FAILED: patch "[PATCH] ceph: fix up non-directory creation in SGID directories" failed to apply to 5.10-stable tree
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From fd84bfdddd169c219c3a637889a8b87f70a072c2 Mon Sep 17 00:00:00 2001
From: Christian Brauner christian.brauner@ubuntu.com Date: Mon, 29 Nov 2021 12:16:39 +0100 Subject: [PATCH] ceph: fix up non-directory creation in SGID directories
Ceph always inherits the SGID bit if it is set on the parent inode, while the generic inode_init_owner does not do this in a few cases where it can create a possible security problem (cf. [1]).
Update ceph to strip the SGID bit just as inode_init_owner would.
This bug was detected by the mapped mount testsuite in [3]. The testsuite tests all core VFS functionality and semantics with and without mapped mounts. That is to say it functions as a generic VFS testsuite in addition to a mapped mount testsuite. While working on mapped mount support for ceph, SIGD inheritance was the only failing test for ceph after the port.
The same bug was detected by the mapped mount testsuite in XFS in January 2021 (cf. [2]).
[1]: commit 0fa3ecd87848 ("Fix up non-directory creation in SGID directories") [2]: commit 01ea173e103e ("xfs: fix up non-directory creation in SGID directories") [3]: https://git.kernel.org/fs/xfs/xfstests-dev.git
Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner christian.brauner@ubuntu.com Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Ilya Dryomov idryomov@gmail.com
diff --git a/fs/ceph/file.c b/fs/ceph/file.c index b24442e27e4e..c138e8126286 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -605,13 +605,25 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry, in.cap.realm = cpu_to_le64(ci->i_snap_realm->ino); in.cap.flags = CEPH_CAP_FLAG_AUTH; in.ctime = in.mtime = in.atime = iinfo.btime; - in.mode = cpu_to_le32((u32)mode); in.truncate_seq = cpu_to_le32(1); in.truncate_size = cpu_to_le64(-1ULL); in.xattr_version = cpu_to_le64(1); in.uid = cpu_to_le32(from_kuid(&init_user_ns, current_fsuid())); - in.gid = cpu_to_le32(from_kgid(&init_user_ns, dir->i_mode & S_ISGID ? - dir->i_gid : current_fsgid())); + if (dir->i_mode & S_ISGID) { + in.gid = cpu_to_le32(from_kgid(&init_user_ns, dir->i_gid)); + + /* Directories always inherit the setgid bit. */ + if (S_ISDIR(mode)) + mode |= S_ISGID; + else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && + !in_group_p(dir->i_gid) && + !capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID)) + mode &= ~S_ISGID; + } else { + in.gid = cpu_to_le32(from_kgid(&init_user_ns, current_fsgid())); + } + in.mode = cpu_to_le32((u32)mode); + in.nlink = cpu_to_le32(1); in.max_size = cpu_to_le64(lo->stripe_unit);
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
Thanks! Christian
On Fri, Dec 17, 2021 at 03:23:01PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
It fails to build :(
On Fri, 2021-12-17 at 16:04 +0100, Greg KH wrote:
On Fri, Dec 17, 2021 at 03:23:01PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
It fails to build :(
I think the issue is probably that capable_wrt_inode_uidgid in kernels of that era didn't take a userns arg. I had to do a similar fixup for the RHEL8 backport.
On Fri, Dec 17, 2021 at 10:55:23AM -0500, Jeff Layton wrote:
On Fri, 2021-12-17 at 16:04 +0100, Greg KH wrote:
On Fri, Dec 17, 2021 at 03:23:01PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
It fails to build :(
I think the issue is probably that capable_wrt_inode_uidgid in kernels of that era didn't take a userns arg. I had to do a similar fixup for the RHEL8 backport.
Yes, I think this is:
diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 5eddee27a688..8ed881fd7440 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -615,7 +615,7 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry, mode |= S_ISGID; else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && !in_group_p(dir->i_gid) && - !capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID)) + !capable_wrt_inode_uidgid(dir, CAP_FSETID)) mode &= ~S_ISGID; } else { in.gid = cpu_to_le32(from_kgid(&init_user_ns, current_fsgid()));
on top of my patch.
Thanks! Christian
On Fri, Dec 17, 2021 at 04:57:58PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 10:55:23AM -0500, Jeff Layton wrote:
On Fri, 2021-12-17 at 16:04 +0100, Greg KH wrote:
On Fri, Dec 17, 2021 at 03:23:01PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
It fails to build :(
I think the issue is probably that capable_wrt_inode_uidgid in kernels of that era didn't take a userns arg. I had to do a similar fixup for the RHEL8 backport.
Yes, I think this is:
diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 5eddee27a688..8ed881fd7440 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -615,7 +615,7 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry, mode |= S_ISGID; else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && !in_group_p(dir->i_gid) &&
!capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID))
!capable_wrt_inode_uidgid(dir, CAP_FSETID)) mode &= ~S_ISGID; } else { in.gid = cpu_to_le32(from_kgid(&init_user_ns, current_fsgid()));on top of my patch.
Can someone submit this in a format that I can apply it in?
thanks,
greg k-h
On Mon, Dec 20, 2021 at 11:52:09AM +0100, Greg KH wrote:
On Fri, Dec 17, 2021 at 04:57:58PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 10:55:23AM -0500, Jeff Layton wrote:
On Fri, 2021-12-17 at 16:04 +0100, Greg KH wrote:
On Fri, Dec 17, 2021 at 03:23:01PM +0100, Christian Brauner wrote:
On Fri, Dec 17, 2021 at 02:51:46PM +0100, gregkh@linuxfoundation.org wrote:
The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Oh? I just applied the patch on top of:
commit 272aedd4a305 ("Linux 5.10.87")
without any issues. Not sure what failed for you.
It fails to build :(
I think the issue is probably that capable_wrt_inode_uidgid in kernels of that era didn't take a userns arg. I had to do a similar fixup for the RHEL8 backport.
Yes, I think this is:
diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 5eddee27a688..8ed881fd7440 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -615,7 +615,7 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry, mode |= S_ISGID; else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && !in_group_p(dir->i_gid) &&
!capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID))
!capable_wrt_inode_uidgid(dir, CAP_FSETID)) mode &= ~S_ISGID; } else { in.gid = cpu_to_le32(from_kgid(&init_user_ns, current_fsgid()));on top of my patch.
Can someone submit this in a format that I can apply it in?
You should've gotten a mail: https://lore.kernel.org/stable/20211223095733.587981-1-brauner@kernel.org
I'm alredy on holidays so only checking my mails sporadically, sorry!
linux-stable-mirror@lists.linaro.org
-
Christian Brauner -
Greg KH -
gregkh＠linuxfoundation.org
-
Jeff Layton