Fri 07 Oct 2011 01:25:48 PM UTC, original submission:
When mounting a folder on a remote dcache system with a WebDAV interface, and setting the permissions of the local linux folder that constitutes the mount point, to rwxrwx---, so that only the user and the group should be able to access the folder, it is still accessible by others.
I realized the problem in a davfs2/autofs setup, but have now verified that the same happens also without autofs.
First, I created a folder like this:
[root@...]# pwd
/swestore-test
[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104 7 okt 14.54 samuels-test
[root@...]#
Then I mounted a remote folder like so:
mount.davfs -o file_mode=660,dir_mode=770,uid=samuel,gid=some_group,rw,noexec https://gunge.hpc2n.umu.se:1443/snic/uppnex/test/samuels-test samuels-test/
... and verified that permissions were still set correctly:
[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104 7 okt 14.54 samuels-test
... and created a test file in it:
echo "hej" > samuels-test/hej
Then I su:ed to another user, which was not a member of the "some_group" that owned the directory (checked with the "groups" command). Still this user could cd in to the directory and view the file created in it.
I can come around this problem by restricting the access rights to of the parent directory (setting rwxrwx--- and user/group to samuel:some_group). Then this other user could not access neither the parent folder, or the mount point itself.
I guess this points to the mount-operation as being the seeminbly faulty part. The permission it tells to linux, and how it operates in reality, are different.
System info
The computer where this happened runs:
- Scientific Linux 6.1 (Carbon)
- Kernel: 2.6.32-131.12.1.el6.x86_64 #1 SMP
- Davfs2 version 1.4.6 (from yum repos)
|