Description of problem: setuid() sets the effective user ID of the calling process. If the effective UID of the caller is root, the real UID and saved set-user-ID are also set. On success, zero is returned. On error, -1 is returned, and errno is set appropriately. Note: there are cases where setuid() can fail even when the caller is UID 0; it is a grave security error to omit checking for a failure return from setuid(). if an environment limits the number of processes a user can have, setuid() might fail if the target uid already is at the limit. Version-Release number of selected component (if applicable): mainline
REVIEW: http://review.gluster.org/10780 (fuse: fix return value check for setuid) posted (#1) for review on master by Prasanna Kumar Kalever
REVIEW: http://review.gluster.org/10780 (fuse: fix return value check for setuid) posted (#2) for review on master by Prasanna Kumar Kalever
Assigning the bug to the owner of the patch, and moving the status to POST. Please do so for your own patches next time.
REVIEW: http://review.gluster.org/10780 (fuse: fix return value check for setuid) posted (#3) for review on master by Prasanna Kumar Kalever
COMMIT: http://review.gluster.org/10780 committed in master by Niels de Vos (ndevos) ------ commit b5ceb1a9de9af563b0f91e2a3138fa5a95cad9f6 Author: Prasanna Kumar Kalever <prasanna.kalever> Date: Thu May 14 12:10:01 2015 +0530 fuse: fix return value check for setuid setuid() sets the effective user ID of the calling process. If the effective UID of the caller is root, the real UID and saved set-user-ID are also set. On success, zero is returned. On error, -1 is returned, and errno is set appropriately. there are cases where setuid() can fail even when the caller is UID 0; it is a grave security error to omit checking for a failure return from setuid(). if an environment limits the number of processes a user can have, setuid() might fail if the target uid already is at the limit. Fix is to check return value of setuid. Change-Id: I7aa5ab5e347603c69dc93188417cc4f4c81ffc75 BUG: 1221490 Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever> Reviewed-on: http://review.gluster.org/10780 Reviewed-by: Prasanna Kumar Kalever Tested-by: Prasanna Kumar Kalever Reviewed-by: Niels de Vos <ndevos> Tested-by: Gluster Build System <jenkins.com> Reviewed-by: Gaurav Kumar Garg <ggarg>
Fix for this BZ is already present in a GlusterFS release. You can find clone of this BZ, fixed in a GlusterFS release and closed. Hence closing this mainline BZ as well.
This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-3.8.0, please open a new bug report. glusterfs-3.8.0 has been announced on the Gluster mailinglists [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution. [1] http://blog.gluster.org/2016/06/glusterfs-3-8-released/ [2] http://thread.gmane.org/gmane.comp.file-systems.gluster.user