fix setuid sometimes wouldn't
commit6560e7a44e83e8dd111c64e3ed77ad08d2550e23
authorHugh Dickins <hugh@veritas.com>
Sat, 28 Mar 2009 23:21:27 +0000 (28 23:21 +0000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 8 May 2009 22:45:06 +0000 (8 15:45 -0700)
tree95c3a639a1e2d4d65c9ef35cc6b07a937a79c6d4
parent47fc5f8d08deb87841757643affa95eeeda3c39d
fix setuid sometimes wouldn't

commit 7c2c7d993044cddc5010f6f429b100c63bc7dffb upstream.

check_unsafe_exec() also notes whether the fs_struct is being
shared by more threads than will get killed by the exec, and if so
sets LSM_UNSAFE_SHARE to make bprm_set_creds() careful about euid.
But /proc/<pid>/cwd and /proc/<pid>/root lookups make transient
use of get_fs_struct(), which also raises that sharing count.

This might occasionally cause a setuid program not to change euid,
in the same way as happened with files->count (check_unsafe_exec
also looks at sighand->count, but /proc doesn't raise that one).

We'd prefer exec not to unshare fs_struct: so fix this in procfs,
replacing get_fs_struct() by get_fs_path(), which does path_get
while still holding task_lock, instead of raising fs->count.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/proc/base.c