lkml.org 
[lkml]   [1999]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[PATCH 2.2.11-pre2] chmod() too permissive
When trying out 2.2.11-pre2 (nice work!), I discovered that an old
patch (whose original author I have lost) is missing -- a patch that
fixes a hole in the tests for valid calls to chmod().

The function inode_change_ok() in fs/attr.c should verify that only a
person who owns a given file (or has CAP_CHOWN) is allowed to change
the file's group. However, that check is *missing*, theoretically
allowing files' groups to be changed inappropriately. Oops!

Also, a bit of overly restrictive code that hides this first problem
for ext2 filesystems appears in ext2_notify_change().

The below patch rectifies these errors. I suggest that it be included
in 2.2.11. It may be appropriate for 2.3.x also, I don't know.


Index: fs/attr.c
*************** int inode_change_ok(struct inode *inode,
*** 24,34 ****
/* Make sure a caller can chown. */
if ((ia_valid & ATTR_UID) &&
! (current->fsuid != inode->i_uid ||
! attr->ia_uid != inode->i_uid) && !capable(CAP_CHOWN))
goto error;

/* Make sure caller can chgrp. */
if ((ia_valid & ATTR_GID) &&
! (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid) &&
!capable(CAP_CHOWN))
goto error;
--- 24,37 ----
/* Make sure a caller can chown. */
if ((ia_valid & ATTR_UID) &&
! attr->ia_uid != inode->i_uid &&
! (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) &&
! !capable(CAP_CHOWN))
goto error;

/* Make sure caller can chgrp. */
if ((ia_valid & ATTR_GID) &&
! attr->ia_gid != inode->i_gid &&
! (current->fsuid != inode->i_uid && !capable(CAP_FOWNER)) &&
! !in_group_p(attr->ia_gid) && /* no CAP_FGROUP? Why? */
!capable(CAP_CHOWN))
goto error;

Index: fs/ext2/inode.c
*************** int ext2_notify_change(struct dentry *de
*** 715,720 ****
if (!capable(CAP_LINUX_IMMUTABLE))
goto out;
! } else if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
! goto out;

if (iattr->ia_valid & ATTR_SIZE) {
--- 715,719 ----
if (!capable(CAP_LINUX_IMMUTABLE))
goto out;
! }

if (iattr->ia_valid & ATTR_SIZE) {

--
Chip Salzenberg - a.k.a. - <chip@perlsupport.com>
"When do you work?" "Whenever I'm not busy."

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.059 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site