This is a note to let you know that I've just added the patch titled
xfs: fix up non-directory creation in SGID directories
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfs-fix-up-non-directory-creation-in-sgid-directories.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Wed Apr 12 06:29:03 2023
From: Chandan Babu R <chandan.babu@xxxxxxxxxx>
Date: Wed, 12 Apr 2023 09:56:18 +0530
Subject: xfs: fix up non-directory creation in SGID directories
To: gregkh@xxxxxxxxxxxxxxxxxxx
Cc: sashal@xxxxxxxxxx, mcgrof@xxxxxxxxxx, linux-xfs@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, djwong@xxxxxxxxxx, chandan.babu@xxxxxxxxxx, amir73il@xxxxxxxxx, leah.rumancik@xxxxxxxxx
Message-ID: <20230412042624.600511-12-chandan.babu@xxxxxxxxxx>
From: Christoph Hellwig <hch@xxxxxx>
commit 01ea173e103edd5ec41acec65b9261b87e123fc2 upstream.
XFS always inherits the SGID bit if it is set on the parent inode, while
the generic inode_init_owner does not do this in a few cases where it can
create a possible security problem, see commit 0fa3ecd87848
("Fix up non-directory creation in SGID directories") for details.
Switch XFS to use the generic helper for the normal path to fix this,
just keeping the simple field inheritance open coded for the case of the
non-sgid case with the bsdgrpid mount option.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Christian Brauner <christian.brauner@xxxxxxxxxx>
Signed-off-by: Christoph Hellwig <hch@xxxxxx>
Reviewed-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Chandan Babu R <chandan.babu@xxxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/xfs_inode.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -750,6 +750,7 @@ xfs_ialloc(
xfs_buf_t **ialloc_context,
xfs_inode_t **ipp)
{
+ struct inode *dir = pip ? VFS_I(pip) : NULL;
struct xfs_mount *mp = tp->t_mountp;
xfs_ino_t ino;
xfs_inode_t *ip;
@@ -795,18 +796,17 @@ xfs_ialloc(
return error;
ASSERT(ip != NULL);
inode = VFS_I(ip);
- inode->i_mode = mode;
set_nlink(inode, nlink);
- inode->i_uid = current_fsuid();
inode->i_rdev = rdev;
ip->i_d.di_projid = prid;
- if (pip && XFS_INHERIT_GID(pip)) {
- inode->i_gid = VFS_I(pip)->i_gid;
- if ((VFS_I(pip)->i_mode & S_ISGID) && S_ISDIR(mode))
- inode->i_mode |= S_ISGID;
+ if (dir && !(dir->i_mode & S_ISGID) &&
+ (mp->m_flags & XFS_MOUNT_GRPID)) {
+ inode->i_uid = current_fsuid();
+ inode->i_gid = dir->i_gid;
+ inode->i_mode = mode;
} else {
- inode->i_gid = current_fsgid();
+ inode_init_owner(inode, dir, mode);
}
/*
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-5.4/xfs-merge-the-projid-fields-in-struct-xfs_icdinode.patch
queue-5.4/xfs-simplify-a-check-in-xfs_ioctl_setattr_check_cowextsize.patch
queue-5.4/xfs-shut-down-the-filesystem-if-we-screw-up-quota-reservation.patch
queue-5.4/irqdomain-fix-mapping-creation-race.patch
queue-5.4/xfs-add-a-new-xfs_sb_version_has_v3inode-helper.patch
queue-5.4/xfs-only-check-the-superblock-version-for-dinode-size-calculation.patch
queue-5.4/xfs-force-log-and-push-ail-to-clear-pinned-inodes-when-aborting-mount.patch
queue-5.4/xfs-fix-up-non-directory-creation-in-sgid-directories.patch
queue-5.4/xfs-consider-shutdown-in-bmapbt-cursor-delete-assert.patch
queue-5.4/xfs-set-inode-size-after-creating-symlink.patch
queue-5.4/xfs-remove-the-kuid-kgid-conversion-wrappers.patch
queue-5.4/xfs-ensure-that-the-inode-uid-gid-match-values-match-the-icdinode-ones.patch
queue-5.4/xfs-remove-the-icdinode-di_uid-di_gid-members.patch
queue-5.4/xfs-don-t-reuse-busy-extents-on-extent-trim.patch
queue-5.4/irqdomain-refactor-__irq_domain_alloc_irqs.patch
queue-5.4/xfs-simplify-di_flags2-inheritance-in-xfs_ialloc.patch
queue-5.4/irqdomain-look-for-existing-mapping-only-once.patch
queue-5.4/xfs-show-the-proper-user-quota-options.patch
queue-5.4/xfs-report-corruption-only-as-a-regular-error.patch
queue-5.4/xfs-remove-the-di_version-field-from-struct-icdinode.patch
