From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5C603EC82F for ; Wed, 29 Jul 2026 16:31:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.222.177 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785342680; cv=pass; b=AV6gt40gywWtNwVC7VAXk0p6O5XCQU9QXIIiFgM0X1CnfADovEuTw5rK1K5DuQtN6+o6x8GHpmcHvE27hiBv+R3YEcyWtnswOQoWdYuXWc2RFIL7xHADhosPbPeF8+JQ3W6k9QdfR6laM+vtN7VKNupcQSISpfX0LkLpktZKoFY= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785342680; c=relaxed/simple; bh=S9SC+Xya2EQfqf9tNwbGoOGjCrrJQ5Kh7ijB/buwyGE=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Ll/uAdDElVxVdDbqQvzg4I0s1BqZopT9jQ7FPPkFtSd7zmdhVQc5P40JJ7+DgT+w8c86Z56kheaIavJfiyDrBVnxsHuOXeTKxD38vIz8XZPjkL4AbkqzHB6oDsE7hUlOyYwZ327rnUSx/D8rkcDsGNCfaoC4Jhru4Vv1xWnFvY0= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QYetWZzB; arc=pass smtp.client-ip=209.85.222.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QYetWZzB" Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-92e99ef0902so76866985a.2 for ; Wed, 29 Jul 2026 09:31:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785342678; cv=none; d=google.com; s=arc-20260327; b=LyOj6iR6gaTVPZDvCDHPSVUn8aFFjo1lnaJjukCmL3uIHuI3He5T1jyXxCpR8dz9Xd dsyCWOtfTGYycdjMqml93wasmtqFarUZWoDvMZooYIWp/UGkpNmOkxmQqQNc6PUItFTD G82du+93274WLuudZnResCXpT59ffcGN/vaqejqnoMSxxWlc7PAZTGsq9TfE3DTVYxsl OXGZXXCuRnizONlqMLEv253AlubS2ehhi8L79o/LjDASaPXZ4XKwFIjUgSKfPIoUtDVG Cr592u5IPH2tHyklbpHZbcjGWW44XvQ4aXK5BLcbsVJMbHtLtqVtwih7Ctm2e+HV7Dic jZFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=H21FkzzATqmSB3dNxAkJ0SfsF/b0DzYCWUc7+kRSXj4=; fh=lBJeZEFupbOel/ojlyv2WL3zHgUhWijn5DspmhuDxG0=; b=ecahHAMPJ31zFG3qD9XRqBGHedexSmsCj28uqh2hou+r8R0IJa6VONx5Ib0WT/1dwc rKi8YtxDgFDg1N5wTdRXomgRSMwAKoR8/Pr/Bs1e2vIG0Tp/8qdVg/MZEabiWVXC7zb0 29kZsYbSBk1qiJ4I+PYkBZSpZxfeCpbmO8Iu4c54A2Fi5LqbTK8B7OuSCYBX+pQevI/U Agqf8IBd9u/4wFAy8QSXGRwQP6Sn9xiBBmMIADd+IwJ8tSz8l6FcXTPSy6o7EBUVaOBD VHYnuLFTNxYy++8sY6eHiwUcnxQPx84JMOnH6Kf9khlvs3DHRuCgZRGlOVjKSFRS3ifv TAbg==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785342678; x=1785947478; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=H21FkzzATqmSB3dNxAkJ0SfsF/b0DzYCWUc7+kRSXj4=; b=QYetWZzBpnhDpGLcZVLD2UMwC82knMTFtgYTl6C2uoGd2BXrlfuS4WNHy97dICpRrJ gOPL9V10aVBvlDXDRzYu58Cs3xGNUMGNoqnvWqDj9pRWxISdTI3VihTpXScLVFzq4Shv tEJLV6pSejLFAa3ktnbQZUMn4VOBGAENnxUJgIB8+1X4hmnT/CqMdsr6NJC4YsYAElMk gIVVhEuEYClK1UwONs09lPUbXfnfaRazQu5BjEIihBkKeUVjrqM1gFKsAvl1xFPrLamq 1PPFpEp9LMEeNccwEP90GkLxTPtI7oOQgqkJwE4CUx1KNiut2LrddjQnU7fw9v6B0H/t mPnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785342678; x=1785947478; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=H21FkzzATqmSB3dNxAkJ0SfsF/b0DzYCWUc7+kRSXj4=; b=PqfPXMSFKA6er7/DU4qNjFal9EnRuZcJwqYgZm7De5+mTBZvy9v86OkWv/WL46ytrk mekqvFgk7ZWwl3MnwChYVyuSjIywz2Z26AicuHtKKgQ6inMBJK4Yi9nWNGo7rXFts9JO ZXb80Gupoxl4S3PVKtUBnWL7GKLuyRmKhTsdcLB9HNA4p8K3QOoWn7vdPmKVYN3pyiSq 1rVWJ8NGrBwC7/To9Xrdq+8ouBkVOqjUi0yFoWS7c5Kz4rI+iGu9JDr+5EtC9DyaJl8B NDihfoZcEIChHF6myY2e27WwRQsACGTJEcNIX/3ePaKtkcKyVDmudg/ZZakieEytoQCg manA== X-Forwarded-Encrypted: i=1; AHgh+RrJ/56NIbW1D9Tdv2T3umRU3aw/BgMCYGQbUJz0Utxe6Q6j3zqYHvOfnGIWmoDKLI33yEwtiVPtj6Je//g=@vger.kernel.org