426b4ca2d6
-----BEGIN PGP SIGNATURE----- iHQEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCYvIYIgAKCRCRxhvAZXjc omE8AQDAZG2YjNJfMnUUaaWYO3+zTaHlQp7OQkQTXIHfcfViXQD4vPt3Wxh3rrF+ J8fwNcWmXhSNei8HP6cA06QmSajnDQ== =GF9/ -----END PGP SIGNATURE----- Merge tag 'fs.setgid.v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull setgid updates from Christian Brauner: "This contains the work to move setgid stripping out of individual filesystems and into the VFS itself. Creating files that have both the S_IXGRP and S_ISGID bit raised in directories that themselves have the S_ISGID bit set requires additional privileges to avoid security issues. When a filesystem creates a new inode it needs to take care that the caller is either in the group of the newly created inode or they have CAP_FSETID in their current user namespace and are privileged over the parent directory of the new inode. If any of these two conditions is true then the S_ISGID bit can be raised for an S_IXGRP file and if not it needs to be stripped. However, there are several key issues with the current implementation: - S_ISGID stripping logic is entangled with umask stripping. For example, if the umask removes the S_IXGRP bit from the file about to be created then the S_ISGID bit will be kept. The inode_init_owner() helper is responsible for S_ISGID stripping and is called before posix_acl_create(). So we can end up with two different orderings: 1. FS without POSIX ACL support First strip umask then strip S_ISGID in inode_init_owner(). In other words, if a filesystem doesn't support or enable POSIX ACLs then umask stripping is done directly in the vfs before calling into the filesystem: 2. FS with POSIX ACL support First strip S_ISGID in inode_init_owner() then strip umask in posix_acl_create(). In other words, if the filesystem does support POSIX ACLs then unmask stripping may be done in the filesystem itself when calling posix_acl_create(). Note that technically filesystems are free to impose their own ordering between posix_acl_create() and inode_init_owner() meaning that there's additional ordering issues that influence S_ISGID inheritance. (Note that the commit message of commit |
||
---|---|---|
.. | ||
cluster | ||
dlm | ||
dlmfs | ||
acl.c | ||
acl.h | ||
alloc.c | ||
alloc.h | ||
aops.c | ||
aops.h | ||
blockcheck.c | ||
blockcheck.h | ||
buffer_head_io.c | ||
buffer_head_io.h | ||
dcache.c | ||
dcache.h | ||
dir.c | ||
dir.h | ||
dlmglue.c | ||
dlmglue.h | ||
export.c | ||
export.h | ||
extent_map.c | ||
extent_map.h | ||
file.c | ||
file.h | ||
filecheck.c | ||
filecheck.h | ||
heartbeat.c | ||
heartbeat.h | ||
inode.c | ||
inode.h | ||
ioctl.c | ||
ioctl.h | ||
journal.c | ||
journal.h | ||
Kconfig | ||
localalloc.c | ||
localalloc.h | ||
locks.c | ||
locks.h | ||
Makefile | ||
mmap.c | ||
mmap.h | ||
move_extents.c | ||
move_extents.h | ||
namei.c | ||
namei.h | ||
ocfs1_fs_compat.h | ||
ocfs2_fs.h | ||
ocfs2_ioctl.h | ||
ocfs2_lockid.h | ||
ocfs2_lockingver.h | ||
ocfs2_trace.h | ||
ocfs2.h | ||
quota_global.c | ||
quota_local.c | ||
quota.h | ||
refcounttree.c | ||
refcounttree.h | ||
reservations.c | ||
reservations.h | ||
resize.c | ||
resize.h | ||
slot_map.c | ||
slot_map.h | ||
stack_o2cb.c | ||
stack_user.c | ||
stackglue.c | ||
stackglue.h | ||
suballoc.c | ||
suballoc.h | ||
super.c | ||
super.h | ||
symlink.c | ||
symlink.h | ||
sysfile.c | ||
sysfile.h | ||
uptodate.c | ||
uptodate.h | ||
xattr.c | ||
xattr.h |