From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx2.suse.de ([195.135.220.15]:48122 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753876AbcEZPCy (ORCPT ); Thu, 26 May 2016 11:02:54 -0400 From: Jan Kara To: Al Viro Cc: linux-fsdevel@vger.kernel.org, Andreas Gruenbacher , Jan Kara Subject: [PATCH 2/2] posix_acl: Clear SGID bit when modifying file permissions Date: Thu, 26 May 2016 17:02:48 +0200 Message-Id: <1464274968-31182-2-git-send-email-jack@suse.cz> In-Reply-To: <1464274968-31182-1-git-send-email-jack@suse.cz> References: <1464274968-31182-1-git-send-email-jack@suse.cz> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: When file permissions are modified via chmod(2) and the user modifying the permissions is not capable of setting SGID bit for the file, the bit gets cleared in inode_change_ok(). However this is not the case when file permissions get modified via setfacl(1). Add clearing of SGID bit to posix_acl_equiv_mode(). Signed-off-by: Jan Kara --- fs/posix_acl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/posix_acl.c b/fs/posix_acl.c index 0a7c5119ed8d..d714b9216418 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -311,8 +311,12 @@ posix_acl_equiv_mode(struct inode *inode, const struct posix_acl *acl, return -EINVAL; } } - if (mode_p) + if (mode_p) { + if (!in_group_p(inode->i_gid) && + !capable_wrt_inode_uidgid(inode, CAP_FSETID)) + *mode_p &= ~S_ISGID; *mode_p = (*mode_p & ~S_IRWXUGO) | mode; + } return not_equiv; } EXPORT_SYMBOL(posix_acl_equiv_mode); -- 2.6.6