Fix NFS mount options in mount.nfs
Subsystems (2)
PATCH 1/1 Fix NFS mount options in mount.nfs
AG
Signature · 2 lines
May the source be with you. http://www.cis.ksu.edu/~gud
Fix NFS mount options.
---
utils/mount/Makefile.am +4 -3
@@ -14,9 +14,10 @@ MAINTAINERCLEANFILES = Makefile.in install-exec-hook: (cd $(DESTDIR)$(sbindir) && \ - ln -sf $(sbin_PROGRAMS) mount.nfs4 && \ - ln -sf $(sbin_PROGRAMS) umount.nfs && \ - ln -sf $(sbin_PROGRAMS) umount.nfs4) + chmod +s $(sbin_PROGRAMS) && \ + cp $(sbin_PROGRAMS) /sbin/mount.nfs4 && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs4) uninstall-hook: (cd $(DESTDIR)$(sbindir) && \ rm -f mount.nfs4 umount.nfs umount.nfs4)
utils/mount/mount.c +67 -17
163 lines not on this page · raw message
utils/mount/nfsumount.c +53 -1
78 lines not on this page · raw message
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
Thanks, that should clean up most of the problems. How well is this tested?
/* Steinar */
Signature · 9 lines
Homepage: http://www.sesse.net/ Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 2 lines · Steinar H. Gunderson
Thanks, that should clean up most of the problems. How well is this tested?
The problem was the options that are meant solely for the mount utility, like remount or noauto, were being passed further down to the syscall. These options should be handled within the mount utility only and should not be passed further.
I tested with options like noauto,async,_netdev,nodiratime,users,dirsync,noatime,nodev,mand,group,owner,suid,user,exec,rw,soft,intr and it apparently worked OK. This isn't regressively tested though. I
would like to see this patch tested in the environment mentioned in
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=376839 .
AG
Signature · 11 lines
May the source be with you. http://www.cis.ksu.edu/~gud Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 5 lines · Amit Gud
I tested with options like noauto,async,_netdev,nodiratime,users,dirsync,noatime,nodev,mand,group,owner,suid,user,exec,rw,soft,intr and it apparently worked OK. This isn't regressively tested though. I would
like to see this patch tested in the environment mentioned in
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=376839 .
I'll make an upload to Debian; the current state is quite broken anyhow, so I guess it can't hurt. :-)
/* Steinar */
Signature · 9 lines
Homepage: http://www.sesse.net/ Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
FWIW, this part is wrong:
utils/mount/Makefile.am MAINTAINERCLEANFILES = Makefile.in · line 20
Quoted 9 lines
install-exec-hook:
(cd $(DESTDIR)$(sbindir) && \utils/mount/Makefile.am +4
-3- ln -sf $(sbin_PROGRAMS) mount.nfs4 && \ - ln -sf $(sbin_PROGRAMS) umount.nfs && \ - ln -sf $(sbin_PROGRAMS) umount.nfs4) + chmod +s $(sbin_PROGRAMS) && \ + cp $(sbin_PROGRAMS) /sbin/mount.nfs4 && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs4)
You cannot expect to be able to put stuff directly into /sbin, you'll have to heed $(DESTDIR).
/* Steinar */
Signature · 9 lines
Homepage: http://www.sesse.net/ Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 12 lines · Steinar H. Gunderson
FWIW, this part is wrong:
Review
Quoted 9 lines
install-exec-hook:
(cd $(DESTDIR)$(sbindir) && \(quoted diff) +4
-3- ln -sf $(sbin_PROGRAMS) mount.nfs4 && \ - ln -sf $(sbin_PROGRAMS) umount.nfs && \ - ln -sf $(sbin_PROGRAMS) umount.nfs4) + chmod +s $(sbin_PROGRAMS) && \ + cp $(sbin_PROGRAMS) /sbin/mount.nfs4 && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs && \ + cp $(sbin_PROGRAMS) /sbin/umount.nfs4)
Quoted 3 lines
You cannot expect to be able to put stuff directly into /sbin, you'll have to heed $(DESTDIR).
Please use the attached patch for testing. It varies only in the above portion, but that should make a difference.
AG
Signature · 2 lines
May the source be with you. http://www.cis.ksu.edu/~gud
utils/mount/Makefile.am +4 -3
@@ -14,9 +14,10 @@ MAINTAINERCLEANFILES = Makefile.in install-exec-hook: (cd $(DESTDIR)$(sbindir) && \ - ln -sf $(sbin_PROGRAMS) mount.nfs4 && \ - ln -sf $(sbin_PROGRAMS) umount.nfs && \ - ln -sf $(sbin_PROGRAMS) umount.nfs4) + chmod +s $(sbin_PROGRAMS) && \ + cp -p $(sbin_PROGRAMS) mount.nfs4 && \ + cp -p $(sbin_PROGRAMS) umount.nfs && \ + cp -p $(sbin_PROGRAMS) umount.nfs4) uninstall-hook: (cd $(DESTDIR)$(sbindir) && \ rm -f mount.nfs4 umount.nfs umount.nfs4)
utils/mount/mount.c +67 -17
163 lines not on this page · raw message
Binary files nfs-utils/utils/mount/mount.nfs and nfs-utils-ag/utils/mount/mount.nfs differ
utils/mount/nfsumount.c +53 -1
78 lines not on this page · raw message
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 2 lines · Amit Gud
Please use the attached patch for testing. It varies only in the above portion, but that should make a difference.
