• Mickaël Salaün's avatar
    fs: Fix file_set_fowner LSM hook inconsistencies · 26f20438
    Mickaël Salaün authored
    The fcntl's F_SETOWN command sets the process that handle SIGIO/SIGURG
    for the related file descriptor.  Before this change, the
    file_set_fowner LSM hook was always called, ignoring the VFS logic which
    may not actually change the process that handles SIGIO (e.g. TUN, TTY,
    dnotify), nor update the related UID/EUID.
    
    Moreover, because security_file_set_fowner() was called without lock
    (e.g. f_owner.lock), concurrent F_SETOWN commands could result to a race
    condition and inconsistent LSM states (e.g. SELinux's fown_sid) compared
    to struct fown_struct's UID/EUID.
    
    This change makes sure the LSM states are always in sync with the VFS
    state by moving the security_file_set_fowner() call close to the
    UID/EUID updates and using the same f_owner.lock .
    
    Rename f_modown() to __f_setown() to simplify code.
    
    Cc: stable@vger.kernel.org
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Casey Schaufler <casey@schaufler-ca.com>
    Cc: Christian Brauner <brauner@kernel.org>
    Cc: James Morris <jmorris@namei.org>
    Cc: Jann Horn <jannh@google.com>
    Cc: Ondrej Mosnacek <omosnace@redhat.com>
    Cc: Paul Moore <paul@paul-moore.com>
    Cc: Serge E. Hallyn <serge@hallyn.com>
    Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    26f20438
fcntl.c 24.3 KB