d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't allow non-owner to set SUID bit on a file. It doesn't make

Browse Source 
any difference now, but in NFSv4 ACLs, there is write_acl permission,
which also affects mode changes.

Reviewed by:	pjd
This commit is contained in:
Edward Tomasz Napierala 2009-05-24 19:21:49 +00:00
parent c1edc4480e
commit 4076aa37dc
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/cddl/compat/opensolaris/kern/opensolaris_policy.c
View File

@ -302,6 +302,14 @@ secpolicy_setid_setsticky_clear(struct vnode *vp, struct vattr *vap,
if (error)
return (error);
}
/*
* Deny setting setuid if we are not the file owner.
*/
if ((vap->va_mode & S_ISUID) && ovap->va_uid != cred->cr_uid) {
error = priv_check_cred(cred, PRIV_VFS_ADMIN, 0);
if (error)
return (error);
}
return (0);
}