Re: [PATCH] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

[Namjae Jeon]

> On Wed, Jul 15, 2026 at 9:23 PM Jiangshan Yi <yijiangshan@xxxxxxxxxx> wrote:
> >
> > When a file has the setuid or setgid bit set and is written to, the VFS
> > strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID
> > together with an ATTR_MODE carrying the already-cleared mode.
> >
> > Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped
> > ATTR_MODE in that case:
> >
> >         /* skip mode change if it's just for clearing setuid/setgid */
> >         if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
> >                 attrs->ia_valid &= ~ATTR_MODE;
> >
> > This is fine for the default mount, where the mode is only emulated via
> > the DOS read-only attribute and cannot represent the setuid/setgid bits
> > anyway.  However, with the "cifsacl" or "modefromsid" mount options the
> > mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with
> > the SMB3.1.1 POSIX extensions the mode is sent to the server directly,
> > and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent
> > via CIFSSMBUnixSetPathInfo().  In all those cases dropping ATTR_MODE means
> > the cleared mode is never pushed to the server, so the setuid/setgid bit
> > survives the write.
> >
> > This is a security issue: on local filesystems the setuid bit is stripped
> > when a file is written, but over these cifs.ko mounts the bit persists on
> > the server, potentially allowing an unexpected privilege escalation on
> > subsequent execution.
> >
> > Fix this in two places:
> >
> >   1. cifs_setattr_nounix(): only take the "skip mode change" shortcut
> >      when the mode is emulated via the DOS read-only attribute (i.e.
> >      neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are
> >      in effect), so that the cleared mode is propagated to the server
> >      in the ACL / POSIX cases.
> >
> >   2. cifs_setattr_unix(): this function is only called when Unix
> >      extensions are in effect, so the mode is always stored on the
> >      server.  Remove the shortcut entirely so that the cleared mode is
> >      always pushed.
> >
> > Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>
I will apply it to #for-next.
Thanks!