d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In ufs_chmod(), use privilege only when required in the following

Browse Source 
cases:

- Setting sticky bit on non-directory
- Setting setgid on a file with a group that isn't in the effective
  or extended groups of the authorizing credential

I.e., test the requirement first, then do the privilege test,
rather than doing the privilege test regardless of the need for
privilege.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2003-08-04 00:31:01 +00:00
parent f19fc5d8b3
commit 7942b925b8
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/ufs/ufs/ufs_vnops.c
View File

@ -645,13 +645,17 @@ ufs_chmod(vp, mode, cred, td)
/*
* Privileged processes may set the sticky bit on non-directories,
* as well as set the setgid bit on a file with a group that the
* process is not a member of.
* process is not a member of. Both of these are allowed in
* jail(8).
*/
if (suser_cred(cred, PRISON_ROOT)) {
if (vp->v_type != VDIR && (mode & S_ISTXT))
if (vp->v_type != VDIR && (mode & S_ISTXT)) {
if (suser_cred(cred, PRISON_ROOT))
return (EFTYPE);
if (!groupmember(ip->i_gid, cred) && (mode & ISGID))
return (EPERM);
}
if (!groupmember(ip->i_gid, cred) && (mode & ISGID)) {
error = suser_cred(cred, PRISON_ROOT);
if (error)
return (error);
}
ip->i_mode &= ~ALLPERMS;
ip->i_mode |= (mode & ALLPERMS);