]> git.apps.os.sepia.ceph.com Git - xfstests-dev.git/commit
generic: update setgid tests
authorChristian Brauner <brauner@kernel.org>
Thu, 5 Jan 2023 14:53:36 +0000 (15:53 +0100)
committerZorro Lang <zlang@kernel.org>
Fri, 20 Jan 2023 13:15:24 +0000 (21:15 +0800)
commit81e6f62844992ad2d9e1f6439577a84277282941
tree38ec27d97564b075c332e9e8ce959c01e7f6823a
parente64416195116eb99011d8db1b1c66db234eddb9c
generic: update setgid tests

Over mutiple kernel releases we have reworked setgid inheritance
significantly due to long-standing security issues, security issues that
were reintroduced after they were fixed, and the subtle and difficult
inheritance rules that plagued individual filesystems. We have lifted
setgid inheritance into the VFS proper in earlier patches. Starting with
kernel v6.2 we have made setgid inheritance consistent between the write
and setattr (ch{mod,own}) paths.

The gist of the requirement is that in order to inherit the setgid bit
the user needs to be in the group of the file or have CAP_FSETID in
their user namespace. Otherwise the setgid bit will be dropped
irregardless of the file's executability. Remove the obsolete tests as
they're not a security issue and will cause spurious warnings on older
distro kernels.

Note, that only with v6.2 setgid inheritance works correctly for
overlayfs in the write path. Before this the setgid bit was always
retained.

Link: https://lore.kernel.org/linux-ext4/CAOQ4uxhmCgyorYVtD6=n=khqwUc=MPbZs+y=sqt09XbGoNm_tA@mail.gmail.com
Link: https://lore.kernel.org/linux-fsdevel/20221212112053.99208-1-brauner@kernel.org
Link: https://lore.kernel.org/linux-fsdevel/20221122142010.zchf2jz2oymx55qi@wittgenstein
Cc: Amir Goldstein <amir73il@gmail.com>
Cc: Zorro Lang <zlang@redhat.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Zorro Lang <zlang@redhat.com>
Signed-off-by: Zorro Lang <zlang@kernel.org>
12 files changed:
tests/generic/673
tests/generic/673.out
tests/generic/683
tests/generic/683.out
tests/generic/684
tests/generic/684.out
tests/generic/685
tests/generic/685.out
tests/generic/686
tests/generic/686.out
tests/generic/687
tests/generic/687.out