ceph: rely on vfs for setgid stripping · Pull Request !5020 · openEuler/kernel

The CVE-2018-13405 has been patched in 2018 and 2021. However, in subsequent submissions: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=426b4ca2d6a5, the following issues are still present:
1.The S_ISGID stripping logic is intertwined with the umask stripping.
2.File systems that do not rely on inode_init_owner() do not have the S_ISGID stripping logic.
3.Even after the initial fix for S_ISGID inheritance issue, we still have the S_ISGID inheritance vulnerability.
T
herefore, with the 4 submissions included in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=426b4ca2d6a5, the setgid handling is moved out from individual file systems and integrated into VFS itself to prevent the increasing setgid inheritance vulnerabilities.

Now that we finished moving setgid stripping for regular files in setgid directories into the vfs, individual filesystem don't need to manually strip the setgid bit anymore. Drop the now unneeded code from ceph.

The current branch only includes the first three fixes, and it has missed the final fix for the ceph file system. Therefore, it is necessary to merge the corresponding patch to thoroughly resolve this issue.

GVPopenEuler/kernel

搜索帮助

GVP openEuler/kernel