xfs
[Top] [All Lists]

Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting defa

To: Carlos Maiolino <cmaiolino@xxxxxxxxxx>
Subject: Re: [PATCH] xfs: fix sgid inheritance for subdirectories inheriting default acls [V2]
From: Dave Chinner <david@xxxxxxxxxxxxx>
Date: Thu, 20 Jun 2013 09:39:51 +1000
Cc: xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20130619132921.GA5200@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
References: <1371569536-5779-1-git-send-email-cmaiolino@xxxxxxxxxx> <20130618224351.GB29338@dastard> <20130619132921.GA5200@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
User-agent: Mutt/1.5.21 (2010-09-15)
On Wed, Jun 19, 2013 at 10:29:22AM -0300, Carlos Maiolino wrote:
> Hi Dave,
> 
> > > @@ -594,9 +594,10 @@ xfs_setattr_nonsize(
> > >            * The set-user-ID and set-group-ID bits of a file will be
> > >            * cleared upon successful return from chown()
> > >            */
> > > -         if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > -             !capable(CAP_FSETID))
> > > -                 ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > > +         if (!S_ISDIR(inode->i_mode))
> > > +                 if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> > > +                     !capable(CAP_FSETID))
> > > +                         ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
> > 
> > I'm not sure I understand why this is part of this patch - the ACL
> > path does not enter this code branch (ATTR_UID/GID) so it doesn't
> > affect ACL inheritence. So this is some other behavioural change?
> > 
> My apologies to have not commented it.
> 
> During my code surfing to understand the problem, and what places we revoked
> sgid, I found this one, and, based on chmod specifications, we should keep 
> sgid
> on the directory while chmoding it, unless the user explicitly ask for sgid
> removal, otherwise, if chmoding a file, we remove sgid if this isn't specified
> in the new mode. So, I've added a check here to ensure the inode isn't a dir
> before remove the sgid bit.

Does notify_change() or inode_change_ok() handle this appropriately?
i.e. do we even need that code there?

> Should I remove it from the patch?

It's unrelated to the ACL problem, so put it in a separate patch
with it's own commit description ;)

Cheers,

Dave.
-- 
Dave Chinner
david@xxxxxxxxxxxxx

<Prev in Thread] Current Thread [Next in Thread>