X-Gm-Message-State: AOJu0YwvLA0PJoU2iy8SB3wAZxo63rbDlPsuXaUdaC3KJbykUllbofho usmRYbb6WXYMbmCTRESJNyMalym7diIKux5chxHOa+/Lm6Vd9wJL+CPiHtnl5yCrn4UtKBC+51T JAnH69r1SCAIEbJFNwcWBdJYsb7KCwyg= X-Gm-Gg: AR+sD10t55p72bR4F7brPphDyJAFWIdc/pJJZ6JElDEGPOWUSJONWkT04tQb4z2pLE+ DgJQjFOgCX2ws5b8i8Z/SemaMNWNHXhtR53/Gq5PWWL6ccQcgcUCsb4zKTzQHhX+abmHyeGSRiH r3uHF7b/DYye7Eekme2mPYI7x2yQhyxyWnVQVWv1vTN7of+st2r9GqcgVqO90HvSgHvkm6wnhI8 TtwAIicbw15hfRLdcqylfjtswTY+sywISoIHou3Ovzl9wPu/1PdFX8ZgcU4Ofc4VtLW+wwx0gVu ap21DlyuyogyAd7FT+LN0b7bbrZYtVUfsWky5kehD9eL7mS9L+fReUde8ziEGVBTKMmKsxtIIFg rTXRrC4NP91Vyz8u5HD7jlGrVWTB6PDVRggzPYjbp6+/f0iX48pk2+u0NxmsQHatfaafES3TV3R UrunbE4DsQ9x+bUaRYINxzk/DT X-Received: by 2002:a05:620a:4445:b0:92e:eeb6:b879 with SMTP id af79cd13be357-933025fe6dcmr709988485a.41.1785342677543; Wed, 29 Jul 2026 09:31:17 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260716022214.2727070-1-yijiangshan@kylinos.cn> In-Reply-To: <20260716022214.2727070-1-yijiangshan@kylinos.cn> From: Steve French Date: Wed, 29 Jul 2026 11:31:05 -0500 X-Gm-Features: AUfX_myTS-L8_63bZ_SeAWVg2RUljtftNFyM8rksYMhQpz3sjCmcWPBXn9L8PtY Message-ID: Subject: Re: [PATCH] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions To: Jiangshan Yi Cc: pc@manguebit.org, ronniesahlberg@gmail.com, sprasad@microsoft.com, tom@talpey.com, bharathsm@microsoft.com, akpm@linux-foundation.org, jlayton@kernel.org, linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-kernel@vger.kernel.org, 13667453960@163.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable doesn't the bit only get cleared if it is a non-root user? Does the patch need changes to see if root is writing? When I asked AI it responded with: On modern Linux: A process without CAP_FSETID will have the setuid/setgid bits cleared when writing to a regular file. A process with CAP_FSETID (typically root, though capabilities can be granted independently) may preserve them. On Wed, Jul 15, 2026 at 9:23=E2=80=AFPM Jiangshan Yi wrote: > > When a file has the setuid or setgid bit set and is written to, the VFS > strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID > together with an ATTR_MODE carrying the already-cleared mode. > > Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally droppe= d > ATTR_MODE in that case: > > /* skip mode change if it's just for clearing setuid/setgid */ > if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) > attrs->ia_valid &=3D ~ATTR_MODE; > > This is fine for the default mount, where the mode is only emulated via > the DOS read-only attribute and cannot represent the setuid/setgid bits > anyway. However, with the "cifsacl" or "modefromsid" mount options the > mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with > the SMB3.1.1 POSIX extensions the mode is sent to the server directly, > and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent > via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE mean= s > the cleared mode is never pushed to the server, so the setuid/setgid bit > survives the write. > > This is a security issue: on local filesystems