On 07/12/2017 04:55 AM, Ernesto A. Fernández wrote: > When changing a file's acl mask, __jfs_set_acl() will first set the group > bits of i_mode to the value of the mask, and only then set the actual > extended attribute representing the new acl. > > If the second part fails (due to lack of space, for example) and the file > had no acl attribute to begin with, the system will from now on assume > that the mask permission bits are actual group permission bits, potentially > granting access to the wrong users. > > Prevent this by only changing the inode mode after the acl has been set.
This looks good to me. I'll add it to the jfs queue. Thanks, Shaggy > > Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernan...@gmail.com> > --- > fs/jfs/acl.c | 15 +++++++++++---- > 1 file changed, 11 insertions(+), 4 deletions(-) > > diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c > index 7bc186f..db5a385 100644 > --- a/fs/jfs/acl.c > +++ b/fs/jfs/acl.c > @@ -73,16 +73,17 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, > int type, > int rc; > int size = 0; > char *value = NULL; > + int update_mode = 0; > + umode_t mode = inode->i_mode; > > switch (type) { > case ACL_TYPE_ACCESS: > ea_name = XATTR_NAME_POSIX_ACL_ACCESS; > if (acl) { > - rc = posix_acl_update_mode(inode, &inode->i_mode, &acl); > + rc = posix_acl_update_mode(inode, &mode, &acl); > if (rc) > return rc; > - inode->i_ctime = current_time(inode); > - mark_inode_dirty(inode); > + update_mode = 1; > } > break; > case ACL_TYPE_DEFAULT: > @@ -105,8 +106,14 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, > int type, > out: > kfree(value); > > - if (!rc) > + if (!rc) { > set_cached_acl(inode, type, acl); > + if (update_mode) { > + inode->i_mode = mode; > + inode->i_ctime = current_time(inode); > + mark_inode_dirty(inode); > + } > + } > > return rc; > } > ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Jfs-discussion mailing list Jfs-discussion@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jfs-discussion