another patch

diff --git a/queue/series b/queue/series
index 3f6bd72e8de6e925df0217b0235b25834aaa704d..767467e8373f60e1b230a2aae2609bccfb4bead3 100644 (file)
--- a/queue/series
+++ b/queue/series
@@ -16,3 +16,4 @@ input-fix-an-OOPS-in-HID-driver.patch
 kernel-params.c-fix-sysfs-access-with-config_modules-n.patch
 scsi-fix-transfer-direction-in-sd.patch
 scsi-fix-transfer-direction-in-scsi_lib-and-st.patch
+setting-acls-on-readonly-mounted-nfs-filesystems.patch

diff --git a/queue/setting-acls-on-readonly-mounted-nfs-filesystems.patch b/queue/setting-acls-on-readonly-mounted-nfs-filesystems.patch
new file mode 100644 (file)
index 0000000..90454a6
--- /dev/null
+++ b/queue/setting-acls-on-readonly-mounted-nfs-filesystems.patch
@@ -0,0 +1,46 @@
+From security-bounces@linux.kernel.org Tue Dec 20 07:32:55 2005
+Date: Tue, 20 Dec 2005 16:29:05 +0100
+From: Marcus Meissner <meissner@suse.de>
+To: Trond.Myklebust@netapp.com
+Message-ID: <20051220152905.GA28537@suse.de>
+Cc: Chris L Mason <mason@suse.de>, Andreas Gruenbacher <agruen@suse.de>
+Subject: setting ACLs on readonly mounted NFS filesystems (CVE-2005-3623)
+
+From: Andreas Gruenbacher <agruen@suse.de>
+
+We must check for MAY_SATTR before setting acls, which includes
+checking for read-only exports: the lower-level setxattr operation
+that eventually sets the acl cannot check export-level restrictions.
+
+Bug reported by Martin Walter <mawa@uni-freiburg.de>.
+
+Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs2acl.c |    2 +-
+ fs/nfsd/nfs3acl.c |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.14.4.orig/fs/nfsd/nfs2acl.c
++++ linux-2.6.14.4/fs/nfsd/nfs2acl.c
+@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct sv
+       dprintk("nfsd: SETACL(2acl)   %s\n", SVCFH_fmt(&argp->fh));
+ 
+       fh = fh_copy(&resp->fh, &argp->fh);
+-      nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
++      nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
+ 
+       if (!nfserr) {
+               nfserr = nfserrno( nfsd_set_posix_acl(
+--- linux-2.6.14.4.orig/fs/nfsd/nfs3acl.c
++++ linux-2.6.14.4/fs/nfsd/nfs3acl.c
+@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_
+       int nfserr = 0;
+ 
+       fh = fh_copy(&resp->fh, &argp->fh);
+-      nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
++      nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
+ 
+       if (!nfserr) {
+               nfserr = nfserrno( nfsd_set_posix_acl(