From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kara Subject: [PATCH 1/5] fs: Fix S_NOSEC handling Date: Tue, 19 May 2015 11:46:39 +0200 Message-ID: <1432028803-32296-2-git-send-email-jack@suse.cz> References: <1432028803-32296-1-git-send-email-jack@suse.cz> Cc: Linus Torvalds , linux-fsdevel@vger.kernel.org, dchinner@redhat.com, Serge Hallyn , linux-security-module@vger.kernel.org, Jan Kara , stable@vger.kernel.org To: Al Viro Return-path: In-Reply-To: <1432028803-32296-1-git-send-email-jack@suse.cz> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org file_remove_suid() could mistakenly set S_NOSEC inode bit when root was modifying the file. As a result following writes to the file by ordinary user would avoid clearing suid or sgid bits. Fix the bug by checking actual mode bits before setting S_NOSEC. CC: stable@vger.kernel.org Signed-off-by: Jan Kara --- fs/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index ea37cd17b53f..6e342cadef81 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1693,8 +1693,8 @@ int file_remove_suid(struct file *file) error = security_inode_killpriv(dentry); if (!error && killsuid) error = __remove_suid(dentry, killsuid); - if (!error && (inode->i_sb->s_flags & MS_NOSEC)) - inode->i_flags |= S_NOSEC; + if (!error) + inode_has_no_xattr(inode); return error; } -- 2.1.4