Hi, On Tue 11-10-16 16:11:01, Eric Biggers wrote: > On Mon, Sep 19, 2016 at 05:42:48PM +0200, Jan Kara wrote: > > When file permissions are modified via chmod(2) and the user is not in > > the owning group or capable of CAP_FSETID, the setgid bit is cleared in > > inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file > > permissions as well as the new ACL, but doesn't clear the setgid bit in > > a similar way; this allows to bypass the check in chmod(2). Fix that. > > > > This patch is causing xfstests generic/314 to fail. This test is supposed to > test "SGID inheritance on subdirectories", and the failure is because subdir2 > unexpectedly ends up without a SGID bit. This happens because the following > commands now result in the SGID bit on the parent directory "$TEST_DIR/$seq-dir" > being cleared rather than set: > > mkdir $TEST_DIR/$seq-dir > chown $qa_user:12345 $TEST_DIR/$seq-dir > chmod 2775 $TEST_DIR/$seq-dir > su $qa_user -c "setfacl -m u:$qa_user:rwx,d:u:$qa_user:rwx $TEST_DIR/$seq-dir" > > Is this the expected behavior now? Yes, this is expected behavior - $qa_user is not in group 12345 and thus he could not set sgid bit himself. So once mode is modified by the user (and the setfacl command you presented will touch file mode) sgid bit is expected to be cleared - this is to be consistent with the behavior when: chmod 2755 $TEST_DIR/$seq-dir done by $qa_user would clear the sgid bit as well. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
