Atenção usuários de ZFS...
---------- Forwarded message ---------- From: Pawel Jakub Dawidek <[email protected]> Date: Tue, Nov 10, 2009 at 8:45 PM Subject: HEADS UP: Important bug fix in ZFS replay code! To: [email protected] Cc: [email protected] Hi. There was important bug in ZFS replay code. If there were setattr logs (not related to permission change) in ZIL during unclean shutdown, one can end up with files that have mode set to 07777. This is very dangerous, especially if you have untrusted local users, as this will set setuid bit on such files. Note that FreeBSD will remove setuid bits when someone will try to modify the file, but it is still dangerous. You can locate such files with the following command: # find / -perm -7777 -print0 | xargs -0 ls -ld You can locate and fix such files with the following command: # find / -perm -7777 -print0 | xargs -0 chmod a-s,o-w,-t On Tue, Nov 10, 2009 at 10:27:33PM +0000, Pawel Jakub Dawidek wrote: > Author: pjd > Date: Tue Nov 10 22:27:33 2009 > New Revision: 199157 > URL: http://svn.freebsd.org/changeset/base/199157 > > Log: > Be careful which vattr fields are set during setattr replay. > Without this fix strange things can appear after unclean shutdown like > files with mode set to 07777. > > Reported by: des > MFC after: 3 days > > Modified: > head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c > > Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c > ============================================================================== > --- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c Tue Nov > 10 22:25:46 2009 (r199156) > +++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c Tue Nov > 10 22:27:33 2009 (r199157) > @@ -60,10 +60,14 @@ zfs_init_vattr(vattr_t *vap, uint64_t ma > { > VATTR_NULL(vap); > vap->va_mask = (uint_t)mask; > - vap->va_type = IFTOVT(mode); > - vap->va_mode = mode & MODEMASK; > - vap->va_uid = (uid_t)(IS_EPHEMERAL(uid)) ? -1 : uid; > - vap->va_gid = (gid_t)(IS_EPHEMERAL(gid)) ? -1 : gid; > + if (mask & AT_TYPE) > + vap->va_type = IFTOVT(mode); > + if (mask & AT_MODE) > + vap->va_mode = mode & MODEMASK; > + if (mask & AT_UID) > + vap->va_uid = (uid_t)(IS_EPHEMERAL(uid)) ? -1 : uid; > + if (mask & AT_GID) > + vap->va_gid = (gid_t)(IS_EPHEMERAL(gid)) ? -1 : gid; > vap->va_rdev = zfs_cmpldev(rdev); > vap->va_nodeid = nodeid; > } -- Pawel Jakub Dawidek http://www.wheel.pl [email protected] http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am! -- Renato Botelho
pgpxNtSu6XQar.pgp
Description: PGP signature
------------------------- Histórico: http://www.fug.com.br/historico/html/freebsd/ Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
