Unverified Commit b4dd412d authored by Christian Brauner's avatar Christian Brauner Committed by Christian Brauner (Microsoft)
Browse files

Merge branch 'fs.ovl.setgid' into for-next 

* fs.ovl.setgid:
  ovl: remove privs in ovl_fallocate()
  ovl: remove privs in ovl_copyfile()
  attr: use consistent sgid stripping checks
  attr: add setattr_should_drop_sgid()
  fs: move should_remove_suid()
  attr: add in_group_or_capable()
parents 9abf2313 23a8ce16

Documentation/trace/ftrace.rst

+1 −1
Original line number Diff line number Diff line
@@ -2940,7 +2940,7 @@ Produces:: 
              bash-1994  [000] ....  4342.324898: ima_get_action <-process_measurement

              bash-1994  [000] ....  4342.324898: ima_match_policy <-ima_get_action

              bash-1994  [000] ....  4342.324899: do_truncate <-do_last

              bash-1994  [000] ....  4342.324899: should_remove_suid <-do_truncate

              bash-1994  [000] ....  4342.324899: setattr_should_drop_suidgid <-do_truncate

              bash-1994  [000] ....  4342.324899: notify_change <-do_truncate

              bash-1994  [000] ....  4342.324900: current_fs_time <-notify_change

              bash-1994  [000] ....  4342.324900: current_kernel_time <-current_fs_time

fs/attr.c

+68 −6
Original line number Diff line number Diff line
@@ -18,6 +18,70 @@ 
#include <linux/evm.h>

#include <linux/ima.h>



#include "internal.h"



/**

 * setattr_should_drop_sgid - determine whether the setgid bit needs to be

 *                            removed

 * @mnt_userns:	user namespace of the mount @inode was found from

 * @inode:	inode to check

 *

 * This function determines whether the setgid bit needs to be removed.

 * We retain backwards compatibility and require setgid bit to be removed

 * unconditionally if S_IXGRP is set. Otherwise we have the exact same

 * requirements as setattr_prepare() and setattr_copy().

 *

 * Return: ATTR_KILL_SGID if setgid bit needs to be removed, 0 otherwise.

 */

int setattr_should_drop_sgid(struct user_namespace *mnt_userns,

			     const struct inode *inode)

{

	umode_t mode = inode->i_mode;



	if (!(mode & S_ISGID))

		return 0;

	if (mode & S_IXGRP)

		return ATTR_KILL_SGID;

	if (!in_group_or_capable(mnt_userns, inode,

				 i_gid_into_vfsgid(mnt_userns, inode)))

		return ATTR_KILL_SGID;

	return 0;

}



/**

 * setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to

 *                               be dropped

 * @mnt_userns:	user namespace of the mount @inode was found from

 * @inode:	inode to check

 *

 * This function determines whether the set{g,u}id bits need to be removed.

 * If the setuid bit needs to be removed ATTR_KILL_SUID is returned. If the

 * setgid bit needs to be removed ATTR_KILL_SGID is returned. If both

 * set{g,u}id bits need to be removed the corresponding mask of both flags is

 * returned.

 *

 * Return: A mask of ATTR_KILL_S{G,U}ID indicating which - if any - setid bits

 * to remove, 0 otherwise.

 */

int setattr_should_drop_suidgid(struct user_namespace *mnt_userns,

				struct inode *inode)

{

	umode_t mode = inode->i_mode;

	int kill = 0;



	/* suid always must be killed */

	if (unlikely(mode & S_ISUID))

		kill = ATTR_KILL_SUID;



	kill |= setattr_should_drop_sgid(mnt_userns, inode);



	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))

		return kill;



	return 0;

}

EXPORT_SYMBOL(setattr_should_drop_suidgid);



/**

 * chown_ok - verify permissions to chown inode

 * @mnt_userns:	user namespace of the mount @inode was found from
@@ -140,8 +204,7 @@ int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry, 
			vfsgid = i_gid_into_vfsgid(mnt_userns, inode);



		/* Also check the setgid bit! */

		if (!vfsgid_in_group_p(vfsgid) &&

		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		if (!in_group_or_capable(mnt_userns, inode, vfsgid))

			attr->ia_mode &= ~S_ISGID;

	}
@@ -251,9 +314,8 @@ void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode, 
		inode->i_ctime = attr->ia_ctime;

	if (ia_valid & ATTR_MODE) {

		umode_t mode = attr->ia_mode;

		vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);

		if (!vfsgid_in_group_p(vfsgid) &&

		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		if (!in_group_or_capable(mnt_userns, inode,

					 i_gid_into_vfsgid(mnt_userns, inode)))

			mode &= ~S_ISGID;

		inode->i_mode = mode;

	}
@@ -375,7 +437,7 @@ int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry, 
		}

