lkml.org 
[lkml]   [2019]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH v2 02/30] fuse: Clear setuid bit even in cache=never path
    On Wed, May 15, 2019 at 03:26:47PM -0400, Vivek Goyal wrote:
    > If fuse daemon is started with cache=never, fuse falls back to direct IO.
    > In that write path we don't call file_remove_privs() and that means setuid
    > bit is not cleared if unpriviliged user writes to a file with setuid bit set.
    >
    > pjdfstest chmod test 12.t tests this and fails.

    I think better sulution is to tell the server if the suid bit needs to be
    removed, so it can do so in a race free way.

    Here's the kernel patch, and I'll reply with the libfuse patch.

    ---
    fs/fuse2/file.c | 2 ++
    include/uapi/linux/fuse.h | 3 +++
    2 files changed, 5 insertions(+)

    --- a/fs/fuse2/file.c
    +++ b/fs/fuse2/file.c
    @@ -363,6 +363,8 @@ static ssize_t fuse_send_write(struct fu
    inarg->flags |= O_DSYNC;
    if (iocb->ki_flags & IOCB_SYNC)
    inarg->flags |= O_SYNC;
    + if (!capable(CAP_FSETID))
    + inarg->write_flags |= FUSE_WRITE_KILL_PRIV;
    req->inh.opcode = FUSE_WRITE;
    req->inh.nodeid = ff->nodeid;
    req->inh.len = req->inline_inlen + count;
    --- a/include/uapi/linux/fuse.h
    +++ b/include/uapi/linux/fuse.h
    @@ -125,6 +125,7 @@
    *
    * 7.29
    * - add FUSE_NO_OPENDIR_SUPPORT flag
    + * - add FUSE_WRITE_KILL_PRIV flag
    */

    #ifndef _LINUX_FUSE_H
    @@ -318,9 +319,11 @@ struct fuse_file_lock {
    *
    * FUSE_WRITE_CACHE: delayed write from page cache, file handle is guessed
    * FUSE_WRITE_LOCKOWNER: lock_owner field is valid
    + * FUSE_WRITE_KILL_PRIV: kill suid and sgid bits
    */
    #define FUSE_WRITE_CACHE (1 << 0)
    #define FUSE_WRITE_LOCKOWNER (1 << 1)
    +#define FUSE_WRITE_KILL_PRIV (1 << 2)

    /**
    * Read flags

    \
     
     \ /
      Last update: 2019-05-20 16:43    [W:4.842 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site