[lkml]   [2011]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 1/4] Cache xattr security drop check for write v2
> It sounds like a good idea, but cluster filesystems will need to clear
> the flag when they update their in-core inodes. Without that we could
> have:
> Node A looks up inode and sets S_NOSEC since its not suid
> Node B does chmod +s on the inode
> Node A now has S_NOSEC set, but inode is suid, so writes don't clear
> suid

Good point. I assume that's also true for network file systems.

This would essentially argue that for those putting the helper
into the inode read paths is not optional. I'll look into this

> + if (!is_sxid(inode->i_mode))
> + flags |= S_NOSEC;

Doesn't that need a check for no xattr too? or do you not support
those currently?

Note I added a helper for this in the latest version:


 \ /
  Last update: 2011-05-31 20:09    [W:0.081 / U:3.560 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site