	}

	if (ia_valid & ATTR_KILL_SGID) {

		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {

		if (mode & S_ISGID) {

			if (!(ia_valid & ATTR_MODE)) {

				ia_valid = attr->ia_valid |= ATTR_MODE;

				attr->ia_mode = inode->i_mode;

fs/fuse/file.c

+1 −1
Original line number Diff line number Diff line
@@ -1313,7 +1313,7 @@ static ssize_t fuse_cache_write_iter(struct kiocb *iocb, struct iov_iter *from) 
			return err;



		if (fc->handle_killpriv_v2 &&

		    should_remove_suid(file_dentry(file))) {

		    setattr_should_drop_suidgid(&init_user_ns, file_inode(file))) {

			goto writethrough;

		}

fs/inode.c

+28 −36
Original line number Diff line number Diff line
@@ -1948,41 +1948,13 @@ void touch_atime(const struct path *path) 
}

EXPORT_SYMBOL(touch_atime);



/*

 * The logic we want is

 *

 *	if suid or (sgid and xgrp)

 *		remove privs

 */

int should_remove_suid(struct dentry *dentry)

{

	umode_t mode = d_inode(dentry)->i_mode;

	int kill = 0;



	/* suid always must be killed */

	if (unlikely(mode & S_ISUID))

		kill = ATTR_KILL_SUID;



	/*

	 * sgid without any exec bits is just a mandatory locking mark; leave

	 * it alone.  If some exec bits are set, it's a real sgid; kill it.

	 */

	if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))

		kill |= ATTR_KILL_SGID;



	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))

		return kill;



	return 0;

}

EXPORT_SYMBOL(should_remove_suid);



/*

 * Return mask of changes for notify_change() that need to be done as a

 * response to write or truncate. Return 0 if nothing has to be changed.

 * Negative value on error (change should be denied).

 */

int dentry_needs_remove_privs(struct dentry *dentry)

int dentry_needs_remove_privs(struct user_namespace *mnt_userns,

			      struct dentry *dentry)

{

	struct inode *inode = d_inode(dentry);

	int mask = 0;
@@ -1991,7 +1963,7 @@ int dentry_needs_remove_privs(struct dentry *dentry) 
	if (IS_NOSEC(inode))

		return 0;



	mask = should_remove_suid(dentry);

	mask = setattr_should_drop_suidgid(mnt_userns, inode);

	ret = security_inode_need_killpriv(dentry);

	if (ret < 0)

		return ret;
@@ -2023,7 +1995,7 @@ static int __file_remove_privs(struct file *file, unsigned int flags) 
	if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode))

		return 0;



	kill = dentry_needs_remove_privs(dentry);

	kill = dentry_needs_remove_privs(file_mnt_user_ns(file), dentry);

	if (kill < 0)

		return kill;
@@ -2487,6 +2459,28 @@ struct timespec64 current_time(struct inode *inode) 
}

EXPORT_SYMBOL(current_time);



/**

 * in_group_or_capable - check whether caller is CAP_FSETID privileged

 * @mnt_userns: user namespace of the mount @inode was found from

 * @inode:	inode to check

 * @vfsgid:	the new/current vfsgid of @inode

 *

 * Check wether @vfsgid is in the caller's group list or if the caller is

 * privileged with CAP_FSETID over @inode. This can be used to determine

 * whether the setgid bit can be kept or must be dropped.

 *

 * Return: true if the caller is sufficiently privileged, false if not.

 */

bool in_group_or_capable(struct user_namespace *mnt_userns,

			 const struct inode *inode, vfsgid_t vfsgid)

{

	if (vfsgid_in_group_p(vfsgid))

		return true;

	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))

		return true;

	return false;

}



/**

 * mode_strip_sgid - handle the sgid bit for non-directories

 * @mnt_userns: User namespace of the mount the inode was created from
@@ -2508,11 +2502,9 @@ umode_t mode_strip_sgid(struct user_namespace *mnt_userns, 
		return mode;

	if (S_ISDIR(mode) || !dir || !(dir->i_mode & S_ISGID))

		return mode;

	if (in_group_p(i_gid_into_mnt(mnt_userns, dir)))

		return mode;

	if (capable_wrt_inode_uidgid(mnt_userns, dir, CAP_FSETID))

	if (in_group_or_capable(mnt_userns, dir,

				i_gid_into_vfsgid(mnt_userns, dir)))

		return mode;



	return mode & ~S_ISGID;

}

EXPORT_SYMBOL(mode_strip_sgid);

fs/internal.h

+9 −1
Original line number Diff line number Diff line
@@ -150,7 +150,9 @@ extern int vfs_open(const struct path *, struct file *); 
 * inode.c

 */

extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);

extern int dentry_needs_remove_privs(struct dentry *dentry);

int dentry_needs_remove_privs(struct user_namespace *, struct dentry *dentry);

bool in_group_or_capable(struct user_namespace *mnt_userns,

			 const struct inode *inode, vfsgid_t vfsgid);



/*

 * fs-writeback.c
@@ -234,3 +236,9 @@ int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry, 
		struct xattr_ctx *ctx);



ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos);



/*

 * fs/attr.c

 */

int setattr_should_drop_sgid(struct user_namespace *mnt_userns,

			     const struct inode *inode);