fanotify: if set by user unset FMODE_NONOTIFY before fsnotify_perm() is called (b1085ba8) · Commits · 戴 / test

Unsetting FMODE_NONOTIFY in fsnotify_open() is too late, since fsnotify_perm() is called before. If FMODE_NONOTIFY is set fsnotify_perm() will skip permission checks, so a user can still disable permission checks by setting this flag in an open() call. This patch corrects this by unsetting the flag before fsnotify_perm is called. Signed-off-by:

Lino Sanfilippo <LinoSanfilippo@gmx.de> Signed-off-by:

Eric Paris <eparis@redhat.com>

fs/namei.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1748,6 +1748,9 @@ struct file do_filp_open(int dfd, const char pathname,
		if (!(open_flag & O_CREAT))
		mode = 0;

		/* Must never be set by userspace */
		open_flag &= ~FMODE_NONOTIFY;

		/*
		* O_SYNC is implemented as __O_SYNC\|O_DSYNC. As many places only
		* check for O_DSYNC if the need any syncing at all we enforce it's

include/linux/fsnotify.h

+0 −3

Original line number	Diff line number	Diff line
		@@ -235,9 +235,6 @@ static inline void fsnotify_open(struct file *file)
		if (S_ISDIR(inode->i_mode))
		mask \|= FS_ISDIR;

		/* FMODE_NONOTIFY must never be set from user */
		file->f_mode &= ~FMODE_NONOTIFY;

		fsnotify_parent(path, NULL, mask);
		fsnotify(inode, mask, path, FSNOTIFY_EVENT_PATH, NULL, 0);
		}

Admin message