Unverified Commit 41c1e56b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11100 exec: Fix ToCToU between perm check and set-uid/gid usage 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zizhi Wo <wozizhi@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TMLL6DWJG4TNCO7PTRWAOMJ5WTDEOG2B/ 
 
https://gitee.com/src-openeuler/kernel/issues/IALED4 
 
Link:https://gitee.com/openeuler/kernel/pulls/11100

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 679c6764 e16e7cbd

fs/exec.c

+7 −1
Original line number Diff line number Diff line
@@ -1589,6 +1589,7 @@ static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file) 
	unsigned int mode;

	vfsuid_t vfsuid;

	vfsgid_t vfsgid;

	int err;



	if (!mnt_may_suid(file->f_path.mnt))

		return;
@@ -1605,12 +1606,17 @@ static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file) 
	/* Be careful if suid/sgid is set */

	inode_lock(inode);



	/* reload atomically mode/uid/gid now that lock held */

	/* Atomically reload and check mode/uid/gid now that lock held. */

	mode = inode->i_mode;

	vfsuid = i_uid_into_vfsuid(idmap, inode);

	vfsgid = i_gid_into_vfsgid(idmap, inode);

	err = inode_permission(idmap, inode, MAY_EXEC);

	inode_unlock(inode);



	/* Did the exec bit vanish out from under us? Give up. */

	if (err)

		return;



	/* We ignore suid/sgid if there are no mappings for them in the ns */

	if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||

	    !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))