bugdavfs2 - Bugs: bug #33644, check for group membership does...

 
 

bug #33644: check for group membership does not work in any case

Submitter:  None
Submitted:  Sat 25 Jun 2011 04:39:19 PM UTC
   
 
Category:  None Severity:  4 - Important
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  _71007
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 12 Mar 2014 05:05:50 PM UTC, comment #8: 

Fixed in CVS branch MAIN and branch rel-1-4-6

 - <_71007>
Thu 19 Jul 2012 04:25:18 PM UTC, comment #7: 

These are indeed three different bugs.

Two of them are fixed in version 1.4.7

But this one is still open:
However, AFAIK the function has_permission still has another, less important, issue: Using mode xyz the file or directory will have mode (x|z)(y|z)z, because whenever an access will be allowed for "other" users, it will be granted.

 - <_71007>
Sun 03 Jun 2012 10:37:44 AM UTC, comment #6: 

Thanks for hinting at these two bugs.
The first one (strcmp.. == 0) is now fixed in CVS.
The second one will take some time.

Cheers
Werner

- <_71007>
Mon 14 May 2012 03:37:45 PM UTC, comment #5: 

The quick fix of this security problem is rather simple, you only have to change strcmp … == 0 to strmp … != 0 in the function "has_permission" in cache.c.

However, AFAIK the function has_permission still has another, less important, issue: Using mode xyz the file or directory will have mode (x|z)(y|z)z, because whenever an access will be allowed for "other" users, it will be granted.

Greetings,
Benedikt

 Benedikt Wildenhain <bwildenhain>
Thu 06 Oct 2011 06:31:29 PM UTC, comment #4: 

I think this problem is unrelated.

Please open a new support tracker item. Usefull additional information would be:

  • does this problem only arise whem mounting with autofs?
  • the fstab entry.
  • when mounting with autofs: please add option 'debug most' to your config file before the file system is mounted. When the file system is mounted do a simple read for one small file and include the mount.davfs log entries.


Werner

 - <_71007>
Wed 05 Oct 2011 05:39:48 PM UTC, comment #3: 

Could this bug be the reason for my problem with using davfs2 with autofs, where by setting the dir_mode=770,file_mode=660, I see the correct UNIX permissions set (rwxrwx---), but still can access mounted folders even if I'm not in the correct group?

(Can get back with more details if it is related ... otherwise I guess I should issue a new bug?)

 Samuel Lampa <samuellampa>
Sat 25 Jun 2011 04:39:19 PM UTC, comment #2: 

This item has been reassigned from the project davfs2 support tracker to your tracker.

The original report is still available at support #107725

Following are the information included in the original report:

[field #0]                  Item ID: 107725
[field #1]                 Group ID: 10199
[field #2]              Open/Closed: Open
[field #3]                 Severity: 4 - Important
[field #4]                  Privacy: Public
[field #7]                         : Unknown support Field Display Type
[field #8]                         : Unknown support Field Display Type
[field #9]                 Category: None
[field #10]             Submitted by: None
[field #11]              Assigned to: wbaumann
[field #12]             Submitted on: Tue 21 Jun 2011 04:21:19 PM GMT
[field #13]                  Summary: check for group membership does not work in any case
[field #14]      Original Submission: In my case the davfs2 group is added via pam_group.so

This results in an empty list as getgrent result.

Everything works fine however if getgroups is used instead of getgrent for checking group memberships.

The attached patch is doing exactly this.
[field #16]               Item Group: None
[field #17]                   Status: Confirmed
[field #18]        Component Version: None
[field #19]         Operating System: GNU/Linux
[field #20]          Reproducibility: None
[field #21]               Size (loc): None
[field #22]            Fixed Release: None
[field #23]          Planned Release: None
[field #24]                   Effort: 0.00
[field #28]                 Priority: 5 - Normal
[field #31]         Percent Complete: 0%
[field #33]                  Release: None
[field #36]         Originator Email: sven-savannah-bugs@geggus.net
[field #58]     Custom Select Box #1: None
[field #59]     Custom Select Box #2: None
[field #60]     Custom Select Box #3: None
[field #61]     Custom Select Box #4: None
[field #62]     Custom Select Box #5: None
[field #63]     Custom Select Box #6: None
[field #64]     Custom Select Box #7: None
[field #65]     Custom Select Box #8: None
[field #66]     Custom Select Box #9: None
[field #67]    Custom Select Box #10: None

 - <_71007>
Sat 25 Jun 2011 04:38:26 PM UTC, comment #1: 

Thanks for the report and the patch and sorry for the delayed answer (I always intended to answer first thing next day).

Because of portability issues with seteuid I want to reorganize all the code that deals with the persona of the process. When doing this I will follow your advice and use getgroups.

I will move this item to the bug tracker so I will not forgett about it.

Cheers
Werner

- <_71007>
Sat 25 Jun 2011 04:39:19 PM UTC, original submission:  

In my case the davfs2 group is added via pam_group.so

This results in an empty list as getgrent result.

Everything works fine however if getgroups is used instead of getgrent for checking group memberships.

The attached patch is doing exactly this.

 Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #23546:  getgroups.diff added by None (1KiB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bwildenhain (Posted a comment)
  • -email is unavailable- added by samuellampa (Posted a comment)
  • -email is unavailable- added by _71007 (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-04-22 _71007 Open/ClosedOpen Closed
    2014-03-12 _71007 StatusPostponed Fixed
    2012-07-19 _71007 StatusIn Progress Postponed
    2011-06-25 _71007 StatusNone In Progress
        Assigned toNone _71007
    2011-06-25 _71007 Reassign itemdavfs2, sr #107725 davfs2, bug #33644

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-72d9.
    Corresponding source code