)]}' { "commit": "1c608665edb5162ebe8c59325c02049995458c42", "tree": "3c6fc9c91190ccbd9204ff55b71717308d65de42", "parents": [ "d8b62ba3739bda836b01d2465fbe7176911c1409" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Apr 29 11:18:22 2025 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Tue Jul 28 14:22:05 2026 +0100" }, "message": "afs, bash: Fix open(O_CREAT) on an extant AFS file in a sticky dir\n\nSince version 1.11 (January 1992) Bash has a work around in redir_open()\nthat causes open(O_CREAT) of a file to be retried without O_CREAT if open()\nfails with an EACCES error if bash was built with AFS workarounds\nconfigured:\n\n #if defined (AFS)\n if ((fd \u003c 0) \u0026\u0026 (errno \u003d\u003d EACCES))\n {\n fd \u003d open (filename, flags \u0026 ~O_CREAT, mode);\n errno \u003d EACCES; /* restore errno */\n }\n\n #endif /* AFS */\n\nThe ~O_CREAT fallback logic was introduced to workaround a bug[1] in the\nIBM AFS 3.1 cache manager and server which can return EACCES in preference\nto EEXIST if the requested file exists but the caller is neither granted\nexplicit PRSFS_READ permission nor is the file owner and is granted\nPRSFS_INSERT permission on the directory. IBM AFS 3.2 altered the cache\nmanager permission checks but failed to correct the permission checks in\nthe AFS server. As of this writing, all IBM AFS derived servers continue\nto return EACCES in preference to EEXIST when these conditions are met.\nBug reports have been filed with all implementations.\n\nAs an unintended side effect, the Bash fallback logic also undermines the\nLinux kernel protections against O_CREAT opening FIFOs and regular files\nnot owned by the user in world writeable sticky directories - unless the\nowner is the same as that of the directory - as was added in commit\n30aba6656f61e (\"namei: allow restricted O_CREAT of FIFOs and regular\nfiles\").\n\nAs a result the Bash fallback logic masks an incompatibility between the\nownership checks performed by may_create_in_sticky() and network\nfilesystems such as AFS where the uid namespace is disjoint from the uid\nnamespace of the local system.\n\nHowever, the bash work around has been removed in bash-5.3[2].\n\nFix this in the kernel by using a preceding patch that allows the user ID\ncomparisons to be overridden by:\n\n (1) Implement the -\u003eis_owned_by_me() inode op for kafs to determine if the\n caller owns the file by checking to see if the server indicated the\n ADMINISTER bit was set in the access rights returned by the\n FS.FetchStatus and suchlike instead of checking the i_uid to\n current_fsuid().\n\n Unfortunately, this check doesn\u0027t work for directories, but none of\n the ops should require that.\n\n Note that anonymous accesses to AFS will never see the ADMINISTER bit\n being set and so will not be perceived as owning an anonymously-owned\n file.\n\n (2) Implement the -\u003ehave_same_owner() inode op, for kafs to compare the\n AFS owner IDs retrieved by FS.FetchStatus (which are 64-bit integers\n with AuriStor\u0027s YFS server and, as such, won\u0027t fit in a kuid_t).\n\n Note that whilst an anonymously-owned file will match an\n anonymously-owned parent directory, an anonymously-owned directory\n cannot have the sticky bit set.\n\nThis can be tested by creating a sticky directory (the user must have a\ntoken to do this) and creating a file in it. Then strace bash doing \"echo\nfoo \u003e\u003efile\" and look at whether bash does a single, successful O_CREAT open\non the file or whether that one fails and then bash does one without\nO_CREAT that succeeds.\n\nFixes: 30aba6656f61 (\"namei: allow restricted O_CREAT of FIFOs and regular files\")\nReported-by: Etienne Champetier \u003cchampetier.etienne@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Chet Ramey \u003cchet.ramey@case.edu\u003e\ncc: Cheyenne Wills \u003ccwills@sinenomine.net\u003e\ncc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\ncc: Christian Brauner \u003cbrauner@kernel.org\u003e\ncc: Steve French \u003csfrench@samba.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: openafs-devel@openafs.org\ncc: linux-cifs@vger.kernel.org\ncc: linux-fsdevel@vger.kernel.org\nLink: https://groups.google.com/g/gnu.bash.bug/c/6PPTfOgFdL4/m/2AQU-S1N76UJ [1]\nLink: https://git.savannah.gnu.org/cgit/bash.git/tree/redir.c?h\u003dbash-5.3-rc1#n733 [2]\n", "tree_diff": [ { "type": "modify", "old_id": "6df56fe9163fd72eb2ba901b6bdedbd80655983c", "old_mode": 33188, "old_path": "fs/afs/dir.c", "new_id": "ee2f5ec0b2c67d0e69ab15be35428df856639243", "new_mode": 33188, "new_path": "fs/afs/dir.c" }, { "type": "modify", "old_id": "0467742bfeee34f0dbf02621947b7892ffb8a504", "old_mode": 33188, "old_path": "fs/afs/file.c", "new_id": "ba44493ccaf6eedca53dff1eb572333c6dcfb945", "new_mode": 33188, "new_path": "fs/afs/file.c" }, { "type": "modify", "old_id": "14f39a9bea6cfefd6f7da3c35fbbdaed7b350e7c", "old_mode": 33188, "old_path": "fs/afs/inode.c", "new_id": "af85a88d943dd188ced7580216d14f9d7bce0bbd", "new_mode": 33188, "new_path": "fs/afs/inode.c" }, { "type": "modify", "old_id": "290873bac89b3f8f40bf09cade1dd7e77af49049", "old_mode": 33188, "old_path": "fs/afs/internal.h", "new_id": "f15dbbc8dd2649d9c69cc0d28e57d0e29653c3fb", "new_mode": 33188, "new_path": "fs/afs/internal.h" }, { "type": "modify", "old_id": "6d00d62a65edf65ec97747e14b47c1ffeb926b7d", "old_mode": 33188, "old_path": "fs/afs/security.c", "new_id": "7092f5acdcd6ac8e3c631293fdd440a77582f988", "new_mode": 33188, "new_path": "fs/afs/security.c" }, { "type": "modify", "old_id": "16b4823cb7b7e7a432f00aea42f37a9fad39ee76", "old_mode": 33188, "old_path": "fs/afs/symlink.c", "new_id": "ed834ba90e85a4bcdbf9c2f7d8a8ee9798274ebd", "new_mode": 33188, "new_path": "fs/afs/symlink.c" } ] }