[LU-4704] Permission checking is missing when setfacl

Duplicate — Fri, 30 May 2014 14:52:53 +0000

Setxattr does not check the permission when setting ACL xattrs. This
will cause security problem because any user can walk around permission
checking by changing ACL rules.

Following script will reproduce this problem.
#!/bin/bash
DIR=/mnt/lustre/dir

we can got this from Lustre/test
RUNAS=./runas
rmdir $DIR
if [ -e $DIR ]; then
echo "Please remove $DIR"
exit 1
fi

mkdir $DIR
if [ ! -d $DIR ]; then
echo "Faled to mkdir $DIR"
exit 1
fi

chmod 700 $DIR

$RUNAS -u test ls $DIR
if [ $? -eq 0 ]; then
echo "Permission error"
exit 1
fi

$RUNAS -u test setfacl -m u:test:rwx $DIR
if [ $? -ne 0 ]; then
echo "Probelm not reproduced because setfacl failed"
exit 1
fi

echo "Probelm reproduced!!"

$RUNAS -u test ls $DIR
if [ $? -ne 0 ]; then
echo "ACL does not work!"
exit 1
fi

echo "Security problem!!"

Whamcloud Community JIRA

[LU-4704] Permission checking is missing when setfacl