afs: Adjust mode bits processing (627f4694) · Commits · 戴 / test

Mode bits for an afs file should not be enforced in the usual way. For files, the absence of user bits can restrict file access with respect to what is granted by the server. These bits apply regardless of the owner or the current uid; the rest of the mode bits (group, other) are ignored. Signed-off-by:

Marc Dionne <marc.dionne@auristor.com> Signed-off-by:

David Howells <dhowells@redhat.com>

fs/afs/security.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask)
		} else {
		if (!(access & AFS_ACE_LOOKUP))
		goto permission_denied;
		if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR))
		goto permission_denied;
		if (mask & (MAY_EXEC \| MAY_READ)) {
		if (!(access & AFS_ACE_READ))
		goto permission_denied;
		if (!(inode->i_mode & S_IRUSR))
		goto permission_denied;
		} else if (mask & MAY_WRITE) {
		if (!(access & AFS_ACE_WRITE))
		goto permission_denied;
		if (!(inode->i_mode & S_IWUSR))
		goto permission_denied;
		}
		}

		key_put(key);
		ret = generic_permission(inode, mask);
		_leave(" = %d", ret);
		return ret;

Admin message