kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/fs/btrfs
History
Jan Kara f2ba3e2310 posix_acl: Clear SGID bit when setting file permissions 
commit 073931017b upstream.

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

References: CVE-2016-7097
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
[bwh: Backported to 3.16:
 - Drop changes to orangefs
 - Adjust context
 - Update ext3 as well]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-11-20 01:17:38 +00:00
..
tests Btrfs: fix qgroups sanity test crash or hang 2014-06-13 09:52:24 -07:00
acl.c posix_acl: Clear SGID bit when setting file permissions 2016-11-20 01:17:38 +00:00
async-thread.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
async-thread.h Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
backref.c Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl 2016-02-25 10:34:37 +00:00
backref.h Btrfs: fix scrub_print_warning to handle skinny metadata extents 2014-06-09 17:21:17 -07:00
btrfs_inode.h btrfs: disable strict file flushes for renames and truncates 2014-09-05 16:36:37 -07:00
check-integrity.c btrfs: check_int: propagate out-of-memory error upwards 2014-06-09 17:20:21 -07:00
check-integrity.h block: submit_bio_wait() conversions 2013-11-24 16:33:41 -07:00
compression.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
compression.h btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
ctree.c Btrfs: make xattr replace operations atomic 2015-03-30 11:11:47 +01:00
ctree.h btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl 2016-08-22 22:37:52 +01:00
delayed-inode.c btrfs: properly set the termination value of ctx->pos in readdir 2016-02-25 10:34:58 +00:00
delayed-inode.h btrfs: properly set the termination value of ctx->pos in readdir 2016-02-25 10:34:58 +00:00
delayed-ref.c Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
delayed-ref.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
dev-replace.c btrfs: Fix a deadlock in btrfs_dev_replace_finishing() 2014-10-30 09:40:08 -07:00
dev-replace.h Btrfs: add new sources for device replace code 2012-12-12 17:15:41 -05:00
dir-item.c Btrfs: make xattr replace operations atomic 2015-03-30 11:11:47 +01:00
disk-io.c btrfs: set proper message level for skinny metadata 2015-02-24 10:01:08 +00:00
disk-io.h Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
export.c btrfs: remove fs/btrfs/compat.h 2013-11-11 22:03:19 -05:00
export.h NFS support for btrfs - v3 2008-09-25 11:04:06 -04:00
extent-tree.c Btrfs: clean up an error code in btrfs_init_space_info() 2016-02-02 23:35:04 +00:00
extent_io.c Btrfs: update fix for read corruption of compressed and shared extents 2015-10-28 16:44:00 +00:00
extent_io.h Btrfs: remove unused wait queue in struct extent_buffer 2014-06-19 14:20:28 -07:00
extent_map.c Btrfs: do not move em to modified list when unpinning 2015-01-05 13:48:52 +00:00
extent_map.h Btrfs: fix NULL pointer crash when running balance and scrub concurrently 2014-06-19 14:20:55 -07:00
file-item.c Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup 2014-11-14 15:19:58 +00:00
file.c btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl 2016-08-22 22:37:52 +01:00
free-space-cache.c Btrfs: fix broken free space cache after the system crashed 2014-06-19 14:20:54 -07:00
free-space-cache.h Btrfs: remove path arg from btrfs_truncate_free_space_cache 2013-11-11 21:51:33 -05:00
hash.c Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
hash.h Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
inode-item.c btrfs: cleanup: removed unused 'btrfs_get_inode_ref_index' 2014-01-28 13:19:39 -08:00
inode-map.c Btrfs: fix race between caching kthread and returning inode to inode cache 2015-07-20 14:38:51 +01:00
inode-map.h Btrfs: Support reading/writing on disk free ino cache 2011-04-25 16:46:11 +08:00
inode.c fs: Give dentry to inode_change_ok() instead of inode 2016-11-20 01:17:38 +00:00
ioctl.c btrfs: ensure that file descriptor used with subvol ioctls is a dir 2016-11-20 01:17:34 +00:00
Kconfig Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
locking.c btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
locking.h btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
lzo.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
Makefile Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
math.h Btrfs: cleanup duplicated division functions 2012-12-11 13:31:30 -05:00
ordered-data.c Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
ordered-data.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
orphan.c btrfs: expand btrfs_find_item() to include find_orphan_item functionality 2014-01-28 13:19:37 -08:00
print-tree.c Btrfs: fix btrfs_print_leaf for skinny metadata 2014-07-03 07:04:16 -07:00
print-tree.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
props.c Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
props.h Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
qgroup.c btrfs: don't go readonly on existing qgroup items 2015-01-05 10:21:14 +00:00
qgroup.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
raid56.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
raid56.h Btrfs: RAID5 and RAID6 2013-02-01 14:24:23 -05:00
rcu-string.h Btrfs: use rcu to protect device->name 2012-06-14 21:29:16 -04:00
reada.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
relocation.c Btrfs: fix build_backref_tree issue with multiple shared blocks 2014-10-30 09:40:09 -07:00
root-tree.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
scrub.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
send.c Btrfs: send, don't leave without decrementing clone root's send_progress 2015-06-17 15:26:38 +01:00
send.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
struct-funcs.c Btrfs: rewrite BTRFS_SETGET_FUNCS 2012-07-23 16:28:06 -04:00
super.c Btrfs: lock superblock before remounting for rw subvol 2015-07-15 10:01:24 +01:00
sysfs.c btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
sysfs.h btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
transaction.c Btrfs: check if previous transaction aborted to avoid fs corruption 2015-09-28 10:21:46 +01:00
transaction.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
tree-defrag.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
tree-log.c Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns 2016-11-20 01:17:23 +00:00
tree-log.h Btrfs: use helpers for last_trans_log_full_commit instead of opencode 2014-06-09 17:20:45 -07:00
ulist.c Btrfs: do not export ulist functions 2014-01-29 07:06:27 -08:00
ulist.h Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch 2014-09-05 16:36:36 -07:00
uuid-tree.c Btrfs: convert printk to btrfs_ and fix BTRFS prefix 2014-01-28 13:20:05 -08:00
volumes.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
volumes.h btrfs: check unsupported filters in balance arguments 2015-11-16 11:26:49 +00:00
xattr.c Btrfs: fix race when listing an inode's xattrs 2015-12-13 17:49:18 +00:00
xattr.h btrfs: use generic posix ACL infrastructure 2014-01-25 23:58:18 -05:00
zlib.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00