xfs: fix up non-directory creation in SGID directories

commit dd9241e55aaeab7fe40a1dd1f386b9c03ff521fe upstream.

XFS always inherits the SGID bit if it is set on the parent inode, while
the generic inode_init_owner does not do this in a few cases where it can
create a possible security problem, see commit b7c7b802a3ed
("Fix up non-directory creation in SGID directories") for details.

Switch XFS to use the generic helper for the normal path to fix this,
just keeping the simple field inheritance open coded for the case of the
non-sgid case with the bsdgrpid mount option.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Chandan Babu R <chandan.babu@oracle.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 6bc565c186cac58b1cf06d78d582300eff9b769a..568a9332efd29d4ab716c96bafd180c166aaf800 100644 (file)
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -750,6 +750,7 @@ xfs_ialloc(
        xfs_buf_t       **ialloc_context,
        xfs_inode_t     **ipp)
 {
+       struct inode    *dir = pip ? VFS_I(pip) : NULL;
        struct xfs_mount *mp = tp->t_mountp;
        xfs_ino_t       ino;
        xfs_inode_t     *ip;
@@ -795,18 +796,17 @@ xfs_ialloc(
                return error;
        ASSERT(ip != NULL);
        inode = VFS_I(ip);
-       inode->i_mode = mode;
        set_nlink(inode, nlink);
-       inode->i_uid = current_fsuid();
        inode->i_rdev = rdev;
        ip->i_d.di_projid = prid;
 
-       if (pip && XFS_INHERIT_GID(pip)) {
-               inode->i_gid = VFS_I(pip)->i_gid;
-               if ((VFS_I(pip)->i_mode & S_ISGID) && S_ISDIR(mode))
-                       inode->i_mode |= S_ISGID;
+       if (dir && !(dir->i_mode & S_ISGID) &&
+           (mp->m_flags & XFS_MOUNT_GRPID)) {
+               inode->i_uid = current_fsuid();
+               inode->i_gid = dir->i_gid;
+               inode->i_mode = mode;
        } else {
-               inode->i_gid = current_fsgid();
+               inode_init_owner(inode, dir, mode);
        }
 
        /*