public inbox for linux-xfs@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
@ 2013-06-18 15:32 Carlos Maiolino
  2013-06-18 22:43 ` Dave Chinner
  0 siblings, 1 reply; 5+ messages in thread
From: Carlos Maiolino @ 2013-06-18 15:32 UTC (permalink / raw)
  To: xfs

XFS removes sgid bits of subdirectories under a directory containing a default
acl.

When a default acl is set, it implies xfs to call xfs_setattr_nonsize() in its
code path. Such function is shared among mkdir and chmod system calls, and
does some checks unneeded by mkdir (calling inode_change_ok()). Such checks
remove sgid bit from the inode after it has been granted.

With this patch, we extend the meaning of XFS_ATTR_NOACL flag to avoid these
checks when acls are being inherited (thanks hch).

Also, xfs_setattr_mode, doesn't need to re-check for group id and capabilities
permissions, this only implies in another try to remove sgid bit from the
directories. Such check is already done either on inode_change_ok() or
xfs_setattr_nonsize().

Changelog:

V2: Extends the meaning of XFS_ATTR_NOACL instead of wrap the tests into another
    function

Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
---
 fs/xfs/xfs_iops.c |   27 ++++++++++++++-------------
 1 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ca9ecaa..3547d89 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -467,9 +467,6 @@ xfs_setattr_mode(
 	ASSERT(tp);
 	ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
 
-	if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
-		mode &= ~S_ISGID;
-
 	ip->i_d.di_mode &= S_IFMT;
 	ip->i_d.di_mode |= mode & ~S_IFMT;
 
@@ -495,15 +492,18 @@ xfs_setattr_nonsize(
 
 	trace_xfs_setattr(ip);
 
-	if (mp->m_flags & XFS_MOUNT_RDONLY)
-		return XFS_ERROR(EROFS);
+	/* If acls are being inherited, we already have this checked */
+	if (!(flags & XFS_ATTR_NOACL)) {
+		if (mp->m_flags & XFS_MOUNT_RDONLY)
+			return XFS_ERROR(EROFS);
 
-	if (XFS_FORCED_SHUTDOWN(mp))
-		return XFS_ERROR(EIO);
+		if (XFS_FORCED_SHUTDOWN(mp))
+			return XFS_ERROR(EIO);
 
-	error = -inode_change_ok(inode, iattr);
-	if (error)
-		return XFS_ERROR(error);
+		error = -inode_change_ok(inode, iattr);
+		if (error)
+			return XFS_ERROR(error);
+	}
 
 	ASSERT((mask & ATTR_SIZE) == 0);
 
@@ -594,9 +594,10 @@ xfs_setattr_nonsize(
 		 * The set-user-ID and set-group-ID bits of a file will be
 		 * cleared upon successful return from chown()
 		 */
-		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
-		    !capable(CAP_FSETID))
-			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
+		if (!S_ISDIR(inode->i_mode))
+			if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
+			    !capable(CAP_FSETID))
+				ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
 
 		/*
 		 * Change the ownerships and register quota modifications
-- 
1.7.1

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
  2013-06-18 15:32 [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2] Carlos Maiolino
@ 2013-06-18 22:43 ` Dave Chinner
  2013-06-19 13:29   ` Carlos Maiolino
  0 siblings, 1 reply; 5+ messages in thread
From: Dave Chinner @ 2013-06-18 22:43 UTC (permalink / raw)
  To: Carlos Maiolino; +Cc: xfs

