You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Hugh Dickins 7c2c7d9930 fix setuid sometimes wouldn't ... check_unsafe_exec() also notes whether the fs_struct is being shared by more threads than will get killed by the exec, and if so sets LSM_UNSAFE_SHARE to make bprm_set_creds() careful about euid. But /proc/<pid>/cwd and /proc/<pid>/root lookups make transient use of get_fs_struct(), which also raises that sharing count. This might occasionally cause a setuid program not to change euid, in the same way as happened with files->count (check_unsafe_exec also looks at sighand->count, but /proc doesn't raise that one). We'd prefer exec not to unshare fs_struct: so fix this in procfs, replacing get_fs_struct() by get_fs_path(), which does path_get while still holding task_lock, instead of raising fs->count. Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: stable@kernel.org ___ fs/proc/base.c | 50 +++++++++++++++-------------------------------- 1 file changed, 16 insertions(+), 34 deletions(-) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		16 years ago
..
9p	vfs: simple_set_mnt() should return void	16 years ago
adfs	constify dentry_operations: misc filesystems	16 years ago
affs	constify dentry_operations: misc filesystems	16 years ago
afs	constify dentry_operations: AFS	16 years ago
autofs	constify dentry_operations: autofs, autofs4	16 years ago
autofs4	constify dentry_operations: autofs, autofs4	16 years ago
befs	fs/Kconfig: move befs out	16 years ago
bfs	fs/Kconfig: move bfs out	16 years ago
btrfs	btrfs: get rid of current_is_pdflush() in btrfs_btree_balance_dirty	16 years ago
cifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
coda	constify dentry_operations: misc filesystems	16 years ago
configfs	constify dentry_operations: configfs	16 years ago
cramfs	fs/Kconfig: move cramfs out	16 years ago
debugfs	…
devpts	Merge code for single and multiple-instance mounts	16 years ago
dlm	dlm: fix length calculation in compat code	16 years ago
ecryptfs	constify dentry_operations: ecryptfs	16 years ago
efs	fs/Kconfig: move efs out	16 years ago
exportfs	…
ext2	ext2: Zero our b_size in ext2_quota_read()	16 years ago
ext3	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-quota-2.6	16 years ago
ext4	ext4: Use lowercase names of quota functions	16 years ago
fat	constify dentry_operations: FAT	16 years ago
freevxfs	fs/Kconfig: move vxfs out	16 years ago
fuse	constify dentry_operations: FUSE	16 years ago
gfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
hfs	constify dentry_operations: misc filesystems	16 years ago
hfsplus	constify dentry_operations: misc filesystems	16 years ago
hostfs	constify dentry_operations: misc filesystems	16 years ago
hpfs	constify dentry_operations: misc filesystems	16 years ago
hppfs	…
hugetlbfs	Do not account for the address space used by hugetlbfs using VM_ACCOUNT	16 years ago
isofs	constify dentry_operations: misc filesystems	16 years ago
jbd	jbd: fix return value of journal_start_commit()	16 years ago
jbd2	jbd2: Avoid possible NULL dereference in jbd2_journal_begin_ordered_truncate()	16 years ago
jffs2	[JFFS2] fix mount crash caused by removed nodes	16 years ago
jfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
lockd	NLM: Fix GRANT callback address comparison when IPv6 is enabled	16 years ago
minix	Update my email address	16 years ago
ncpfs	constify dentry_operations: misc filesystems	16 years ago
nfs	constify dentry_operations: NFS	16 years ago
nfs_common	…
nfsd	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-quota-2.6	16 years ago
nls	…
notify	fs: avoid I_NEW inodes	16 years ago
ntfs	fs/Kconfig: move ntfs out	16 years ago
ocfs2	constify dentry_operations: OCFS2	16 years ago
omfs	fs/Kconfig: move omfs out	16 years ago
openpromfs	…
partitions	Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6	16 years ago
proc	fix setuid sometimes wouldn't	16 years ago
qnx4	fs/Kconfig: move qnx4 out	16 years ago
quota	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
ramfs	ramfs: Remove quota call	16 years ago
reiserfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
romfs	fs/Kconfig: move romfs out	16 years ago
smbfs	constify dentry_operations: misc filesystems	16 years ago
squashfs	Squashfs: Valid filesystems are flagged as bad by the corrupted fs patch	16 years ago
sysfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
sysv	constify dentry_operations: misc filesystems	16 years ago
ubifs	vfs: simple_set_mnt() should return void	16 years ago
udf	udf: Use lowercase names of quota functions	16 years ago
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
xfs	xfs: only issues a cache flush on unmount if barriers are enabled	16 years ago
Kconfig	quota: Move quota files into separate directory	16 years ago
Kconfig.binfmt	…
Makefile	quota: Move quota files into separate directory	16 years ago
aio.c	aio: lookup_ioctx can return the wrong value when looking up a bogus context	16 years ago
anon_inodes.c	constify dentry_operations: rest	16 years ago
attr.c	vfs: Use lowercase names of quota functions	16 years ago
bad_inode.c	…
binfmt_aout.c	…
binfmt_elf.c	elf core dump: fix get_user use	16 years ago
binfmt_elf_fdpic.c	…
binfmt_em86.c	…
binfmt_flat.c	…
binfmt_misc.c	…
binfmt_script.c	…
binfmt_som.c	…
bio-integrity.c	block: add private bio_set for bio integrity allocations	16 years ago
bio.c	block: add private bio_set for bio integrity allocations	16 years ago
block_dev.c	fs: move bdev code out of buffer.c	16 years ago
buffer.c	fs: move bdev code out of buffer.c	16 years ago
char_dev.c	…
compat.c	fix setuid sometimes doesn't	16 years ago
compat_binfmt_elf.c	…
compat_ioctl.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	16 years ago
dcache.c	cleanup d_add_ci	16 years ago
dcookies.c	…
direct-io.c	…
drop_caches.c	fs: avoid I_NEW inodes	16 years ago
eventfd.c	…
eventpoll.c	Rename struct file->f_ep_lock	16 years ago
exec.c	fix setuid sometimes doesn't	16 years ago
fcntl.c	Rationalize fasync return values	16 years ago
fifo.c	…
file.c	…
file_table.c	Merge branch 'bkl-removal' of git://git.lwn.net/linux-2.6	16 years ago
filesystems.c	…
fs-writeback.c	fs: new inode i_state corruption fix	16 years ago
generic_acl.c	…
inode.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
internal.h	fix setuid sometimes doesn't	16 years ago
ioctl.c	Rationalize fasync return values	16 years ago
ioprio.c	…
libfs.c	vfs: simple_set_mnt() should return void	16 years ago
locks.c	…
mbcache.c	…
mpage.c	…
namei.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
namespace.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
nfsctl.c	…
no-block.c	…
open.c	vfs: Use lowercase names of quota functions	16 years ago
pipe.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
pnode.c	…
pnode.h	…
posix_acl.c	…
read_write.c	…
read_write.h	…
readdir.c	…
select.c	…
seq_file.c	seq_file: properly cope with pread	16 years ago
signalfd.c	…
splice.c	…
stack.c	…
stat.c	…
super.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	16 years ago
sync.c	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-quota-2.6	16 years ago
timerfd.c	timerfd: add flags check	16 years ago
utimes.c	…
xattr.c	…
xattr_acl.c	…