This patch allows clients like DMF to modify an immutable file
without changing the immutable capability on the file, which
would expose the file to change.
This patch is restricted to holders of the CAP_LINUX_IMMUTABLE,
so no addition security risk has been introduced.
Signed-off-by: Greg Banks <gbanks@xxxxxxx>
Signed-off-by: Mark Tinguely <tinguely@xxxxxxx>
---
v1->v2 fix the FMODE_WRITE test.
fs/xfs/xfs_ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Index: b/fs/xfs/xfs_ioctl.c
===================================================================
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -237,7 +237,9 @@ xfs_open_by_handle(
goto out_dput;
}
- if ((fmode & FMODE_WRITE) && IS_IMMUTABLE(inode)) {
+ if ((fmode & FMODE_WRITE) &&
+ IS_IMMUTABLE(inode) &&
+ !capable(CAP_LINUX_IMMUTABLE)) {
error = -XFS_ERROR(EACCES);
goto out_dput;
}
_______________________________________________
xfs mailing list
xfs@xxxxxxxxxxx
http://oss.sgi.com/mailman/listinfo/xfs
