Received: by 2002:ac0:a5a6:0:0:0:0:0 with SMTP id m35-v6csp27299imm; Fri, 21 Sep 2018 17:22:01 -0700 (PDT) X-Google-Smtp-Source: ANB0Vdb56wYZF4zvyS4eURw8Nr1+VBmWMkSBUZ8eO1LYyFyxKEZ5mPTFRaSNojAueaQYHYCVX98C X-Received: by 2002:a62:4bc6:: with SMTP id d67-v6mr121455pfj.175.1537575721261; Fri, 21 Sep 2018 17:22:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1537575721; cv=none; d=google.com; s=arc-20160816; b=eR6fSsR4JVIZbEW3cbEcMEjMp/e+etBOG6diyDDiNHwYJHhLQW9jhEfH90+O6dmDn5 6UB9i9UVEWInCYdphm/wCsVChUn+ddCGarfBiO81jVECgrZqVYST3JVg++DqfQjUJpxT IzqdBY/E7lYkPTLaeg04sn/9njRQV0sb4vlnrfHwdQKPlD0gTjLrCW/eUntxm4IokmK+ p8p91HD/S42OSMSoUh/fKmaV2xebJd5TBmQoGrwbdXISKf7m5sdRb7TZzt+WEFT+Ecn4 JZd3B6M2sLBhf+RYY98uXhJsPE0Amn7jYQ04ARJ13clKgj9UGDji5RE1TkdFcNrNX+4R KrnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition; bh=ezwiCVDCdE7iF6xd0LBwz56AIoVkgWtBeyEXlYSsfsE=; b=U+4Ykwh7+gRnskLf0ChG3j3JC7E2b8bxyY5w36Pvu1VApJEyeYTu2dvxnbGvooEaVg 66vblbyfDNX4TDA5FvAlM3Wrwiapg+lCD8ohJfsjQz0gpjDOSN2MRx8eH+zetqzk69pJ /7TPib8e9VE10K3tvU73bOU+8IM5a0GByT1Lcz60ufAvx/cPoAEc8vuVJ0lRgRRARG8N mBmtMpWIxvPUhi9L2K4uGLyQiVLGdNJ8D+G1gCSrFqDi1e/Q1bgSqSfP6NuoXsMOPasy mn/dhY6LzwJqmy7np2iXFETXd0HO9RXdV2Bm0Ia5l1B14uAOfamKOHfrWXZ8Bno/Y+z0 c1Dg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z16-v6si1558578pga.177.2018.09.21.17.21.45; Fri, 21 Sep 2018 17:22:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392086AbeIVGKt (ORCPT + 99 others); Sat, 22 Sep 2018 02:10:49 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:44245 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2392009AbeIVGKs (ORCPT ); Sat, 22 Sep 2018 02:10:48 -0400 Received: from [2a02:8011:400e:2:cbab:f00:c93f:614] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1g3Vdy-0008BU-6b; Sat, 22 Sep 2018 01:19:30 +0100 Received: from ben by deadeye with local (Exim 4.91) (envelope-from ) id 1g3Vdo-0000sk-Dc; Sat, 22 Sep 2018 01:19:20 +0100 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Al Viro" , "Jann Horn" , "Linus Torvalds" , "Andy Lutomirski" Date: Sat, 22 Sep 2018 01:15:42 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 38/63] Fix up non-directory creation in SGID directories In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:cbab:f00:c93f:614 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.58-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Linus Torvalds commit 0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 upstream. sgid directories have special semantics, making newly created files in the directory belong to the group of the directory, and newly created subdirectories will also become sgid. This is historically used for group-shared directories. But group directories writable by non-group members should not imply that such non-group members can magically join the group, so make sure to clear the sgid bit on non-directories for non-members (but remember that sgid without group execute means "mandatory locking", just to confuse things even more). Reported-by: Jann Horn Cc: Andy Lutomirski Cc: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings --- fs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/inode.c +++ b/fs/inode.c @@ -1827,8 +1827,14 @@ void inode_init_owner(struct inode *inod inode->i_uid = current_fsuid(); if (dir && dir->i_mode & S_ISGID) { inode->i_gid = dir->i_gid; + + /* Directories are special, and always inherit S_ISGID */ if (S_ISDIR(mode)) mode |= S_ISGID; + else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && + !in_group_p(inode->i_gid) && + !capable_wrt_inode_uidgid(dir, CAP_FSETID)) + mode &= ~S_ISGID; } else inode->i_gid = current_fsgid(); inode->i_mode = mode;