From: shanea@extro.ucc.su.OZ.AU (Shane Alderton) Subject: patch for chmod "bug" Date: 21 Dec 1992 05:45:57 GMT
Linux' chmod currently allows you to set the sgid bit on a file
if you own that file, regardless of whether the file's group is
one of your primary or secondary groups. This can cause security
problems - for example with mail, where you may own your mail
file but it is group owned by mail.
The following patch can be applied relative to 098p6 (and probably
099 - I haven't actually attempted it, but it looked similar enough)
to prevent this occuring.
Please let me know if there is a problem with the way I have done
this - I make no guarantee that it will work for you, but it certainly
solved my problem.
Regards,
Shane Alderton
shanea@extro.ucc.su.oz.au
===== snip snip ========================================================
--- newlinux/linux/fs/open.c Sun Nov 29 22:59:47 1992
+++ linux/fs/open.c Mon Dec 21 15:16:15 1992
@@ -234,4 +234,5 @@
struct inode * inode;
struct file * file;
+ int mask = 07777;
if (fd >= NR_OPEN || !(file = current->filp[fd]))
@@ -243,5 +244,7 @@
if (IS_RDONLY(inode))
return -EROFS;
- inode->i_mode = (mode & 07777) | (inode->i_mode & ~07777);
+ if (!in_group_p(inode->i_gid) && !suser())
+ mask = 05777;
+ inode->i_mode = (mode & mask) | (inode->i_mode & ~mask);
inode->i_dirt = 1;
return notify_change(inode);
@@ -252,4 +255,5 @@
struct inode * inode;
int error;
+ int mask = 07777;
error = namei(filename,&inode);
@@ -264,5 +268,7 @@
return -EROFS;
}
- inode->i_mode = (mode & 07777) | (inode->i_mode & ~07777);
+ if (!in_group_p(inode->i_gid) && !suser())
+ mask = 05777;
+ inode->i_mode = (mode & mask) | (inode->i_mode & ~mask);
inode->i_dirt = 1;
error = notify_change(inode);