On Tue, Jun 18, 2013 at 12:32:16PM -0300, Carlos Maiolino wrote:
> XFS removes sgid bits of subdirectories under a directory containing a default
> acl.
> 
> When a default acl is set, it implies xfs to call xfs_setattr_nonsize() in its
> code path. Such function is shared among mkdir and chmod system calls, and
> does some checks unneeded by mkdir (calling inode_change_ok()). Such checks
> remove sgid bit from the inode after it has been granted.
> 
> With this patch, we extend the meaning of XFS_ATTR_NOACL flag to avoid these
> checks when acls are being inherited (thanks hch).
> 
> Also, xfs_setattr_mode, doesn't need to re-check for group id and capabilities
> permissions, this only implies in another try to remove sgid bit from the
> directories. Such check is already done either on inode_change_ok() or
> xfs_setattr_nonsize().
> 
> Changelog:
> 
> V2: Extends the meaning of XFS_ATTR_NOACL instead of wrap the tests into another
>     function
> 
> Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
> ---
>  fs/xfs/xfs_iops.c |   27 ++++++++++++++-------------
>  1 files changed, 14 insertions(+), 13 deletions(-)
> 
> diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
> index ca9ecaa..3547d89 100644
> --- a/fs/xfs/xfs_iops.c
> +++ b/fs/xfs/xfs_iops.c
> @@ -467,9 +467,6 @@ xfs_setattr_mode(
>  	ASSERT(tp);
>  	ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
>  
> -	if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
> -		mode &= ~S_ISGID;
> -
>  	ip->i_d.di_mode &= S_IFMT;
>  	ip->i_d.di_mode |= mode & ~S_IFMT;
>  
> @@ -495,15 +492,18 @@ xfs_setattr_nonsize(
>  
>  	trace_xfs_setattr(ip);
>  
> -	if (mp->m_flags & XFS_MOUNT_RDONLY)
> -		return XFS_ERROR(EROFS);
> +	/* If acls are being inherited, we already have this checked */
> +	if (!(flags & XFS_ATTR_NOACL)) {
> +		if (mp->m_flags & XFS_MOUNT_RDONLY)
> +			return XFS_ERROR(EROFS);
>  
> -	if (XFS_FORCED_SHUTDOWN(mp))
> -		return XFS_ERROR(EIO);
> +		if (XFS_FORCED_SHUTDOWN(mp))
> +			return XFS_ERROR(EIO);

I'd leave the RO and shutdown checks outside the NOACL branch...

>  
> -	error = -inode_change_ok(inode, iattr);
> -	if (error)
> -		return XFS_ERROR(error);
> +		error = -inode_change_ok(inode, iattr);
> +		if (error)
> +			return XFS_ERROR(error);
> +	}
>  
>  	ASSERT((mask & ATTR_SIZE) == 0);
>  
> @@ -594,9 +594,10 @@ xfs_setattr_nonsize(
>  		 * The set-user-ID and set-group-ID bits of a file will be
>  		 * cleared upon successful return from chown()
>  		 */
> -		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> -		    !capable(CAP_FSETID))
> -			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> +		if (!S_ISDIR(inode->i_mode))
> +			if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> +			    !capable(CAP_FSETID))
> +				ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);

I'm not sure I understand why this is part of this patch - the ACL
path does not enter this code branch (ATTR_UID/GID) so it doesn't
affect ACL inheritence. So this is some other behavioural change?

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
  2013-06-18 22:43 ` Dave Chinner
@ 2013-06-19 13:29   ` Carlos Maiolino
  2013-06-19 23:39     ` Dave Chinner
  0 siblings, 1 reply; 5+ messages in thread
From: Carlos Maiolino @ 2013-06-19 13:29 UTC (permalink / raw)
  To: Dave Chinner; +Cc: xfs

Hi Dave,

> > @@ -594,9 +594,10 @@ xfs_setattr_nonsize(
> >  		 * The set-user-ID and set-group-ID bits of a file will be
> >  		 * cleared upon successful return from chown()
> >  		 */
> > -		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > -		    !capable(CAP_FSETID))
> > -			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > +		if (!S_ISDIR(inode->i_mode))
> > +			if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > +			    !capable(CAP_FSETID))
> > +				ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> 
> I'm not sure I understand why this is part of this patch - the ACL
> path does not enter this code branch (ATTR_UID/GID) so it doesn't
> affect ACL inheritence. So this is some other behavioural change?
> 
My apologies to have not commented it.

During my code surfing to understand the problem, and what places we revoked
sgid, I found this one, and, based on chmod specifications, we should keep sgid
on the directory while chmoding it, unless the user explicitly ask for sgid
removal, otherwise, if chmoding a file, we remove sgid if this isn't specified
in the new mode. So, I've added a check here to ensure the inode isn't a dir
before remove the sgid bit.

