU in ceph_d_revalidate

2016-07-28 03:00:39 +02:00

export.c

ceph: fix d_obtain_alias() misuses

2016-06-24 23:49:03 -04:00

file.c

ceph: Correctly return NXIO errors from ceph_llseek

2016-07-28 03:00:45 +02:00

inode.c

The highlights are:

2016-08-02 19:39:09 -04:00

ioctl.c

ceph: reduce i_nr_by_mode array size

2016-07-28 02:55:39 +02:00

ioctl.h

ceph: fully initialize new layout

2012-05-16 14:28:27 -05:00

Kconfig

ceph: add acl for cephfs

2013-12-31 20:32:01 +02:00

locks.c

Move locks API users to locks_lock_inode_wait()

2015-10-22 14:57:36 -04:00

Makefile

ceph: add acl for cephfs

2013-12-31 20:32:01 +02:00

mds_client.c

The highlights are:

2016-08-02 19:39:09 -04:00

mds_client.h

ceph: unify cap flush and snapcap flush

2016-07-28 03:00:42 +02:00

mdsmap.c

ceph: CEPH_FEATURE_MDSENC support

2016-05-26 01:15:31 +02:00

snap.c

ceph: cleanup ceph_flush_snaps()

2016-07-28 03:00:44 +02:00

strings.c

ceph: rename snapshot support

2015-04-22 18:33:41 +03:00

super.c

ceph: Mark the file cache as unreclaimable

2016-07-28 03:00:45 +02:00

super.h

ceph: optimize cap flush waiting

2016-07-28 03:00:45 +02:00

xattr.c

ceph: rados pool namespace support

2016-07-28 02:55:38 +02:00