Subject: Re: Group man to group root privilege escalation
From: Linus Torvalds
To: Andy Lutomirski
Cc: "security at kernel.org", halfdog, Kees Cook, Al Viro
Date: Wed, 24 Jun 2015 15:06:21 -0700

On Wed, Jun 24, 2015 at 2:45 PM, Linus Torvalds wrote:
>
> Ahh, yes. Ok, I agree, we should probably do both - use f_cred for the
> suid removal check, *and* make sure that group-sticky directories
> clear the sgid bit on file creation.

Maybe something fairly simple like this for the SGID case?

                    Linus
 fs/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/inode.c b/fs/inode.c
index e8d62688ed91..7bde0ad673e4 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1898,6 +1898,8 @@ void inode_init_owner(struct inode *inode, const struct inode *dir,
 		inode->i_gid = dir->i_gid;
 		if (S_ISDIR(mode))
 			mode |= S_ISGID;
+		else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
+			mode &= ~S_ISGID;
 	} else
 		inode->i_gid = current_fsgid();
 	inode->i_mode = mode;