Jan Kara 57c9cfdb61 posix_acl: Clear SGID bit when setting file permissions ... commit 073931017b upstream. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-10-31 04:13:58 -06:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	asm-generic: make copy_from_user() zero the destination properly	2016-09-24 10:07:45 +02:00
clocksource
crypto	crypto: ghash-generic - move common definitions to a new header file	2016-10-22 12:26:56 +02:00
drm	drm/prime: Pass the right module owner through to dma_buf_export()	2016-10-31 04:13:57 -06:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'	2016-09-30 10:18:36 +02:00
pcmcia
ras
rdma	IB/security: Restrict use of the write() interface	2016-05-04 14:48:48 -07:00
rxrpc
scsi	scsi: Add intermediate STARGET_REMOVE state to scsi_target_state	2016-06-01 12:15:54 -07:00
soc	ARM: SoC driver updates for v4.4	2015-11-10 15:00:03 -08:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT REACHABLE	2016-10-28 03:01:36 -04:00
trace	SUNRPC: Don't allocate a full sockaddr_storage for tracing	2016-08-20 18:09:26 +02:00
uapi	cxlflash: Fix to avoid virtual LUN failover failure	2016-09-15 08:27:49 +02:00
video	drm/imx: Match imx-ipuv3-crtc components using device node in platform data	2016-06-07 18:14:37 -07:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild