mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-26 12:26:11 +00:00
attr: add in_group_or_capable()
In setattr_{copy,prepare}() we need to perform the same permission checks to determine whether we need to drop the setgid bit or not. Instead of open-coding it twice add a simple helper the encapsulates the logic. We will reuse this helpers to make dropping the setgid bit during write operations more consistent in a follow up patch. Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
This commit is contained in:
parent
9abf2313ad
commit
11c2a8700c
3 changed files with 31 additions and 9 deletions
10
fs/attr.c
10
fs/attr.c
|
@ -18,6 +18,8 @@
|
||||||
#include <linux/evm.h>
|
#include <linux/evm.h>
|
||||||
#include <linux/ima.h>
|
#include <linux/ima.h>
|
||||||
|
|
||||||
|
#include "internal.h"
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* chown_ok - verify permissions to chown inode
|
* chown_ok - verify permissions to chown inode
|
||||||
* @mnt_userns: user namespace of the mount @inode was found from
|
* @mnt_userns: user namespace of the mount @inode was found from
|
||||||
|
@ -140,8 +142,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
|
||||||
vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
|
vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
|
||||||
|
|
||||||
/* Also check the setgid bit! */
|
/* Also check the setgid bit! */
|
||||||
if (!vfsgid_in_group_p(vfsgid) &&
|
if (!in_group_or_capable(mnt_userns, inode, vfsgid))
|
||||||
!capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
|
|
||||||
attr->ia_mode &= ~S_ISGID;
|
attr->ia_mode &= ~S_ISGID;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -251,9 +252,8 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
|
||||||
inode->i_ctime = attr->ia_ctime;
|
inode->i_ctime = attr->ia_ctime;
|
||||||
if (ia_valid & ATTR_MODE) {
|
if (ia_valid & ATTR_MODE) {
|
||||||
umode_t mode = attr->ia_mode;
|
umode_t mode = attr->ia_mode;
|
||||||
vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
|
if (!in_group_or_capable(mnt_userns, inode,
|
||||||
if (!vfsgid_in_group_p(vfsgid) &&
|
i_gid_into_vfsgid(mnt_userns, inode)))
|
||||||
!capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
|
|
||||||
mode &= ~S_ISGID;
|
mode &= ~S_ISGID;
|
||||||
inode->i_mode = mode;
|
inode->i_mode = mode;
|
||||||
}
|
}
|
||||||
|
|
28
fs/inode.c
28
fs/inode.c
|
@ -2487,6 +2487,28 @@ struct timespec64 current_time(struct inode *inode)
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(current_time);
|
EXPORT_SYMBOL(current_time);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* in_group_or_capable - check whether caller is CAP_FSETID privileged
|
||||||
|
* @mnt_userns: user namespace of the mount @inode was found from
|
||||||
|
* @inode: inode to check
|
||||||
|
* @vfsgid: the new/current vfsgid of @inode
|
||||||
|
*
|
||||||
|
* Check wether @vfsgid is in the caller's group list or if the caller is
|
||||||
|
* privileged with CAP_FSETID over @inode. This can be used to determine
|
||||||
|
* whether the setgid bit can be kept or must be dropped.
|
||||||
|
*
|
||||||
|
* Return: true if the caller is sufficiently privileged, false if not.
|
||||||
|
*/
|
||||||
|
bool in_group_or_capable(struct user_namespace *mnt_userns,
|
||||||
|
const struct inode *inode, vfsgid_t vfsgid)
|
||||||
|
{
|
||||||
|
if (vfsgid_in_group_p(vfsgid))
|
||||||
|
return true;
|
||||||
|
if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
|
||||||
|
return true;
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* mode_strip_sgid - handle the sgid bit for non-directories
|
* mode_strip_sgid - handle the sgid bit for non-directories
|
||||||
* @mnt_userns: User namespace of the mount the inode was created from
|
* @mnt_userns: User namespace of the mount the inode was created from
|
||||||
|
@ -2508,11 +2530,9 @@ umode_t mode_strip_sgid(struct user_namespace *mnt_userns,
|
||||||
return mode;
|
return mode;
|
||||||
if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID))
|
if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID))
|
||||||
return mode;
|
return mode;
|
||||||
if (in_group_p(i_gid_into_mnt(mnt_userns, dir)))
|
if (in_group_or_capable(mnt_userns, dir,
|
||||||
|
i_gid_into_vfsgid(mnt_userns, dir)))
|
||||||
return mode;
|
return mode;
|
||||||
if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID))
|
|
||||||
return mode;
|
|
||||||
|
|
||||||
return mode & ~S_ISGID;
|
return mode & ~S_ISGID;
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(mode_strip_sgid);
|
EXPORT_SYMBOL(mode_strip_sgid);
|
||||||
|
|
|
@ -151,6 +151,8 @@ extern int vfs_open(const struct path *, struct file *);
|
||||||
*/
|
*/
|
||||||
extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);
|
extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);
|
||||||
extern int dentry_needs_remove_privs(struct dentry *dentry);
|
extern int dentry_needs_remove_privs(struct dentry *dentry);
|
||||||
|
bool in_group_or_capable(struct user_namespace *mnt_userns,
|
||||||
|
const struct inode *inode, vfsgid_t vfsgid);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* fs-writeback.c
|
* fs-writeback.c
|
||||||
|
|
Loading…
Reference in a new issue