open|creat: skip S_ISGID check on files created by non-group members

PATCH New Jan Stancek 3 participants 4 messages Jul 17, 2018 – Jul 30, 2018

Share & tools

Jan Stancek

author

2018-07-17 08:35 UTC #0 lore raw

PATCH 1/1 open|creat: skip S_ISGID check on files created by non-group members

0fa3ecd87848 ("Fix up non-directory creation in SGID directories") fixes problem described in CVE-2018-13405. This commit is getting backported to older streams as well.

This patch removes S_ISGID check for files created by non-group members in LTP tests creat08 and open10.

Once 0fa3ecd87848 will be in non-rc kernel, we could add a new test for this CVE that would be limited to 4.18+ kernels.

Signed-off-by Jan Stancek <[email protected]>

---
 testcases/kernel/syscalls/creat/creat08.c | 13 ++++++-------
 testcases/kernel/syscalls/open/open10.c   | 12 +++++-------
 2 files changed, 11 insertions(+), 14 deletions(-)

testcases/kernel/syscalls/creat/creat08.c +6 -7

index 50f2b39931b8..d22558ac3c53 100644
@@ -361,13 +361,12 @@ int main(int ac, char **av)
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit should be set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
+
 		close(fd);
 
 		if (local_flag == PASSED) {

testcases/kernel/syscalls/open/open10.c +5 -7

index 613f2288fbde..14feec9e127e 100644
@@ -345,13 +345,11 @@ int main(int ac, char *av[])
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit not set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
 
 		if (local_flag == PASSED) {
 			tst_resm(TPASS, "Test passed in block2.");

Signature · 1 line

1.8.3.1

Naresh Kamboju

2018-07-18 15:04 UTC #1 lore raw

PATCH 1/1 open|creat: skip S_ISGID check on files created by non-group members

Thanks for the patch Jan.

Quoted 11 lines · Jan Stancek

0fa3ecd87848 ("Fix up non-directory creation in SGID directories") fixes problem described in CVE-2018-13405. This commit is getting backported to older streams as well.
This patch removes S_ISGID check for files created by non-group members in LTP tests creat08 and open10.
Once 0fa3ecd87848 will be in non-rc kernel, we could add a new test for this CVE that would be limited to 4.18+ kernels.
Signed-off-by Jan Stancek <[email protected]>

Reviewed-by Naresh Kamboju <[email protected]>

Quoted 53 lines

---
 testcases/kernel/syscalls/creat/creat08.c | 13 ++++++-------
 testcases/kernel/syscalls/open/open10.c   | 12 +++++-------
 2 files changed, 11 insertions(+), 14 deletions(-)

testcases/kernel/syscalls/creat/creat08.c +6 -7

index 50f2b39931b8..d22558ac3c53 100644
@@ -361,13 +361,12 @@ int main(int ac, char **av)
                        local_flag = FAILED;
                }
 
-               /* Verify modes */
-               if (!(buf.st_mode & S_ISGID)) {
-                       tst_resm(TFAIL,
-                                "%s: Incorrect modes, setgid bit should be set",
-                                setgid_B);
-                       local_flag = FAILED;
-               }
+               /*
+                * Skip S_ISGID check
+                * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+                * clears S_ISGID for files created by non-group members
+                */
+
                close(fd);
 
                if (local_flag == PASSED) {

testcases/kernel/syscalls/open/open10.c +5 -8

index 613f2288fbde..14feec9e127e 100644
@@ -345,13 +345,11 @@ int main(int ac, char *av[])
                        local_flag = FAILED;
                }
 
-               /* Verify modes */
-               if (!(buf.st_mode & S_ISGID)) {
-                       tst_resm(TFAIL,
-                                "%s: Incorrect modes, setgid bit not set",
-                                setgid_B);
-                       local_flag = FAILED;
-               }
+               /*
+                * Skip S_ISGID check
+                * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+                * clears S_ISGID for files created by non-group members
+                */
 
                if (local_flag == PASSED) {
                        tst_resm(TPASS, "Test passed in block2.");
--

Quoted 2 lines

1.8.3.1

- Naresh

Cyril Hrubis

2018-07-30 11:57 UTC #2 lore raw

PATCH 1/1 open|creat: skip S_ISGID check on files created by non-group members

In reply to Jan Stancek

Hi!

