HEADS UP: Important bug fix in ZFS replay code!

[Pawel Jakub Dawidek]

Hi.

There was important bug in ZFS replay code. If there were setattr logs
(not related to permission change) in ZIL during unclean shutdown, one
can end up with files that have mode set to 07777.

This is very dangerous, especially if you have untrusted local users, as
this will set setuid bit on such files. Note that FreeBSD will remove
setuid bits when someone will try to modify the file, but it is still
dangerous.

You can locate such files with the following command:

	# find / -perm -7777 -print0 | xargs -0 ls -ld

You can locate and fix such files with the following command:

	# find / -perm -7777 -print0 | xargs -0 chmod a-s,o-w,-t

On Tue, Nov 10, 2009 at 10:27:33PM +0000, Pawel Jakub Dawidek wrote:
> Author: pjd
> Date: Tue Nov 10 22:27:33 2009
> New Revision: 199157
> URL: http://svn.freebsd.org/changeset/base/199157
> 
> Log:
>   Be careful which vattr fields are set during setattr replay.
>   Without this fix strange things can appear after unclean shutdown like
>   files with mode set to 07777.
>   
>   Reported by:	des
>   MFC after:	3 days
> 
> Modified:
>   head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
> 
> Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
> ==============================================================================
> --- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c	Tue Nov 10 22:25:46 2009	(r199156)
> +++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c	Tue Nov 10 22:27:33 2009	(r199157)
> @@ -60,10 +60,14 @@ zfs_init_vattr(vattr_t *vap, uint64_t ma
>  {
>  	VATTR_NULL(vap);
>  	vap->va_mask = (uint_t)mask;
> -	vap->va_type = IFTOVT(mode);
> -	vap->va_mode = mode & MODEMASK;
> -	vap->va_uid = (uid_t)(IS_EPHEMERAL(uid)) ? -1 : uid;
> -	vap->va_gid = (gid_t)(IS_EPHEMERAL(gid)) ? -1 : gid;
> +	if (mask & AT_TYPE)
> +		vap->va_type = IFTOVT(mode);
> +	if (mask & AT_MODE)
> +		vap->va_mode = mode & MODEMASK;
> +	if (mask & AT_UID)
> +		vap->va_uid = (uid_t)(IS_EPHEMERAL(uid)) ? -1 : uid;
> +	if (mask & AT_GID)
> +		vap->va_gid = (gid_t)(IS_EPHEMERAL(gid)) ? -1 : gid;
>  	vap->va_rdev = zfs_cmpldev(rdev);
>  	vap->va_nodeid = nodeid;
>  }

-- 
Pawel Jakub Dawidek                       http://www.wheel.pl
pjd at FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20091110/9ffc89b7/attachment.pgp