Prev: [032/145] idr: fix a critical misallocation bug, take#2
Next: [033/145] Switch proc/self to nd_set_link()
From: Greg KH on 12 Mar 2010 20:00
2.6.32-stable review patch. If anyone has any objections, please let me know.

----------------
From: Kay Sievers <kay.sievers(a)vrfy.org>

commit 5e31d76f2817bd50258a092a7c5b15b3006fd61c upstream.

Before unlinking the inode, reset the current permissions of possible
references like hardlinks, so granted permissions can not be retained
across the device lifetime by creating hardlinks, in the unusual case
that there is a user-writable directory on the same filesystem.

Signed-off-by: Kay Sievers <kay.sievers(a)vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
drivers/base/devtmpfs.c | 13 +++++++++++++
1 file changed, 13 insertions(+)

--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -295,6 +295,19 @@ int devtmpfs_delete_node(struct device *
if (dentry->d_inode) {
err = vfs_getattr(nd.path.mnt, dentry, &stat);
if (!err && dev_mynode(dev, dentry->d_inode, &stat)) {
+ struct iattr newattrs;
+ /*
+ * before unlinking this node, reset permissions
+ * of possible references like hardlinks
+ */
+ newattrs.ia_uid = 0;
+ newattrs.ia_gid = 0;
+ newattrs.ia_mode = stat.mode & ~0777;
+ newattrs.ia_valid =
+ ATTR_UID|ATTR_GID|ATTR_MODE;
+ mutex_lock(&dentry->d_inode->i_mutex);
+ notify_change(dentry, &newattrs);
+ mutex_unlock(&dentry->d_inode->i_mutex);
err = vfs_unlink(nd.path.dentry->d_inode,
dentry);
if (!err || err == -ENOENT)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [032/145] idr: fix a critical misallocation bug, take#2
Next: [033/145] Switch proc/self to nd_set_link()