[PATCH] ntfs: require owner privileges for system attribute xattrs

ntfs_setxattr() allows system.dos_attrib and system.ntfs_attrib to update
NTFS file attributes. These attributes affect the inode mode because the
READONLY flag is mapped to the write permission bits.

Require the caller to own the inode or hold CAP_FOWNER before accepting
updates to these xattrs. This prevents unprivileged callers from changing
file mode semantics through NTFS attribute updates.

Cc: [email protected]
Signed-off-by: Hongling Zeng <[email protected]>
---
 fs/ntfs/ea.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index 4fbea76afe7e..5cd5a4a02d1e 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -820,6 +820,18 @@ static int ntfs_setxattr(const struct xattr_handler *handler,
 	if (NVolShutdown(ni->vol))
 		return -EIO;
 
+	/*
+	 * system.dos_attrib and system.ntfs_attrib affect file permissions
+	 * (READONLY flag maps to write permissions). Require owner or
+	 * CAP_FOWNER to prevent unauthorized access control bypass.
+	 */
+	if (!strcmp(name, SYSTEM_DOS_ATTRIB) ||
+	    !strcmp(name, SYSTEM_NTFS_ATTRIB) ||
+	    !strcmp(name, SYSTEM_NTFS_ATTRIB_BE)) {
+		if (!inode_owner_or_capable(idmap, inode))
+			return -EPERM;
+	}
+
 	if (!strcmp(name, SYSTEM_DOS_ATTRIB)) {
 		if (sizeof(u8) != size) {
 			err = -EINVAL;
-- 
2.25.1