Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6473a559 authored by Steve French's avatar Steve French
Browse files

[CIFS] Fix missing permission check on setattr when noperm mount option is 


disabled.  Also set mode, uid, gid better on mkdir and create for the
case when Unix Extensions is not enabled and setuids is enabled. This is
necessary to fix the hole in which chown could be allowed for non-root
users in some cases if root mounted, and also to display the mode and uid
properly in some cases.

Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent 3abb9272

fs/cifs/CHANGES

+1 −1
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ stress on writes). Modify cifs Kconfig options to expose CONFIG_CIFS_STATS2 
Fix SFU style symlinks and mknod needed for servers which do not support the

CIFS Unix Extensions.  Fix setfacl/getfacl on bigendian. Timeout negative

dentries so files that the client sees as deleted but that later get created

on the server will be recognized.

on the server will be recognized.  Add client side permission check on setattr.



Version 1.38

------------

fs/cifs/README

+24 −6
Original line number Diff line number Diff line
@@ -278,7 +278,9 @@ A partial list of the supported mount options follows: 
		(such as Windows), permissions can also be checked at the

		client, and a crude form of client side permission checking 

		can be enabled by specifying file_mode and dir_mode on 

		the client

		the client.  Note that the mount.cifs helper must be

		at version 1.10 or higher to support specifying the uid

		(or gid) in non-numberic form.

  gid		If CIFS Unix extensions are not supported by the server

		this overrides the default gid for inodes.

  file_mode     If CIFS Unix extensions are not supported by the server
@@ -345,7 +347,10 @@ A partial list of the supported mount options follows: 
		client system. It is typically only needed when the server

		supports the CIFS Unix Extensions but the UIDs/GIDs on the

		client and server system do not match closely enough to allow

		access by the user doing the mount.

		access by the user doing the mount, but it may be useful with

		non CIFS Unix Extension mounts for cases in which the default

		mode is specified on the mount but is not to be enforced on the

		client (e.g. perhaps when MultiUserMount is enabled)

		Note that this does not affect the normal ACL check on the

		target machine done by the server software (of the server

		ACL against the user name provided at mount time).
@@ -368,15 +373,21 @@ A partial list of the supported mount options follows: 
  setuids       If the CIFS Unix extensions are negotiated with the server

		the client will attempt to set the effective uid and gid of

		the local process on newly created files, directories, and

		devices (create, mkdir, mknod).

		devices (create, mkdir, mknod).  If the CIFS Unix Extensions

		are not negotiated, for newly created files and directories

		instead of using the default uid and gid specified on the

		the mount, cache the new file's uid and gid locally which means

		that the uid for the file can change when the inode is

	        reloaded (or the user remounts the share).

  nosetuids     The client will not attempt to set the uid and gid on

		on newly created files, directories, and devices (create, 

		mkdir, mknod) which will result in the server setting the

		uid and gid to the default (usually the server uid of the

		user who mounted the share).  Letting the server (rather than

		the client) set the uid and gid is the default. This

		parameter has no effect if the CIFS Unix Extensions are not

		negotiated.

		the client) set the uid and gid is the default. If the CIFS

		Unix Extensions are not negotiated then the uid and gid for

		new files will appear to be the uid (gid) of the mounter or the

		uid (gid) parameter specified on the mount.

  netbiosname   When mounting to servers via port 139, specifies the RFC1001

		source name to use to represent the client netbios machine 

		name when doing the RFC1001 netbios session initialize.
@@ -418,6 +429,13 @@ A partial list of the supported mount options follows: 
		byte range locks).

 remount        remount the share (often used to change from ro to rw mounts

	        or vice versa)

 sfu            When the CIFS Unix Extensions are not negotiated, attempt to

		create device files and fifos in a format compatible with

		Services for Unix (SFU).  In addition retrieve bits 10-12

		of the mode via the SETFILEBITS extended attribute (as

		SFU does).  In the future the bottom 9 bits of the mode

		mode also will be emulated using queries of the security

		descriptor (ACL).

		

The mount.cifs mount helper also accepts a few mount options before -o

including:

fs/cifs/TODO

+2 −2
Original line number Diff line number Diff line 
version 1.37 October 9, 2005

Version 1.39 November 30, 2005



A Partial List of Missing Features

==================================
@@ -58,7 +58,7 @@ o) Improve performance of readpages by sending more than one read 
at a time when 8 pages or more are requested. In conjuntion

add support for async_cifs_readpages.



p) Add support for storing symlink and fifo info to Windows servers 

p) Add support for storing symlink info to Windows servers 

in the Extended Attribute format their SFU clients would recognize.



q) Finish fcntl D_NOTIFY support so kde and gnome file list windows

fs/cifs/dir.c

+8 −1
Original line number Diff line number Diff line
@@ -228,8 +228,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode, 
		else {

			rc = cifs_get_inode_info(&newinode, full_path,

						 buf, inode->i_sb,xid);

			if(newinode)

			if(newinode) {

				newinode->i_mode = mode;

				if((oplock & CIFS_CREATE_ACTION) &&

				  (cifs_sb->mnt_cifs_flags & 

				     CIFS_MOUNT_SET_UID)) {

					newinode->i_uid = current->fsuid;

					newinode->i_gid = current->fsgid;

				}

			}

		}



		if (rc != 0) {

fs/cifs/inode.c

+25 −3
Original line number Diff line number Diff line
@@ -768,6 +768,15 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode) 
			/* BB to be implemented via Windows secrty descriptors

			   eg CIFSSMBWinSetPerms(xid, pTcon, full_path, mode,

						 -1, -1, local_nls); */

			if(direntry->d_inode) {

				direntry->d_inode->i_mode = mode;

				if(cifs_sb->mnt_cifs_flags & 

				     CIFS_MOUNT_SET_UID) {

					direntry->d_inode->i_uid = 

						current->fsuid;

					direntry->d_inode->i_gid = 

						current->fsgid;

				}

			}

	}

	kfree(full_path);
@@ -1111,9 +1120,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs) 


	cFYI(1, ("In cifs_setattr, name = %s attrs->iavalid 0x%x ",

		 direntry->d_name.name, attrs->ia_valid));



	cifs_sb = CIFS_SB(direntry->d_inode->i_sb);

	pTcon = cifs_sb->tcon;



	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM == 0) {

		/* check if we have permission to change attrs */

		rc = inode_change_ok(direntry->d_inode, attrs);

		if(rc < 0) {

			FreeXid(xid);

			return rc;

		} else

			rc = 0;

	}

		

	down(&direntry->d_sb->s_vfs_rename_sem);

	full_path = build_path_from_dentry(direntry);

	up(&direntry->d_sb->s_vfs_rename_sem);
@@ -1153,7 +1173,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs) 
						  1 /* 45 seconds */);

				cFYI(1,("Wrt seteof rc %d", rc));

			}

		}

		} else 

			rc = -EINVAL;



		if (rc != 0) {

			/* Set file size by pathname rather than by handle

			   either because no valid, writeable file handle for