fanotify: if set by user unset FMODE_NONOTIFY before fsnotify_perm() is called

LinoSanfilippo333 · eparis · commit b1085ba80cd2 · 2010-12-07T16:14:21.000-05:00
Unsetting FMODE_NONOTIFY in fsnotify_open() is too late, since fsnotify_perm()
is called before. If FMODE_NONOTIFY is set fsnotify_perm() will skip permission
checks, so a user can still disable permission checks by setting this flag
in an open() call.
This patch corrects this by unsetting the flag before fsnotify_perm is called.

Signed-off-by: Lino Sanfilippo &lt;LinoSanfilippo@gmx.de&gt;
Signed-off-by: Eric Paris &lt;eparis@redhat.com&gt;
diff --git a/fs/namei.c b/fs/namei.c
@@ -1748,6 +1748,9 @@ struct file *do_filp_open(int dfd, const char *pathname,
 	if (!(open_flag & O_CREAT))
 		mode = 0;
 
+	/* Must never be set by userspace */
+	open_flag &= ~FMODE_NONOTIFY;
+
 	/*
 	 * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
 	 * check for O_DSYNC if the need any syncing at all we enforce it's
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
@@ -235,9 +235,6 @@ static inline void fsnotify_open(struct file *file)
 	if (S_ISDIR(inode->i_mode))
 		mask |= FS_ISDIR;
 
-	/* FMODE_NONOTIFY must never be set from user */
-	file->f_mode &= ~FMODE_NONOTIFY;
-
 	fsnotify_parent(path, NULL, mask);
 	fsnotify(inode, mask, path, FSNOTIFY_EVENT_PATH, NULL, 0);
 }

Original file line number	Diff line number	Diff line change
`@@ -235,9 +235,6 @@ static inline void fsnotify_open(struct file *file)`
`235`	`235`	`if (S_ISDIR(inode->i_mode))`
`236`	`236`	`mask \|= FS_ISDIR;`
`237`	`237`
`238`		`- /* FMODE_NONOTIFY must never be set from user */`
`239`		`- file->f_mode &= ~FMODE_NONOTIFY;`
`240`		`-`
`241`	`238`	`fsnotify_parent(path, NULL, mask);`
`242`	`239`	`fsnotify(inode, mask, path, FSNOTIFY_EVENT_PATH, NULL, 0);`
`243`	`240`	`}`