helpdavfs2 - Support: sr #107641, system wide options result in...

 
 

sr #107641: system wide options result in inconsistent user experience

Submitted by:  Michael R. Crusoe <khedron>
Submitted on:  Fri 01 Apr 2011 12:59:31 AM UTC  
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Werner Baumann <wbaumann>
Open/Closed:  Closed Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 19 Jul 2012 05:16:12 PM UTC, comment #4: 

I believe the problem is solved in version 1.4.7.
davfs2 will no longer check for other user's home directory if the mount point in fstab is an absolute file name (starting with /).

Werner

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Sun 03 Apr 2011 04:22:17 PM UTC, comment #3: 

Attached you will find a patch file for version 1.4.6. Apply it form within the top source directory with option -p1.

Despite the large size of the patch the changes to the source could are small. Most of the patch file is due to gettext (.po, pot, .gmo) to adapt the man pages. It also contains some binary data from the .gmo files.

There is no mor test for someone elses homedirectory.

But if the line in fstab has a relative mount point like

http://foo.bar  foobar  davfs2  user,noauto 0 0

this would allow every davfs user to mount to any directory named foobar. So in case of a relative mount point davfs2 will require that the mount point is within the mounting users home directory.

Cheers
Werner

(file #23089)

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Sat 02 Apr 2011 12:18:48 AM UTC, comment #2: 

Thanks for the clarification, I'm glad to hear that I misunderstood where the per-user configuration file came from. Upon reflection I agree that a post-install customization would have been a better, cleaner fix.

We are in agreement that the ignore_home line solution is inelegant as I don't think any distribution wants to maintain a list of system users with a '/' default home directory. I was also surprised to see these, though I don't know of any specific reason why they shouldn't other than that it is weird. I'd be happy to file bugs against those packages once a technical justification is developed.

I think option b) would be the easiest to implement.

Given the above I am fine with options present in the wrong file producing an error, though perhaps keeping the increased specificity of the  patch in place would still be useful.

Cheers,

--
Michael

Michael R. Crusoe <khedron>
Fri 01 Apr 2011 08:37:43 PM UTC, comment #1: 

davfs2 does not copy /etc/davfs2/davfs2.conf into ~/.davfs/. It copies the template file /usr/share/davfs2/davfs2.conf.
You probably changed the file etc/davfs2.conf in the davfs2 sources. This is the wrong place to change the system wide configuration. You must either add these option at install time (by changing makefile.am) or use one of the debian scripts that are run after installation.

But I don't think adding a 'ignore_home'-line is a proper solution. I would prefer one of these:

a) Don't assign '/' as home directory to anyone. What is the sense of this? I have never seen Debian doing this before. They usually use more sensible home directories for system users like
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
messagebus:x:101:103::/var/run/dbus:/bin/false
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

b) Remove that check for "someone elses home directory" from davfs2. After all user mounts are controlled by /etc/fstab. This check is only there to prevent root from making silly mistakes, like using relative filenames as mount points in fstab. But root has the right to make silly mistakes (or cool hacks, depending on the point of view).

Someone suggested that davfs2 should check wether the mounting user has write permissions for the mount point instead. This will not help because unprivilegded users don't have write permissions for common mount points like those in /media.

"Fix: Warn instead of exiting when system options are in the users configuration and vice-versa"
I don't like this at all. Why issue a warning every time the file system is mounted, when it is easy to fix the error? And trying to change the system configuration in a way only root is allowed to do is nothing that should be ignored. The user will be happy to know that we are serious about security.

Cheers
Werner

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Fri 01 Apr 2011 12:59:31 AM UTC, original submission:  

If the sysadmin set system wide options in /etc/davfs2/davfs2.conf and she allows for unprivileged users to mount WebDAV resources then they will experience inconsistent results.

Example:

sysadmin@host:~$ echo "davfs2 davfs2/suid_file boolean true" | sudo debconf-set-selections --
sysadmin@host:~$ sudo dpkg-reconfigure davfs2
sysadmin@host:~$ sudo sh -c 'echo "http://webdav.cyberteams.com:8080/ /mnt davfs noauto,user 0 0" > /etc/fstab'

user@host:~$ mount /mnt
Please enter the username to authenticate with server
http://webdav.cyberteams.com:8080 or hit enter for none.
  Username: guest
Please enter the password to authenticate user guest with server
http://webdav.cyberteams.com:8080 or hit enter for none.
  Password: guest
user@host:~$ ls /mnt
aaa
[snip]
user@host:~$ umount /mnt
/sbin/umount.davfs: waiting while mount.davfs (pid 13147) synchronizes the cache .
user@host:~$ mount /mnt
/sbin/mount.davfs:/home/user/.davfs2/davfs2.conf:24: unknown option
user@host:~$ ls /mnt
user@host:~$

This happens because /etc/davfs2/davfs2.conf is copied to ~/.davfs/ if ~/.davfs2 doesn't exist when mount.davfs2 is called.
Due to LP: 459998 Ubuntu & Debian need to include a system option in /etc/davfs2/davfs2.conf

Fix: Warn instead of exiting when system options are in the users configuration and vice-versa

Michael R. Crusoe <khedron>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #23089:  davfs2-ignore_home.diff added by wbaumann (254KiB - text/x-patch - patch: removes check for someone elses home directory)
file #23069:  mount_davfs2.c.patch added by khedron (6KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wbaumann (Posted a comment)
  • -email is unavailable- added by khedron (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-07-19 wbaumann Open/ClosedOpen => Closed
    2011-04-03 wbaumann Attached File- => Added davfs2-ignore_home.diff, #23089
        StatusNone => Done
        Assigned toNone => wbaumann
    2011-04-01 khedron Attached File- => Added mount_davfs2.c.patch, #23069

    Back to the top


    Powered by Savane 3.6