Say, why is mount.nfs suid root in the first place? I'd expect it only to be called by mount, which should be suid already...
/* Steinar */
Signature · 9 lines
Homepage: http://www.sesse.net/ Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 7 lines · Steinar H. Gunderson
Quoted 2 lines · Amit Gud
Please use the attached patch for testing. It varies only in the above portion, but that should make a difference.
Say, why is mount.nfs suid root in the first place? I'd expect it only to be called by mount, which should be suid already...
For security reasons, mount command resets the uids before calling mount.nfs. So, even mount.nfs needs to be suid root to be able to use the 'user' and 'users' mount options for NFS.
AG
Signature · 11 lines
May the source be with you. http://www.cis.ksu.edu/~gud Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
utils/mount/Makefile.am MAINTAINERCLEANFILES = Makefile.in · line 17
Quoted 11 lines · On Friday July 7, [email protected] wrote:
diff -uprN -X dontdiff nfs-utils/utils/mount/Makefile.am nfs-utils-ag/utils/mount/Makefile.am
utils/mount/Makefile.am +1
-3@@ -14,9 +14,10 @@ MAINTAINERCLEANFILES = Makefile.in install-exec-hook: (cd $(DESTDIR)$(sbindir) && \ - ln -sf $(sbin_PROGRAMS) mount.nfs4 && \ - ln -sf $(sbin_PROGRAMS) umount.nfs && \ - ln -sf $(sbin_PROGRAMS) umount.nfs4) + chmod +s $(sbin_PROGRAMS) && \
I do *not* have a good feeling about this... not at all. I'm going to switch configure to default to *not* installing nfs.mount and release 1.0.9 pretty much as-is.
We can do a proper security review and allow setuid for 1.0.10 (or maybe it is time for 1.1.0) but I want 1.0.9 out now, and this isn't going in. sorry.
utils/mount/Makefile.am MAINTAINERCLEANFILES = Makefile.in
Quoted 7 lines
utils/mount/Makefile.am +7
-0+/* Custom mount options for our own purposes. */ +/* Maybe these should now be freed for kernel use again */ +#define MS_DUMMY 0x00000000 +#define MS_USERS 0x40000000 +#define MS_USER 0x20000000 +#define MS_OWNER 0x10000000 +#define MS_GROUP 0x08000000
OWNER and GROUP are never used, so DUMMY should just be used for them.
utils/mount/Makefile.am
Quoted 4 lines
utils/mount/Makefile.am +4
-0+ { "users", 0, 0, MS_USERS }, /* Allow ordinary user to mount */ + { "nousers", 0, 0, MS_USERS }, /* Forbid ordinary user to mount */ + { "user", 0, 0, MS_USER }, /* Allow ordinary user to mount */ + { "nouser", 0, 0, MS_USER }, /* Forbid ordinary user to mount */
So both "users" and "nousers" set the MS_USERS flag which causes privileged operations to be allowed?
You at least want the 'inv' flag to be set for nousers and nouser. However that isn't enough.
The options are passed in on the command line, so anyone could give any option they like and call /sbin/mount.nfs directly. We can really only trust 'user' and 'users' if they are in the /etc/fstab file, and we don't have direct access to /etc/fstab.
It would really be MUCH more secure if mount DIDN'T drop setuid, but that isn't the case - sadly.
The only other setuid /sbin/mount.* that I have installed in mount.cifs, and it allows anyone to mount anything on any directory they own. This is at least slightly safer, but I'd still rather something more connected with /etc/fstab.....
NeilBrown
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 9 lines · Amit Gud
Quoted 2 lines · Steinar H. Gunderson
Thanks, that should clean up most of the problems. How well is this tested?
The problem was the options that are meant solely for the mount utility, like remount or noauto, were being passed further down to the syscall. These options should be handled within the mount utility only and should not be passed further.
Quoted 5 lines
I tested with options like noauto,async,_netdev,nodiratime,users,dirsync,noatime,nodev,mand,group,owner,suid,user,exec,rw,soft,intr and it apparently worked OK. This isn't regressively tested though. I
would like to see this patch tested in the environment mentioned in
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=376839 .
How does this change affect the mount options that show up in /proc/mounts and /proc/self/mountstats?
Signature · 10 lines
"We who cut mere stones must always be envisioning cathedrals" -- Quarry worker's creed Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ NFS maillist - [email protected] https://lists.sourceforge.net/lists/listinfo/nfs
Quoted 3 lines · Chuck Lever
How does this change affect the mount options that show up in
/proc/mountsand/proc/self/mountstats?
IMO, it wouldn't affect at all. We are just trying to change the user-space binaries, the stuff going in the kernel is still the same.
AG--
May the source be with you.
http://www.cis.ksu.edu/~gud
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs