From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
To: brauner@kernel.org, chuck.lever@oracle.com, bfields@fieldses.org,
stable@vger.kernel.org, linux-nfs@vger.kernel.org
Cc: gregkh@linuxfoundation.org, hch@lst.de, jlayton@kernel.org,
vegard.nossum@oracle.com, naresh.kamboju@linaro.org,
Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Subject: [PATCH 6.1.y 1/2] nfs: use vfs setgid helper
Date: Fri, 25 Aug 2023 09:16:02 -0700 [thread overview]
Message-ID: <20230825161603.371792-2-harshit.m.mogalapalli@oracle.com> (raw)
In-Reply-To: <20230825161603.371792-1-harshit.m.mogalapalli@oracle.com>
From: Christian Brauner <brauner@kernel.org>
commit 4f704d9a8352f5c0a8fcdb6213b934630342bd44 upstream.
We've aligned setgid behavior over multiple kernel releases. The details
can be found in the following two merge messages:
cf619f891971 ("Merge tag 'fs.ovl.setgid.v6.2')
426b4ca2d6a5 ("Merge tag 'fs.setgid.v6.0')
Consistent setgid stripping behavior is now encapsulated in the
setattr_should_drop_sgid() helper which is used by all filesystems that
strip setgid bits outside of vfs proper. Switch nfs to rely on this
helper as well. Without this patch the setgid stripping tests in
xfstests will fail.
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Message-Id: <20230313-fs-nfs-setgid-v2-1-9a59f436cfc0@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
[Harshit: backport to 6.1.y]
Conflicts:
fs/internal.h -- minor conflict due to code change differences.
include/linux/fs.h -- Used struct user_namespace *mnt_userns
instead of struct mnt_idmap *idmap
fs/nfs/inode.c -- Used init_user_ns instead of nop_mnt_idmap
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
fs/attr.c | 1 +
fs/internal.h | 2 --
fs/nfs/inode.c | 4 +---
include/linux/fs.h | 2 ++
4 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/fs/attr.c b/fs/attr.c
index b45f30e516fa..9b9a70e0cc54 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -47,6 +47,7 @@ int setattr_should_drop_sgid(struct user_namespace *mnt_userns,
return ATTR_KILL_SGID;
return 0;
}
+EXPORT_SYMBOL(setattr_should_drop_sgid);
/**
* setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to
diff --git a/fs/internal.h b/fs/internal.h
index 46caa33373a4..42df013f7fe7 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -242,5 +242,3 @@ ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *po
/*
* fs/attr.c
*/
-int setattr_should_drop_sgid(struct user_namespace *mnt_userns,
- const struct inode *inode);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6b2cfa59a1a2..e0c1fb98f907 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -717,9 +717,7 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr,
if ((attr->ia_valid & ATTR_KILL_SUID) != 0 &&
inode->i_mode & S_ISUID)
inode->i_mode &= ~S_ISUID;
- if ((attr->ia_valid & ATTR_KILL_SGID) != 0 &&
- (inode->i_mode & (S_ISGID | S_IXGRP)) ==
- (S_ISGID | S_IXGRP))
+ if (setattr_should_drop_sgid(&init_user_ns, inode))
inode->i_mode &= ~S_ISGID;
if ((attr->ia_valid & ATTR_MODE) != 0) {
int mode = attr->ia_mode & S_IALLUGO;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a2b5592c6828..26ea1a0a59a1 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -3120,6 +3120,8 @@ extern struct inode *new_inode(struct super_block *sb);
extern void free_inode_nonrcu(struct inode *inode);
extern int setattr_should_drop_suidgid(struct user_namespace *, struct inode *);
extern int file_remove_privs(struct file *);
+int setattr_should_drop_sgid(struct user_namespace *mnt_userns,
+ const struct inode *inode);
/*
* This must be used for allocating filesystems specific inodes to set
--
2.34.1
next prev parent reply other threads:[~2023-08-25 16:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-25 16:16 [PATCH 6.1.y 0/2] Address ltp nfs test failure Harshit Mogalapalli
2023-08-25 16:16 ` Harshit Mogalapalli [this message]
2023-08-25 16:16 ` [PATCH 6.1.y 2/2] nfsd: use vfs setgid helper Harshit Mogalapalli
2023-08-25 23:11 ` [PATCH 6.1.y 0/2] Address ltp nfs test failure Daniel Díaz
2023-08-26 10:00 ` Harshit Mogalapalli
2023-08-27 7:57 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230825161603.371792-2-harshit.m.mogalapalli@oracle.com \
--to=harshit.m.mogalapalli@oracle.com \
--cc=bfields@fieldses.org \
--cc=brauner@kernel.org \
--cc=chuck.lever@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=hch@lst.de \
--cc=jlayton@kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=naresh.kamboju@linaro.org \
--cc=stable@vger.kernel.org \
--cc=vegard.nossum@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).