tree b97e9c9aed1c32b44c84c68d948ee38caf659783
parent fc4485ddd935643250a6234bb83b8d5fa5ea1fe0
author Linus Torvalds <torvalds@linux-foundation.org> 1530663019 -0700
committer Maarten Derks <maarten@fairphone.com> 1554817481 +0200

Fix up non-directory creation in SGID directories

commit 0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 upstream.

sgid directories have special semantics, making newly created files in
the directory belong to the group of the directory, and newly created
subdirectories will also become sgid.  This is historically used for
group-shared directories.

But group directories writable by non-group members should not imply
that such non-group members can magically join the group, so make sure
to clear the sgid bit on non-directories for non-members (but remember
that sgid without group execute means "mandatory locking", just to
confuse things even more).

Issue: SEC-1671
Reported-by: Jann Horn <jannh@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Bug: 113452403
Bug: 122360694
Test: build
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9c5ab371e9ca3bfe0816ad6cfe002471ada8cc2f
(adapted from commit 4170a5d2cd5091e076c8d2c9682122cee71ca672)