Project

General

Profile

Actions

Bug #14472

closed

Fix clearing setuid/setgid bits on a file when replaying a write

Added by Dan McDonald 6 months ago. Updated 6 months ago.

Status:
Closed
Priority:
High
Assignee:
Category:
zfs - Zettabyte File System
Start date:
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:

Description

This is from an OpenZFS pull request: https://github.com/openzfs/zfs/pull/13027

We don't have the test programs they do, but their changes to zfs_vnops.c are back-portable to illumos, and should be back-ported.

Actions #1

Updated by Dan McDonald 6 months ago

  • Subject changed from Fix clearing set-uid and set-gid bits on a file when replying a write. to Fix clearing setuid/setgid bits on a file when replying a write.
Actions #2

Updated by Dan McDonald 6 months ago

  • Subject changed from Fix clearing setuid/setgid bits on a file when replying a write. to Fix clearing setuid/setgid bits on a file when replying a write.
Actions #3

Updated by Dan McDonald 6 months ago

  • Subject changed from Fix clearing setuid/setgid bits on a file when replying a write. to Fix clearing setuid/setgid bits on a file when replaying a write
Actions #4

Updated by Electric Monk 6 months ago

  • Gerrit CR set to 2003
Actions #5

Updated by Dan McDonald 6 months ago

Tested on OmniOS by using this script:

#!/bin/sh

POOLNAME=rpool/test

zfs destroy $POOLNAME
zfs create -o sync=always $POOLNAME
touch /$POOLNAME/suid
chmod u+sx,o+rw /rpool/test/suid
ls -lt /$POOLNAME/suid
su nobody "echo test >> /$POOLNAME/suid" 
uadmin 5 1

Before this fix, a post-reboot "ls -lt /rpool/test/suid" would have the setuid bit STILL SET, but with the "test" text in the binary (which could be a more malicious payload in theory).

After this fix, the post-reboot "ls -lt /rpool/test/suid" will have its setuid bit cleared.

Actions #6

Updated by Electric Monk 6 months ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

git commit 163bcb88498e897f35c7fc801fe9db507052a1f0

commit  163bcb88498e897f35c7fc801fe9db507052a1f0
Author: Pawel Jakub Dawidek <pawel@dawidek.net>
Date:   2022-02-07T21:53:22.000Z

    14472 Fix clearing setuid/setgid bits on a file when replaying a write
    Co-authored-by: Christian Schwarz <me@cschwarz.com>
    Reviewed by: Dan McDonald <danmcd@joyent.com>
    Reviewed by: Jason King <jason.brian.king@gmail.com>
    Reviewed by: Toomas Soome <tsoome@me.com>
    Approved by: Garrett D'Amore <garrett@damore.org>

Actions

Also available in: Atom PDF