From: Christian Brauner <brauner@kernel.org>
To: Amir Goldstein <amir73il@gmail.com>,
Miklos Szeredi <miklos@szeredi.hu>,
"Darrick J . Wong" <djwong@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>, Christoph Hellwig <hch@lst.de>,
Seth Forshee <sforshee@kernel.org>,
Yang Xu <xuyang2018.jy@fujitsu.com>,
Filipe Manana <fdmanana@kernel.org>,
linux-unionfs@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: [PATCH v3 1/5] attr: add setattr_drop_sgid()
Date: Mon, 17 Oct 2022 12:05:56 +0200 [thread overview]
Message-ID: <20221017100600.70269-2-brauner@kernel.org> (raw)
In-Reply-To: <20221017100600.70269-1-brauner@kernel.org>
In setattr_{copy,prepare}() we need to perform the same permission
checks to determine whether we need to drop the setgid bit or not.
Instead of open-coding it twice add a simple helper the encapsulates the
logic. We will reuse this helpers to make dropping the setgid bit during
write operations more consistent in a follow up patch.
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
---
Notes:
/* v2 */
patch added
/* v3 */
Amir Goldstein <amir73il@gmail.com>:
- Return 0 or ATTR_KILL_SGID to make all dropping helpers behave similarly.
fs/attr.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/fs/attr.c b/fs/attr.c
index 1552a5f23d6b..8bc2edd6bd3c 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -18,6 +18,27 @@
#include <linux/evm.h>
#include <linux/ima.h>
+/**
+ * setattr_drop_sgid - check generic setgid permissions
+ * @mnt_userns: user namespace of the mount @inode was found from
+ * @inode: inode to check
+ * @vfsgid: the new/current vfsgid of @inode
+ *
+ * This function determines whether the setgid bit needs to be removed because
+ * the caller lacks privileges over the inode.
+ *
+ * Return: ATTR_KILL_SGID if the setgid bit needs to be removed, 0 if not.
+ */
+static int setattr_drop_sgid(struct user_namespace *mnt_userns,
+ const struct inode *inode, vfsgid_t vfsgid)
+{
+ if (vfsgid_in_group_p(vfsgid))
+ return 0;
+ if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
+ return 0;
+ return ATTR_KILL_SGID;
+}
+
/**
* chown_ok - verify permissions to chown inode
* @mnt_userns: user namespace of the mount @inode was found from
@@ -140,8 +161,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
/* Also check the setgid bit! */
- if (!vfsgid_in_group_p(vfsgid) &&
- !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
+ if (setattr_drop_sgid(mnt_userns, inode, vfsgid))
attr->ia_mode &= ~S_ISGID;
}
@@ -251,9 +271,8 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
inode->i_ctime = attr->ia_ctime;
if (ia_valid & ATTR_MODE) {
umode_t mode = attr->ia_mode;
- vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
- if (!vfsgid_in_group_p(vfsgid) &&
- !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
+ if (setattr_drop_sgid(mnt_userns, inode,
+ i_gid_into_vfsgid(mnt_userns, inode)))
mode &= ~S_ISGID;
inode->i_mode = mode;
}
--
2.34.1
next prev parent reply other threads:[~2022-10-17 10:06 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-17 10:05 [PATCH v3 0/5] fs: improve setgid stripping consistency even more Christian Brauner
2022-10-17 10:05 ` Christian Brauner [this message]
2022-10-17 12:00 ` [PATCH v3 1/5] attr: add setattr_drop_sgid() Amir Goldstein
2022-10-17 10:05 ` [PATCH v3 2/5] attr: add setattr_should_drop_sgid() Christian Brauner
2022-10-17 12:03 ` Amir Goldstein
2022-10-17 10:05 ` [PATCH v3 3/5] attr: use consistent sgid stripping checks Christian Brauner
2022-10-17 11:59 ` Amir Goldstein
2022-10-17 12:05 ` Amir Goldstein
2022-10-17 10:05 ` [PATCH v3 4/5] ovl: remove privs in ovl_copyfile() Christian Brauner
2022-10-17 10:06 ` [PATCH v3 5/5] ovl: remove privs in ovl_fallocate() Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221017100600.70269-2-brauner@kernel.org \
--to=brauner@kernel.org \
--cc=amir73il@gmail.com \
--cc=djwong@kernel.org \
--cc=fdmanana@kernel.org \
--cc=hch@lst.de \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=sforshee@kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=xuyang2018.jy@fujitsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).