Jan Kara 57c9cfdb61 posix_acl: Clear SGID bit when setting file permissions ... commit 073931017b49d9458aa351605b43a7e34598caef upstream. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-10-31 04:13:58 -06:00
..
acl.c	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
acl.h
balloc.c
dir.c
ext2.h
file.c
ialloc.c
inode.c
ioctl.c
Kconfig
Makefile
namei.c
super.c	ext2, ext4: warn when mounting with dax enabled	2015-11-16 09:43:54 -08:00
symlink.c
xattr.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00
xattr.h
xattr_security.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00
xattr_trusted.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00
xattr_user.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00