summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGobinda Charan Maji <gobinda.cemk07@gmail.com>2015-05-27 11:09:38 +0930
committerRusty Russell <rusty@rustcorp.com.au>2015-05-28 11:32:09 +0930
commit28b8d0c8f560300836dff352348e513cdf328e50 (patch)
tree1386c9e820f553b034a29219a9fc8349b533c258
parent4f666546d047752c17265f4641cc9470c1cbaed4 (diff)
downloadlinux-stable-28b8d0c8f560300836dff352348e513cdf328e50.tar.gz
linux-stable-28b8d0c8f560300836dff352348e513cdf328e50.tar.bz2
linux-stable-28b8d0c8f560300836dff352348e513cdf328e50.zip
sysfs: tightened sysfs permission checks
There were some inconsistency in restriction to VERIFY_OCTAL_PERMISSIONS(). Previously the test was "User perms >= group perms >= other perms". The permission field of User, Group or Other consists of three bits. LSB is EXECUTE permission, MSB is READ permission and the middle bit is WRITE permission. But logically WRITE is "more privileged" than READ. Say for example, permission value is "0430". Here User has only READ permission whereas Group has both WRITE and EXECUTE permission. So, the checks could be tightened and the tests are separated to USER_READABLE >= GROUP_READABLE >= OTHER_READABLE, USER_WRITABLE >= GROUP_WRITABLE and OTHER_WRITABLE is not permitted. Signed-off-by: Gobinda Charan Maji <gobinda.cemk07@gmail.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
-rw-r--r--include/linux/kernel.h18
1 files changed, 10 insertions, 8 deletions
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 3a5b48e52a9e..cd54b357c934 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -818,13 +818,15 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
#endif
/* Permissions on a sysfs file: you didn't miss the 0 prefix did you? */
-#define VERIFY_OCTAL_PERMISSIONS(perms) \
- (BUILD_BUG_ON_ZERO((perms) < 0) + \
- BUILD_BUG_ON_ZERO((perms) > 0777) + \
- /* User perms >= group perms >= other perms */ \
- BUILD_BUG_ON_ZERO(((perms) >> 6) < (((perms) >> 3) & 7)) + \
- BUILD_BUG_ON_ZERO((((perms) >> 3) & 7) < ((perms) & 7)) + \
- /* Other writable? Generally considered a bad idea. */ \
- BUILD_BUG_ON_ZERO((perms) & 2) + \
+#define VERIFY_OCTAL_PERMISSIONS(perms) \
+ (BUILD_BUG_ON_ZERO((perms) < 0) + \
+ BUILD_BUG_ON_ZERO((perms) > 0777) + \
+ /* USER_READABLE >= GROUP_READABLE >= OTHER_READABLE */ \
+ BUILD_BUG_ON_ZERO((((perms) >> 6) & 4) < (((perms) >> 3) & 4)) + \
+ BUILD_BUG_ON_ZERO((((perms) >> 3) & 4) < ((perms) & 4)) + \
+ /* USER_WRITABLE >= GROUP_WRITABLE */ \
+ BUILD_BUG_ON_ZERO((((perms) >> 6) & 2) < (((perms) >> 3) & 2)) + \
+ /* OTHER_WRITABLE? Generally considered a bad idea. */ \
+ BUILD_BUG_ON_ZERO((perms) & 2) + \
(perms))
#endif