Commit a110343f0d6d41f68b7cf8c00b57a3172c67f816
1 parent
7f2da1e7d0
Exists in
master
and in
7 other branches
[PATCH] fix MAY_CHDIR/MAY_ACCESS/LOOKUP_ACCESS mess
* MAY_CHDIR is redundant - it's an equivalent of MAY_ACCESS * MAY_ACCESS on fuse should affect only the last step of pathname resolution * fchdir() and chroot() should pass MAY_ACCESS, for the same reason why chdir() needs that. * now that we pass MAY_ACCESS explicitly in all cases, LOOKUP_ACCESS can be removed; it has no business being in nameidata. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Showing 5 changed files with 7 additions and 11 deletions Side-by-side Diff
fs/fuse/dir.c
... | ... | @@ -962,7 +962,7 @@ |
962 | 962 | exist. So if permissions are revoked this won't be |
963 | 963 | noticed immediately, only after the attribute |
964 | 964 | timeout has expired */ |
965 | - } else if (mask & (MAY_ACCESS | MAY_CHDIR)) { | |
965 | + } else if (mask & MAY_ACCESS) { | |
966 | 966 | err = fuse_access(inode, mask); |
967 | 967 | } else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) { |
968 | 968 | if (!(inode->i_mode & S_IXUGO)) { |
fs/namei.c
fs/open.c
... | ... | @@ -457,11 +457,11 @@ |
457 | 457 | old_cap = cap_set_effective(current->cap_permitted); |
458 | 458 | } |
459 | 459 | |
460 | - res = __user_walk_fd(dfd, filename, LOOKUP_FOLLOW|LOOKUP_ACCESS, &nd); | |
460 | + res = __user_walk_fd(dfd, filename, LOOKUP_FOLLOW, &nd); | |
461 | 461 | if (res) |
462 | 462 | goto out; |
463 | 463 | |
464 | - res = vfs_permission(&nd, mode); | |
464 | + res = vfs_permission(&nd, mode | MAY_ACCESS); | |
465 | 465 | /* SuS v2 requires we report a read only fs too */ |
466 | 466 | if(res || !(mode & S_IWOTH) || |
467 | 467 | special_file(nd.path.dentry->d_inode->i_mode)) |
... | ... | @@ -505,7 +505,7 @@ |
505 | 505 | if (error) |
506 | 506 | goto out; |
507 | 507 | |
508 | - error = vfs_permission(&nd, MAY_EXEC | MAY_CHDIR); | |
508 | + error = vfs_permission(&nd, MAY_EXEC | MAY_ACCESS); | |
509 | 509 | if (error) |
510 | 510 | goto dput_and_out; |
511 | 511 | |
... | ... | @@ -534,7 +534,7 @@ |
534 | 534 | if (!S_ISDIR(inode->i_mode)) |
535 | 535 | goto out_putf; |
536 | 536 | |
537 | - error = file_permission(file, MAY_EXEC); | |
537 | + error = file_permission(file, MAY_EXEC | MAY_ACCESS); | |
538 | 538 | if (!error) |
539 | 539 | set_fs_pwd(current->fs, &file->f_path); |
540 | 540 | out_putf: |
... | ... | @@ -552,7 +552,7 @@ |
552 | 552 | if (error) |
553 | 553 | goto out; |
554 | 554 | |
555 | - error = vfs_permission(&nd, MAY_EXEC); | |
555 | + error = vfs_permission(&nd, MAY_EXEC | MAY_ACCESS); | |
556 | 556 | if (error) |
557 | 557 | goto dput_and_out; |
558 | 558 |
include/linux/fs.h
include/linux/namei.h
... | ... | @@ -53,7 +53,6 @@ |
53 | 53 | */ |
54 | 54 | #define LOOKUP_OPEN (0x0100) |
55 | 55 | #define LOOKUP_CREATE (0x0200) |
56 | -#define LOOKUP_ACCESS (0x0400) | |
57 | 56 | |
58 | 57 | extern int __user_walk(const char __user *, unsigned, struct nameidata *); |
59 | 58 | extern int __user_walk_fd(int dfd, const char __user *, unsigned, struct nameidata *); |