lkml.org 
[lkml]   [2003]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
Subject[PATCH] Re: suid bit behaviour modification in 2.6.0-test5
jpcartal@free.fr writes:

I noticed that contrary to what was happening with 2.4.x kernel, suid
root files don't loose their suid bit when they get overwritten by a
normal user (see example below)

Is this the intended behaviour or a bug ?

Example :

[root@localhost test]# chown root ~cartaljp/test/suid_test
[root@localhost test]# chmod 4775 ~cartaljp/test/suid_test
[root@localhost test]# exit
[cartaljp@localhost test]$ cp /bin/ls suid_test
[cartaljp@localhost test]$ ls -l
total 72
-rwsrwxr-x 1 root cartaljp 67668 Sep 19 07:56 suid_test <-
Suid bit is still set whereas with 2.4.x kernel it was reset.

Yes. Here 2.4 had the terrible code

mode = (inode->i_mode & S_IXGRP)*(S_ISGID/S_IXGRP) | S_ISUID;

while 2.6 does things via notify_change().
However, in 2.6 notify_change() does not allow removal of the SUID bit
because you are not owner of the file :-).
So, we have to convince inode_change_ok() to do it anyway.
Below a patch.

Andries


diff -u --recursive --new-file -X /linux/dontdiff a/mm/filemap.c b/mm/filemap.c
--- a/mm/filemap.c Sat Aug 23 13:30:20 2003
+++ b/mm/filemap.c Sun Sep 21 13:55:38 2003
@@ -1437,7 +1437,7 @@

/* was any of the uid bits set? */
if (mode && !capable(CAP_FSETID)) {
- newattrs.ia_valid = ATTR_KILL_SUID | ATTR_KILL_SGID;
+ newattrs.ia_valid = ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_FORCE;
notify_change(dentry, &newattrs);
}
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 13:48    [W:0.025 / U:0.380 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site