This is a note to let you know that I've just added the patch titled fs: use consistent setgid checks in is_sxid() to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fs-use-consistent-setgid-checks-in-is_sxid.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From stable-owner@xxxxxxxxxxxxxxx Sat Mar 18 11:16:17 2023 From: Amir Goldstein <amir73il@xxxxxxxxx> Date: Sat, 18 Mar 2023 12:15:28 +0200 Subject: fs: use consistent setgid checks in is_sxid() To: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: Sasha Levin <sashal@xxxxxxxxxx>, "Darrick J . Wong" <djwong@xxxxxxxxxx>, Leah Rumancik <leah.rumancik@xxxxxxxxx>, Chandan Babu R <chandan.babu@xxxxxxxxxx>, Christian Brauner <brauner@xxxxxxxxxx>, linux-fsdevel@xxxxxxxxxxxxxxx, linux-xfs@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, Miklos Szeredi <miklos@xxxxxxxxxx> Message-ID: <20230318101529.1361673-15-amir73il@xxxxxxxxx> From: Christian Brauner <brauner@xxxxxxxxxx> commit 8d84e39d76bd83474b26cb44f4b338635676e7e8 upstream. Now that we made the VFS setgid checking consistent an inode can't be marked security irrelevant even if the setgid bit is still set. Make this function consistent with all other helpers. Note that enforcing consistent setgid stripping checks for file modification and mode- and ownership changes will cause the setgid bit to be lost in more cases than useed to be the case. If an unprivileged user wrote to a non-executable setgid file that they don't have privilege over the setgid bit will be dropped. This will lead to temporary failures in some xfstests until they have been updated. Reported-by: Miklos Szeredi <miklos@xxxxxxxxxx> Signed-off-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx> Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- include/linux/fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3408,7 +3408,7 @@ int __init get_filesystem_list(char *buf static inline bool is_sxid(umode_t mode) { - return (mode & S_ISUID) || ((mode & S_ISGID) && (mode & S_IXGRP)); + return mode & (S_ISUID | S_ISGID); } static inline int check_sticky(struct inode *dir, struct inode *inode) Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are queue-5.10/xfs-fallocate-should-call-file_modified.patch queue-5.10/attr-add-setattr_should_drop_sgid.patch queue-5.10/xfs-set-prealloc-flag-in-xfs_alloc_file_space.patch queue-5.10/xfs-purge-dquots-after-inode-walk-fails-during-quotacheck.patch queue-5.10/fs-use-consistent-setgid-checks-in-is_sxid.patch queue-5.10/xfs-remove-xfs_prealloc_sync.patch queue-5.10/attr-add-in_group_or_capable.patch queue-5.10/xfs-don-t-assert-fail-on-perag-references-on-teardown.patch queue-5.10/xfs-don-t-leak-btree-cursor-when-insrec-fails-after-a-split.patch queue-5.10/fs-move-s_isgid-stripping-into-the-vfs_-helpers.patch queue-5.10/xfs-remove-xfs_setattr_time-declaration.patch queue-5.10/fs-move-should_remove_suid.patch queue-5.10/attr-use-consistent-sgid-stripping-checks.patch queue-5.10/fs-add-mode_strip_sgid-helper.patch queue-5.10/xfs-use-setattr_copy-to-set-vfs-inode-attributes.patch