c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2025-01-27 18:34:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix NFS sticky bit permission denied error

Browse Source 
When zfs_sticky_remove_access() was originally adapted for Linux
a typo was made which altered the intended behavior.  As described
in the block comment, the intended behavior is that permission
should be granted when the entry is a regular file and you have
write access.  That is, S_ISREG should have been used instead of
S_ISDIR.

Restricting permission to regular files made good sense for older
systems where setting the bit on executable files would instruct
the system to save the program's text segment on the swap device.

On modern systems this behavior has been replaced by the sticky
bit acting as a restricted deletion flag and the plain file
restriction has been relaxed.

Reviewed-by: George Melikov <mail@gmelikov.ru>
Reviewed-by: Giuseppe Di Natale <dinatale2@llnl.gov>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #6889 
Closes #6910
This commit is contained in:
Brian Behlendorf 2017-12-04 11:55:57 -08:00 committed by GitHub
parent 9717fe052b
commit 7b3407003f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
module/zfs/zfs_dir.c
View File

@ -1126,7 +1126,7 @@ top:
*
* you own the directory,
* you own the entry,
* the entry is a plain file and you have write access,
* you have write access to the entry,
* or you are privileged (checked in secpolicy...).
*
* The function returns 0 if remove access is granted.
@ -1151,8 +1151,7 @@ zfs_sticky_remove_access(znode_t *zdp, znode_t *zp, cred_t *cr)
cr, ZFS_OWNER);
if ((uid = crgetuid(cr)) == downer || uid == fowner ||
(S_ISDIR(ZTOI(zp)->i_mode) &&
zfs_zaccess(zp, ACE_WRITE_DATA, 0, B_FALSE, cr) == 0))
zfs_zaccess(zp, ACE_WRITE_DATA, 0, B_FALSE, cr) == 0)
return (0);
else
return (secpolicy_vnode_remove(cr));