Should I remove it from the patch?
> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@fromorbit.com

-- 
Carlos

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
  2013-06-19 13:29   ` Carlos Maiolino
@ 2013-06-19 23:39     ` Dave Chinner
  2013-06-21 17:48       ` Carlos Maiolino
  0 siblings, 1 reply; 5+ messages in thread
From: Dave Chinner @ 2013-06-19 23:39 UTC (permalink / raw)
  To: Carlos Maiolino; +Cc: xfs

On Wed, Jun 19, 2013 at 10:29:22AM -0300, Carlos Maiolino wrote:
> Hi Dave,
> 
> > > @@ -594,9 +594,10 @@ xfs_setattr_nonsize(
> > >  		 * The set-user-ID and set-group-ID bits of a file will be
> > >  		 * cleared upon successful return from chown()
> > >  		 */
> > > -		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > -		    !capable(CAP_FSETID))
> > > -			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > > +		if (!S_ISDIR(inode->i_mode))
> > > +			if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > +			    !capable(CAP_FSETID))
> > > +				ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > 
> > I'm not sure I understand why this is part of this patch - the ACL
> > path does not enter this code branch (ATTR_UID/GID) so it doesn't
> > affect ACL inheritence. So this is some other behavioural change?
> > 
> My apologies to have not commented it.
> 
> During my code surfing to understand the problem, and what places we revoked
> sgid, I found this one, and, based on chmod specifications, we should keep sgid
> on the directory while chmoding it, unless the user explicitly ask for sgid
> removal, otherwise, if chmoding a file, we remove sgid if this isn't specified
> in the new mode. So, I've added a check here to ensure the inode isn't a dir
> before remove the sgid bit.

Does notify_change() or inode_change_ok() handle this appropriately?
i.e. do we even need that code there?

> Should I remove it from the patch?

It's unrelated to the ACL problem, so put it in a separate patch
with it's own commit description ;)

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
  2013-06-19 23:39     ` Dave Chinner
@ 2013-06-21 17:48       ` Carlos Maiolino
  0 siblings, 0 replies; 5+ messages in thread
From: Carlos Maiolino @ 2013-06-21 17:48 UTC (permalink / raw)
  To: Dave Chinner; +Cc: xfs

Thanks for the Review Dave, Patch V3 sent to ML

cheers
> On Wed, Jun 19, 2013 at 10:29:22AM -0300, Carlos Maiolino wrote:
> > Hi Dave,
> > 
> > > > @@ -594,9 +594,10 @@ xfs_setattr_nonsize(
> > > >  		 * The set-user-ID and set-group-ID bits of a file will be
> > > >  		 * cleared upon successful return from chown()
> > > >  		 */
> > > > -		if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > > -		    !capable(CAP_FSETID))
> > > > -			ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > > > +		if (!S_ISDIR(inode->i_mode))
> > > > +			if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > > +			    !capable(CAP_FSETID))
> > > > +				ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > > 
> > > I'm not sure I understand why this is part of this patch - the ACL
> > > path does not enter this code branch (ATTR_UID/GID) so it doesn't
> > > affect ACL inheritence. So this is some other behavioural change?
> > > 
> > My apologies to have not commented it.
> > 
> > During my code surfing to understand the problem, and what places we revoked
> > sgid, I found this one, and, based on chmod specifications, we should keep sgid
> > on the directory while chmoding it, unless the user explicitly ask for sgid
> > removal, otherwise, if chmoding a file, we remove sgid if this isn't specified
> > in the new mode. So, I've added a check here to ensure the inode isn't a dir
> > before remove the sgid bit.
> 

-- 
Carlos

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-06-21 17:48 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-18 15:32 [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2] Carlos Maiolino
2013-06-18 22:43 ` Dave Chinner
2013-06-19 13:29   ` Carlos Maiolino
2013-06-19 23:39     ` Dave Chinner
2013-06-21 17:48       ` Carlos Maiolino

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox