From nobody Mon Dec 15 13:02:56 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A30FDC07E9D for ; Mon, 26 Sep 2022 12:26:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239531AbiIZM0e (ORCPT ); Mon, 26 Sep 2022 08:26:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239437AbiIZMZn (ORCPT ); Mon, 26 Sep 2022 08:25:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F218FAB4EE; Mon, 26 Sep 2022 04:06:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 74AF2B8092B; Mon, 26 Sep 2022 10:30:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBA0DC433D7; Mon, 26 Sep 2022 10:30:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664188254; bh=NryZB3Ybd6APvn/0eYP21OrMJqs15ALEa9AN7nDLQww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yM6/OrFaaV9oztEUP1cRBHs3pAvpmyDOY5WLkJF6puf0ys3R35ETcnfPpMDeffgZR oJBE9RbHj1DFIf4BUi9UTl+eoNxbItKeD+3CamF/W+RZGxULey64aD24PzRCJydI1V /ybZOlcOGduVcyxhcbzBo5eZNtNe7Cdzy2GN4kAc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christian Brauner , Christoph Hellwig , "Darrick J. Wong" , Amir Goldstein Subject: [PATCH 5.10 060/141] xfs: fix up non-directory creation in SGID directories Date: Mon, 26 Sep 2022 12:11:26 +0200 Message-Id: <20220926100756.624113733@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220926100754.639112000@linuxfoundation.org> References: <20220926100754.639112000@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig commit 01ea173e103edd5ec41acec65b9261b87e123fc2 upstream. XFS always inherits the SGID bit if it is set on the parent inode, while the generic inode_init_owner does not do this in a few cases where it can create a possible security problem, see commit 0fa3ecd87848 ("Fix up non-directory creation in SGID directories") for details. Switch XFS to use the generic helper for the normal path to fix this, just keeping the simple field inheritance open coded for the case of the non-sgid case with the bsdgrpid mount option. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Christian Brauner Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Amir Goldstein Acked-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_inode.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -802,6 +802,7 @@ xfs_ialloc( xfs_buf_t **ialloc_context, xfs_inode_t **ipp) { + struct inode *dir =3D pip ? VFS_I(pip) : NULL; struct xfs_mount *mp =3D tp->t_mountp; xfs_ino_t ino; xfs_inode_t *ip; @@ -847,18 +848,17 @@ xfs_ialloc( return error; ASSERT(ip !=3D NULL); inode =3D VFS_I(ip); - inode->i_mode =3D mode; set_nlink(inode, nlink); - inode->i_uid =3D current_fsuid(); inode->i_rdev =3D rdev; ip->i_d.di_projid =3D prid; =20 - if (pip && XFS_INHERIT_GID(pip)) { - inode->i_gid =3D VFS_I(pip)->i_gid; - if ((VFS_I(pip)->i_mode & S_ISGID) && S_ISDIR(mode)) - inode->i_mode |=3D S_ISGID; + if (dir && !(dir->i_mode & S_ISGID) && + (mp->m_flags & XFS_MOUNT_GRPID)) { + inode->i_uid =3D current_fsuid(); + inode->i_gid =3D dir->i_gid; + inode->i_mode =3D mode; } else { - inode->i_gid =3D current_fsgid(); + inode_init_owner(inode, dir, mode); } =20 /*