Unverified Commit 11c2a870 authored by Christian Brauner's avatar Christian Brauner Committed by Christian Brauner (Microsoft)
Browse files

attr: add in_group_or_capable() 



In setattr_{copy,prepare}() we need to perform the same permission
checks to determine whether we need to drop the setgid bit or not.
Instead of open-coding it twice add a simple helper the encapsulates the
logic. We will reuse this helpers to make dropping the setgid bit during
write operations more consistent in a follow up patch.

Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarChristian Brauner (Microsoft) <brauner@kernel.org>
parent 9abf2313

fs/attr.c

+5 −5
Original line number Diff line number Diff line
@@ -18,6 +18,8 @@ 
#include <linux/evm.h>

#include <linux/ima.h>



#include "internal.h"



/**

 * chown_ok - verify permissions to chown inode

 * @mnt_userns:	user namespace of the mount @inode was found from
@@ -140,8 +142,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry, 
			vfsgid = i_gid_into_vfsgid(mnt_userns, inode);



		/* Also check the setgid bit! */

		if (!vfsgid_in_group_p(vfsgid) &&

		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		if (!in_group_or_capable(mnt_userns, inode, vfsgid))

			attr->ia_mode &= ~S_ISGID;

	}
@@ -251,9 +252,8 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode, 
		inode->i_ctime = attr->ia_ctime;

	if (ia_valid & ATTR_MODE) {

		umode_t mode = attr->ia_mode;

		vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);

		if (!vfsgid_in_group_p(vfsgid) &&

		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		if (!in_group_or_capable(mnt_userns, inode,

					 i_gid_into_vfsgid(mnt_userns, inode)))

			mode &= ~S_ISGID;

		inode->i_mode = mode;

	}

fs/inode.c

+24 −4
Original line number Diff line number Diff line
@@ -2487,6 +2487,28 @@ struct timespec64 current_time(struct inode *inode) 
}

EXPORT_SYMBOL(current_time);



/**

 * in_group_or_capable - check whether caller is CAP_FSETID privileged

 * @mnt_userns: user namespace of the mount @inode was found from

 * @inode:	inode to check

 * @vfsgid:	the new/current vfsgid of @inode

 *

 * Check wether @vfsgid is in the caller's group list or if the caller is

 * privileged with CAP_FSETID over @inode. This can be used to determine

 * whether the setgid bit can be kept or must be dropped.

 *

 * Return: true if the caller is sufficiently privileged, false if not.

 */

bool in_group_or_capable(struct user_namespace *mnt_userns,

			 const struct inode *inode, vfsgid_t vfsgid)

{

	if (vfsgid_in_group_p(vfsgid))

		return true;

	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		return true;

	return false;

}



/**

 * mode_strip_sgid - handle the sgid bit for non-directories

 * @mnt_userns: User namespace of the mount the inode was created from
@@ -2508,11 +2530,9 @@ umode_t mode_strip_sgid(struct user_namespace *mnt_userns, 
		return mode;

	if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID))

		return mode;

	if (in_group_p(i_gid_into_mnt(mnt_userns, dir)))

		return mode;

	if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID))

	if (in_group_or_capable(mnt_userns, dir,

				i_gid_into_vfsgid(mnt_userns, dir)))

		return mode;



	return mode & ~S_ISGID;

}

EXPORT_SYMBOL(mode_strip_sgid);

fs/internal.h

+2 −0
Original line number Diff line number Diff line
@@ -151,6 +151,8 @@ extern int vfs_open(const struct path *, struct file *); 
 */

extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);

extern int dentry_needs_remove_privs(struct dentry *dentry);

bool in_group_or_capable(struct user_namespace *mnt_userns,

			 const struct inode *inode, vfsgid_t vfsgid);



/*

 * fs-writeback.c