linux-kernel - [PATCH 0/7] fix setuid/setgid clearing in networked filesystems (take 6)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200709101452.l8AEqGFw016262@dantu.rdu.redhat.com>
Date:	Mon, 10 Sep 2007 10:52:16 -0400
From:	Jeff Layton <jlayton@...hat.com>
To:	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Cc:	linux-cifs-client@...ts.samba.org, nfs@...ts.sourceforge.net,
	ecryptfs-devel@...ts.sourceforge.net,
	reiserfs-devel@...r.kernel.org, unionfs@...esystems.org
Subject: [PATCH 0/7] fix setuid/setgid clearing in networked filesystems (take 6)

When an unprivileged process attempts to modify a file that has the
setuid or setgid bits set, the VFS will attempt to clear these bits. The
VFS will set the ATTR_KILL_SUID or ATTR_KILL_SGID bits in the ia_valid
mask, and then call notify_change to clear these bits and set the mode
accordingly.

With a networked filesystem (NFS and CIFS in particular but likely
others), the client machine or process may not have credentials that
allow for setting the mode. In some situations, this can lead to file
corruption, an operation failing outright because the setattr fails, or
to races that lead to a mode change being reverted.

In this situation, we'd like to just leave the handling of this to the
server and ignore these bits. The problem is that by the time the
setattr op is called, the VFS has already reinterpreted the ATTR_KILL_*
bits into a mode change and the setattr operation has no way to
know its intent.

The following patchset fixes this by making notify_change no longer
clear the ATTR_KILL_SUID and ATTR_KILL_SGID bits in the ia_valid before
handing it off to the setattr inode op. setattr can then check for the
presence of these bits, and if they're set it can assume that the mode
change was only for the purposes of clearing these bits.

This means that we now have an implicit assumption that notify_change is
never called with ATTR_MODE and either ATTR_KILL_S*ID bit set. Nothing
currently enforces that, so the main patch (5/7) adds a BUG() if that
occurs.

The first four patches fix up callers of notify_change to make sure that
they don't trip the new BUG() call. The last two patches change CIFS and
NFS to ignore the mode change if either ATTR_KILL_S*ID is set.

This patchset should apply cleanly to 2.6.23-rc4-mm1. This is
basically the same patchset as take 5. The only differences are that
the patches have been reordered to make the tree cleanly bisectable,
and the comment in notify_change is now a bit more descriptive.

Signed-off-by: Jeff Layton <jlayton@...hat.com>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/