[LU-4703] setxattr(2) will succeed by a non root user, against a file the user doesn't own.

Duplicate — Wed, 12 Mar 2014 22:30:59 +0000

[root@localhost ~]# mount -t lustre 192.168.122.225@tcp:/testfs /mnt/
[root@localhost ~]# ll /mnt/
total 8
drwxr-xr-x 2 dyl900 users 4096 Mar 4 16:08 dyl900
drwxr-xr-x 2 mxa900 users 4096 Mar 4 16:08 mxa900
[root@localhost ~]# su - dyl900
[dyl900@localhost ~]$ cd /mnt/
[dyl900@localhost mnt]$ getfacl ./mxa900

file: mxa900/
owner: mxa900
group: users
user::rwx
group::r-x
other::r-x

[dyl900@localhost mnt]$ setfacl -m u:dyl900:rwx ./mxa900
[dyl900@localhost mnt]$ getfacl ./mxa900

file: mxa900/
owner: mxa900
group: users
user::rwx
user:dyl900:rwx
group::r-x
mask::rwx
other::r-x

On our production system, this allows a user access other users' files...

Whamcloud Community JIRA

[LU-4703] setxattr(2) will succeed by a non root user, against a file the user doesn't own.