tree 1c59d4d47df600147f2e90a947cb82c1f57003ba
parent 31051c85b5e2aaaf6315f74c72a732673632a905
author Jan Kara <jack@suse.cz> 1464276092 +0200
committer Jan Kara <jack@suse.cz> 1474534579 +0200

fs: Avoid premature clearing of capabilities

Currently, notify_change() clears capabilities or IMA attributes by
calling security_inode_killpriv() before calling into ->setattr. Thus it
happens before any other permission checks in inode_change_ok() and user
is thus allowed to trigger clearing of capabilities or IMA attributes
for any file he can look up e.g. by calling chown for that file. This is
unexpected and can lead to user DoSing a system.

Fix the problem by calling security_inode_killpriv() at the end of
inode_change_ok() instead of from notify_change(). At that moment we are
sure user has permissions to do the requested change.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>