Commit b7964c3d authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Linus Torvalds

[PATCH] nfsd: check for read-only exports before setting acls

We must check for MAY_SATTR before setting acls, which includes checking
for read-only exports: the lower-level setxattr operation that
eventually sets the acl cannot check export-level restrictions.

Bug reported by Martin Walter <mawa@uni-freiburg.de>.
Signed-off-by: default avatarAndreas Gruenbacher <agruen@suse.de>
Acked-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 9e283939
...@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct svc_rqst * rqstp, ...@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct svc_rqst * rqstp,
dprintk("nfsd: SETACL(2acl) %s\n", SVCFH_fmt(&argp->fh)); dprintk("nfsd: SETACL(2acl) %s\n", SVCFH_fmt(&argp->fh));
fh = fh_copy(&resp->fh, &argp->fh); fh = fh_copy(&resp->fh, &argp->fh);
nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
if (!nfserr) { if (!nfserr) {
nfserr = nfserrno( nfsd_set_posix_acl( nfserr = nfserrno( nfsd_set_posix_acl(
......
...@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_rqst * rqstp, ...@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_rqst * rqstp,
int nfserr = 0; int nfserr = 0;
fh = fh_copy(&resp->fh, &argp->fh); fh = fh_copy(&resp->fh, &argp->fh);
nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
if (!nfserr) { if (!nfserr) {
nfserr = nfserrno( nfsd_set_posix_acl( nfserr = nfserrno( nfsd_set_posix_acl(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment