Bug 443044 - fix setuid/setgid clearing by knfsd
fix setuid/setgid clearing by knfsd
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity medium
: rc
: ---
Assigned To: Jeff Layton
Martin Jenner
Depends On: 443043
Blocks: 461304
  Show dependency treegraph
Reported: 2008-04-18 08:09 EDT by Jeff Layton
Modified: 2009-05-18 15:31 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-05-18 15:31:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
patch -- revoke both setuid and setgid on uid/gid changes (1.67 KB, patch)
2008-04-23 11:24 EDT, Jeff Layton
no flags Details | Diff

  None (edit)
Description Jeff Layton 2008-04-18 08:09:20 EDT
+++ This bug was initially created as a clone of Bug #443043 +++

I just pushed a couple of patches upstream that we should backport for the next
RHEL updates. I suspect that Bruce will push them for 2.6.26. Here is the
description of the problem:

Currently, knfsd only clears the setuid bit if the owner of a file is
changed on a SETATTR call, and only clears the setgid bit if the group
is changed. POSIX says this in the spec for chown():

    "If the specified file is a regular file, one or more of the
     S_IXUSR, S_IXGRP, or S_IXOTH bits of the file mode are set, and the
     process does not have appropriate privileges, the set-user-ID
     (S_ISUID) and set-group-ID (S_ISGID) bits of the file mode shall
     be cleared upon successful return from chown()."

If I'm reading this correctly, then knfsd is doing this wrong. It should
be clearing both the setuid and setgid bit on any SETATTR that changes
the uid or gid. This wasn't really as noticable before, but now that the
ATTR_KILL_S*ID bits are a no-op for the NFS client, it's more evident.
Comment 1 Jeff Layton 2008-04-23 11:24:03 EDT
Created attachment 303511 [details]
patch -- revoke both setuid and setgid on uid/gid changes
Comment 3 RHEL Product and Program Management 2008-05-02 12:20:48 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
Comment 4 RHEL Product and Program Management 2008-09-03 09:13:34 EDT
Updating PM score.
Comment 5 Vivek Goyal 2008-09-25 09:18:17 EDT
Committed in 78.11.EL . RPMS are available at http://people.redhat.com/vgoyal/rhel4/
Comment 8 errata-xmlrpc 2009-05-18 15:31:28 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.