[PATCH] ntfs3: add permission checks for NTFS system attributes

[Hongling Zeng]

ntfs3_setxattr() allows system.dos_attrib, system.ntfs_attrib, and
system.ntfs_attrib_be to update NTFS file attributes without permission
checks. These attributes affect the inode mode because the READONLY flag
is mapped to write permission bits, allowing unprivileged users to bypass
file access controls.

system.ntfs_security allows modifying NTFS security descriptors which
control access control. Similar to POSIX ACLs where file owners can
modify access permissions, require inode owner or CAP_FOWNER for these
NTFS system attributes.

Fixes: 4534a70b7056 ("fs/ntfs3: Add headers and misc files")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
---
 fs/ntfs3/xattr.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index 7a81369a1173..4e41aca0d5c7 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -868,6 +868,22 @@ static noinline int ntfs_setxattr(const struct xattr_handler *handler,
 	struct ntfs_inode *ni = ntfs_i(inode);
 	enum FILE_ATTRIBUTE new_fa;
 
+	/*
+	 * system.dos_attrib and system.ntfs_attrib affect file permissions
+	 * because the READONLY flag is mapped to write permission bits.
+	 * system.ntfs_security controls NTFS security descriptors.
+	 *
+	 * Require the caller to own the inode or hold CAP_FOWNER before allowing
+	 * these NTFS system attributes to be changed.
+	 */
+	if (!strcmp(name, SYSTEM_DOS_ATTRIB) ||
+	    !strcmp(name, SYSTEM_NTFS_ATTRIB) ||
+	    !strcmp(name, SYSTEM_NTFS_ATTRIB_BE) ||
+	    !strcmp(name, SYSTEM_NTFS_SECURITY)) {
+		if (!inode_owner_or_capable(idmap, inode))
+			return -EPERM;
+	}
+
 	/* Dispatch request. */
 	if (!strcmp(name, SYSTEM_DOS_ATTRIB)) {
 		if (sizeof(u8) != size)
-- 
2.25.1