helpdavfs2 - Support: sr #107832, Davfs2 does not respect unix/linux...

 
 

sr #107832: Davfs2 does not respect unix/linux group permissions for the mount point

Submitted by:  None
Submitted on:  Fri 07 Oct 2011 01:25:48 PM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: Need Info
Privacy: PublicAssigned to: Werner Baumann <wbaumann>
Originator Email: -unavailable-Open/Closed: Open
Operating System: GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 20 May 2012 09:49:26 PM UTC, comment #3:

I could reproduce that problem on my own systems.

The function "has_permission" in cache.c checks for (non-)membership of the current owner in the group by the following code:

while (members && strcmp(members, pw->pw_name) == 0) members++;
if (!*members) return 0;

However, strcmp returns 0 if and only if both strings are equal. So it should be strcmp(*members, pw->pw_name) != 0.

Benedikt Wildenhain <bwildenhain>
Wed 26 Oct 2011 10:32:16 AM UTC, comment #2:

Hi, thanks for the response. I have tested now on another server, and the problem seems to be specific for servers where we have user authentication via LDAP, so I should try to dig more in this directions.

Thanks
// Samuel

Samuel Lampa <samuellampa>
Sat 08 Oct 2011 03:49:21 PM UTC, comment #1:

I can't reproduce this. I will get 'access denied' on my system.

So please enable 'debug most' and send the debug messages that are logged while the file system is mounted and accessed by a user that should not be allowed to.

Is there anything unusual with your user and group data base that might cause standard libc functions to return wrong information (functions like getpwuid and getgrgid).

Werner

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Fri 07 Oct 2011 01:25:48 PM UTC, original submission:

When mounting a folder on a remote dcache system with a WebDAV interface, and setting the permissions of the local linux folder that constitutes the mount point, to rwxrwx---, so that only the user and the group should be able to access the folder, it is still accessible by others.

I realized the problem in a davfs2/autofs setup, but have now verified that the same happens also without autofs.

First, I created a folder like this:

[root@...]# pwd
/swestore-test
[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104 7 okt 14.54 samuels-test
[root@...]#

Then I mounted a remote folder like so:

mount.davfs -o file_mode=660,dir_mode=770,uid=samuel,gid=some_group,rw,noexec https://gunge.hpc2n.umu.se:1443/snic/uppnex/test/samuels-test samuels-test/

... and verified that permissions were still set correctly:

[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104 7 okt 14.54 samuels-test

... and created a test file in it:

echo "hej" > samuels-test/hej

Then I su:ed to another user, which was not a member of the "some_group" that owned the directory (checked with the "groups" command). Still this user could cd in to the directory and view the file created in it.

I can come around this problem by restricting the access rights to of the parent directory (setting rwxrwx--- and user/group to samuel:some_group). Then this other user could not access neither the parent folder, or the mount point itself.

I guess this points to the mount-operation as being the seeminbly faulty part. The permission it tells to linux, and how it operates in reality, are different.

System info

The computer where this happened runs:

  • Scientific Linux 6.1 (Carbon)
  • Kernel: 2.6.32-131.12.1.el6.x86_64 #1 SMP
  • Davfs2 version 1.4.6 (from yum repos)
Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwildenhain (Posted a comment)
  • -unavailable- added by samuellampa (Posted a comment)
  • -unavailable- added by wbaumann (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 08 Oct 2011 03:49:21 PM UTCwbaumannStatusNone=>Need Info
      Assigned toNone=>wbaumann

    Back to the top


    Powered by Savane 3.1-cleanup