Quoted 6 lines

0fa3ecd87848 ("Fix up non-directory creation in SGID directories") fixes problem described in CVE-2018-13405. This commit is getting backported to older streams as well.
This patch removes S_ISGID check for files created by non-group members in LTP tests creat08 and open10.

Looks good, acked.

Quoted 2 lines

Once 0fa3ecd87848 will be in non-rc kernel, we could add a new test for this CVE that would be limited to 4.18+ kernels.

Given that this is CVE we may as well go a little bit further and write a test that will fail even on older kernels.

Quoted 59 lines

Signed-off-by Jan Stancek <[email protected]>

---
 testcases/kernel/syscalls/creat/creat08.c | 13 ++++++-------
 testcases/kernel/syscalls/open/open10.c   | 12 +++++-------
 2 files changed, 11 insertions(+), 14 deletions(-)

testcases/kernel/syscalls/creat/creat08.c +6 -7

index 50f2b39931b8..d22558ac3c53 100644
@@ -361,13 +361,12 @@ int main(int ac, char **av)
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit should be set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
+
 		close(fd);
 
 		if (local_flag == PASSED) {

testcases/kernel/syscalls/open/open10.c +5 -7

index 613f2288fbde..14feec9e127e 100644
@@ -345,13 +345,11 @@ int main(int ac, char *av[])
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit not set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
 
 		if (local_flag == PASSED) {
 			tst_resm(TPASS, "Test passed in block2.");

Signature · 5 lines

1.8.3.1


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Signature · 2 lines

Cyril Hrubis
[email protected]

Jan Stancek

author

2018-07-30 12:27 UTC #3 lore raw

PATCH 1/1 open|creat: skip S_ISGID check on files created by non-group members

----- Original Message -----

Quoted 9 lines

Hi!
Quoted 6 lines
0fa3ecd87848 ("Fix up non-directory creation in SGID directories") fixes problem described in CVE-2018-13405. This commit is getting backported to older streams as well.
This patch removes S_ISGID check for files created by non-group members in LTP tests creat08 and open10.
Looks good, acked.

Thanks, I almost forgot about this. Pushed.

Regards,
Jan

Quoted 73 lines

Quoted 3 lines

Once 0fa3ecd87848 will be in non-rc kernel, we could add a new test for this CVE that would be limited to 4.18+ kernels.

Given that this is CVE we may as well go a little bit further and write a test that will fail even on older kernels.

Quoted 59 lines

Signed-off-by Jan Stancek <[email protected]>

---
 testcases/kernel/syscalls/creat/creat08.c | 13 ++++++-------
 testcases/kernel/syscalls/open/open10.c   | 12 +++++-------
 2 files changed, 11 insertions(+), 14 deletions(-)

testcases/kernel/syscalls/creat/creat08.c +6 -7

index 50f2b39931b8..d22558ac3c53 100644
@@ -361,13 +361,12 @@ int main(int ac, char **av)
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit should be set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
+
 		close(fd);
 
 		if (local_flag == PASSED) {

testcases/kernel/syscalls/open/open10.c +5 -8

index 613f2288fbde..14feec9e127e 100644
@@ -345,13 +345,11 @@ int main(int ac, char *av[])
 			local_flag = FAILED;
 		}
 
-		/* Verify modes */
-		if (!(buf.st_mode & S_ISGID)) {
-			tst_resm(TFAIL,
-				 "%s: Incorrect modes, setgid bit not set",
-				 setgid_B);
-			local_flag = FAILED;
-		}
+		/*
+		 * Skip S_ISGID check
+		 * 0fa3ecd87848 ("Fix up non-directory creation in SGID directories")
+		 * clears S_ISGID for files created by non-group members
+		 */
 
 		if (local_flag == PASSED) {
 			tst_resm(TPASS, "Test passed in block2.");
--

1.8.3.1

Quoted 2 lines

--
Mailing list info: https://lists.linux.it/listinfo/ltp

--
Cyril Hrubis
[email protected]