maindavfs2 - Support: sr #107832, Davfs2 does not respect unix/linux...

 
 

sr #107832: Davfs2 does not respect unix/linux group permissions for the mount point

Submitter:  None
Submitted:  Fri 07 Oct 2011 01:25:48 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  _71007
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 20 Apr 2014 05:58:54 PM UTC, comment #4: 

The problem is fixed in the CVS sources.

Werner

- <_71007>
Sun 20 May 2012 09:49:26 PM UTC, comment #3: 

I could reproduce that problem on my own systems.

The function "has_permission" in cache.c checks for (non-)membership of the current owner in the group by the following code:

while (*members && strcmp(*members, pw->pw_name) == 0) members++;
if (!*members) return 0;

However, strcmp returns 0 if and only if both strings are equal. So it should be strcmp(*members, pw->pw_name) != 0.

Benedikt Wildenhain <bwildenhain>
Wed 26 Oct 2011 10:32:16 AM UTC, comment #2: 

Hi, thanks for the response. I have tested now on another server, and the problem seems to be specific for servers where we have user authentication via LDAP, so I should try to dig more in this directions.

Thanks
// Samuel

Samuel Lampa <samuellampa>
Sat 08 Oct 2011 03:49:21 PM UTC, comment #1: 

I can't reproduce this. I will get 'access denied' on my system.

So please enable 'debug most' and send the debug messages that are logged while the file system is mounted and accessed by a user that should not be allowed to.

Is there anything unusual with your user and group data base that might cause standard libc functions to return wrong information (functions like getpwuid and getgrgid).

Werner

- <_71007>
Fri 07 Oct 2011 01:25:48 PM UTC, original submission:  

When mounting a folder on a remote dcache system with a WebDAV interface, and setting the permissions of the local linux folder that constitutes the mount point, to rwxrwx---, so that only the user and the group should be able to access the folder, it is still accessible by others.

I realized the problem in a davfs2/autofs setup, but have now verified that the same happens also without autofs.

First, I created a folder like this:

[root@...]# pwd
/swestore-test
[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104  7 okt 14.54 samuels-test
[root@...]#

Then I mounted a remote folder like so:

mount.davfs -o file_mode=660,dir_mode=770,uid=samuel,gid=some_group,rw,noexec https://gunge.hpc2n.umu.se:1443/snic/uppnex/test/samuels-test samuels-test/

... and verified that permissions were still set correctly:

[root@...]# ls -l
total 1
drwxrwx--- 3 samuel some_group 104  7 okt 14.54 samuels-test

... and created a test file in it:

echo "hej" > samuels-test/hej

Then I su:ed to another user, which was not a member of the "some_group" that owned the directory (checked with the "groups" command). Still this user could cd in to the directory and view the file created in it.

I can come around this problem by restricting the access rights to of the parent directory (setting rwxrwx--- and user/group to samuel:some_group). Then this other user could not access neither the parent folder, or the mount point itself.

I guess this points to the mount-operation as being the seeminbly faulty part. The permission it tells to linux, and how it operates in reality, are different.

System info

The computer where this happened runs:

  • Scientific Linux 6.1 (Carbon)
  • Kernel: 2.6.32-131.12.1.el6.x86_64 #1 SMP
  • Davfs2 version 1.4.6 (from yum repos)
Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bwildenhain (Posted a comment)
  • -email is unavailable- added by samuellampa (Posted a comment)
  • -email is unavailable- added by _71007 (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-04-20 _71007 StatusNeed Info Done
        Open/ClosedOpen Closed
    2011-10-08 _71007 StatusNone Need Info
        Assigned toNone _71007

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code