Re: odd chown difference between 2.0 and 2.1pre kernels

Nicholas J. Leon (nicholas@binary9.net)
Mon, 11 Jan 1999 11:26:53 -0500 (EST)


On Sat, 9 Jan 1999, Joey Hess wrote:

# On a 2.1pre4 machine:
# root@kite:~>ls -l foo
# -rwsrw-r-- 1 root joey 0 Jan 9 17:13 foo*
# root@kite:~> chown root.root foo; ls -l foo
# -rwsrw-r-- 1 root root 0 Jan 9 17:13 foo*
#
# On a 2.0.x machine:
# cookie:~# ls -l foo
# -rwsr--r-- 1 root james 0 Jan 10 01:44 foo
# cookie:~# chown root.root foo; ls -l foo
# -rwxr--r-- 1 root root 0 Jan 10 01:44 foo
#
# Why did the file lose it's suid bit before, and not anymore?

Yah. I verify that this is true also. Previously (pre 2.2pre's) chowning
anything would remove all SUID flags. Now, nothing is changed. I had
always thought this was a security feature to prevent someone gaining root
suid access through some symlink trick.

Anyway, it appears that this is the code that changed and made the
difference:

(~linux/fs/open.c)

if ((inode->i_mode & S_ISUID) == S_ISUID &&
!S_ISDIR(inode->i_mode)
&& current->fsuid)
{
newattrs.ia_mode &= ~S_ISUID;
newattrs.ia_valid |= ATTR_MODE;
}

where is used to be:

if (inode->i_mode & S_ISUID) {
newattrs.ia_mode &= ~S_ISUID;
newattrs.ia_valid |= ATTR_MODE;
}

G'day!
-- n i c h o l a s j l e o n
elegance through simplicity*http://mrnick.binary9.net*nicholas@binary9.net
good fortune through truth*roaming:njllm@email.msn.com*ICQ#2170994*U+($++)
TRA#6805*not all questions have answers*pseudogeek:P+++($++)L+($++)W=lm@b9

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/