the setuid bit is stripped > when a file is written, but over these cifs.ko mounts the bit persists on > the server, potentially allowing an unexpected privilege escalation on > subsequent execution. > > Fix this in two places: > > 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut > when the mode is emulated via the DOS read-only attribute (i.e. > neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are > in effect), so that the cleared mode is propagated to the server > in the ACL / POSIX cases. > > 2. cifs_setattr_unix(): this function is only called when Unix > extensions are in effect, so the mode is always stored on the > server. Remove the shortcut entirely so that the cleared mode is > always pushed. > > Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing = setuid/setgid bits") > Cc: stable@vger.kernel.org > Signed-off-by: Jiangshan Yi > --- > fs/smb/client/inode.c | 29 ++++++++++++++++++++++++----- > 1 file changed, 24 insertions(+), 5 deletions(-) > > diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c > index deed04dd9b91..e1cecd58ea9d 100644 > --- a/fs/smb/client/inode.c > +++ b/fs/smb/client/inode.c > @@ -3200,9 +3200,13 @@ cifs_setattr_unix(struct dentry *direntry, struct = iattr *attrs) > attrs->ia_valid &=3D ~(ATTR_CTIME | ATTR_MTIME); > } > > - /* skip mode change if it's just for clearing setuid/setgid */ > - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) > - attrs->ia_valid &=3D ~ATTR_MODE; > + /* > + * This function is only called when Unix extensions are in effec= t, > + * so the mode is always sent to and stored on the server. Do no= t > + * skip the mode change when clearing setuid/setgid bits: droppin= g > + * ATTR_MODE here would leave those bits set on the server after = a > + * write, which is a security issue. > + */ > > args =3D kmalloc_obj(*args); > if (args =3D=3D NULL) { > @@ -3400,8 +3404,23 @@ cifs_setattr_nounix(struct dentry *direntry, struc= t iattr *attrs) > attrs->ia_valid &=3D ~(ATTR_UID | ATTR_GID); > } > > - /* skip mode change if it's just for clearing setuid/setgid */ > - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) > + /* > + * Skip the mode change if it is only being done to clear the > + * setuid/setgid bits *and* the mode is emulated via the DOS > + * read-only attribute (the default, non-ACL case), which cannot > + * represent the setuid/setgid bits anyway. > + * > + * When the mode is instead stored on the server - i.e. with the > + * cifsacl or modefromsid mount options (via an ACL) or with the > + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to > + * the server. Dropping ATTR_MODE here would leave the setuid/ > + * setgid bit set on the server after a write, which is a securit= y > + * issue (the bits are not stripped as they are on local > + * filesystems). > + */ > + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && > + !((sbflags & (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)= ) || > + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) > attrs->ia_valid &=3D ~ATTR_MODE; > > if (attrs->ia_valid & ATTR_MODE) { > -- > 2.25.1 > > --=20 Thanks, Steve