Bug 461444 - kernel: security: filesystem capabilities: fix fragile setuid fixup code [mrg-1]
kernel: security: filesystem capabilities: fix fragile setuid fixup code [mrg-1]
Status: CLOSED NOTABUG
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: realtime-kernel (Show other bugs)
1.1
All Linux
medium Severity medium
: ---
: ---
Assigned To: Luis Claudio R. Goncalves
:
Depends On:
Blocks: 461446 461449 461450
  Show dependency treegraph
 
Reported: 2008-09-07 22:53 EDT by Eugene Teo (Security Response)
Modified: 2008-10-15 08:07 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-15 08:07:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Upstream patch for this issue (6.44 KB, patch)
2008-09-07 22:57 EDT, Eugene Teo (Security Response)
no flags Details | Diff

  None (edit)
Description Eugene Teo (Security Response) 2008-09-07 22:53:52 EDT
Description of problem:
This commit includes a bugfix for the fragile setuid fixup code in the case that filesystem capabilities are supported (in access()). The effect of this fix is gated on filesystem capability support because changing securebits is only supported when filesystem capabilities support is configured.)
Comment 2 Eugene Teo (Security Response) 2008-09-07 22:57:33 EDT
Created attachment 315983 [details]
Upstream patch for this issue
Comment 3 Luis Claudio R. Goncalves 2008-09-09 09:29:16 EDT
I had two failures applying the patch:
* include/linux/capability.h

  the file we have in MRG is at least 200 lines shorter, giving the line 
  numbering for the patch bits.

include/linux/securebits.h

  though this file is small, the one in MRG has fewer defs.

Eugene, my question is: should I backport both files from upstream? I am not sure how much work it would mean as it may mean backporting suport functions and so on.
Comment 4 Jiri Pirko 2008-10-14 10:26:13 EDT
I asked Andrew G. Morgan (author or upstream patch) how to test this issue. He told me that there is good chance that we do not need this patch:

"The relevant change is resurrecting the securebits as a per-process
property. I'd be really surprised if you back ported this, and if you
haven't this patch can be safely ignored."

securebits as a per-process property was introduced by following patch:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=3898b1b4ebff8dcfbcf1807e0661585e06c9a91c

We DO NOT have this in our kernels so there is no need to fix this issue because there is not any. Feel free to close this bug.
Comment 5 Eugene Teo (Security Response) 2008-10-14 20:45:08 EDT
(In reply to comment #3)
> I had two failures applying the patch:
> * include/linux/capability.h
> 
>   the file we have in MRG is at least 200 lines shorter, giving the line 
>   numbering for the patch bits.
> 
> include/linux/securebits.h
> 
>   though this file is small, the one in MRG has fewer defs.
> 
> Eugene, my question is: should I backport both files from upstream? I am not
> sure how much work it would mean as it may mean backporting suport functions
> and so on.

As discussed with Andrew, there is no need to fix this issue. Please close this bug. Thanks!
Comment 6 Luis Claudio R. Goncalves 2008-10-15 08:07:23 EDT
Closed as NOTABUG.

Thanks Eugene and Jiri (and Andrew) :)

Note You need to log in before you can comment on or make changes to this bug.