Messages in this thread | | | From | (Harald Koenig) | Subject | NFS bug ?! | Date | Fri, 21 Feb 1997 09:01:32 +0100 (MET) |
| |
recently I noticed that root is allowed to open files on NFS file systems which are exported with "root_squash" (or no root access for non-linux NFS servers) and where world (nobody) doesn't have access to the file.
things get even more weird when there is some data of such a file in the local (nfs client) buffer cache: since the file can be opened, root can access all the data which is in the buffer cache and can generate incomplete copies of such files if not completely cached (that's the way I discovered it). please try the following ("server" and "client" are the noth nfs machines, everything done in the same directory with permissions "755"):
USER@server : dd if=/dev/zero of=newfile bs=1024k count=1 USER@server : chmod 600 newfile
root@client : file newfile newfile: file: read failed (Permission denied). root@client : cp newfile /tmp/local_copy cp: newfile: I/O error root@client : ls -l /tmp/local_copy -rw------- 1 root root 0 Feb 21 08:50 /tmp/local_copy
USER@client : file newfile
root@client : cp newfile /tmp/local_copy cp: newfile: I/O error root@client : ls -l /tmp/local_copy -rw------- 1 root root 8192 Feb 21 08:50 /tmp/local_copy
USER@client : wc newfile
root@client : cp newfile /tmp/local_copy root@client : ls -l /tmp/local_copy -rw------- 1 root root 1048576 Feb 21 08:50 /tmp/local_copy
here is the output of strace for the first two "cp" commands from root:
------------------------------------------------------------------------------- open("newfile", O_RDONLY) = 4 open("/tmp/local_copy", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5 fstat(5, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 fstat(4, {st_mode=S_IFREG|0600, st_size=2097152, ...}) = 0 read(4, 0xbfffe694, 4096) = -1 EACCES (Permission denied) write(2, "cp: ", 4) = 4 write(2, "newfile", 8) = 8 write(2, ": Permission denied", 19) = 19 write(2, "\n", 1) = 1 ------------------------------------------------------------------------------- open("newfile", O_RDONLY) = 4 open("/tmp/local_copy", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5 fstat(5, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 fstat(4, {st_mode=S_IFREG|0600, st_size=2097152, ...}) = 0 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 read(4, 0xbfffe694, 4096) = -1 EIO (I/O error) write(2, "cp: ", 4) = 4 write(2, "newfile", 8) = 8 write(2, ": I/O error", 11) = 11 write(2, "\n", 1) = 1 -------------------------------------------------------------------------------
I can understand that allowing NFS to use the buffer cache is the reason that root can access parts of the file if locally cached but why is root allowes to open that file at all ???
if trying to copy the file as non-root and "otheruser" (who isn't allowed to access this file too) I get
------------------------------------------------------------------------------- open("newfile", O_RDONLY) = -1 EACCES (Permission denied) write(2, "cp: ", 4) = 4 write(2, "newfile4", 8) = 8 write(2, ": Permission denied", 19) = 19 write(2, "\n", 1) = 1 -------------------------------------------------------------------------------
as expected...
Harald -- All SCSI disks will from now on ___ _____ be required to send an email notice 0--,| /OOOOOOO\ 24 hours prior to complete hardware failure! <_/ / /OOOOOOOOOOO\ \ \/OOOOOOOOOOOOOOO\ \ OOOOOOOOOOOOOOOOO|// Harald Koenig, \/\/\/\/\/\/\/\/\/ Inst.f.Theoret.Astrophysik // / \\ \ koenig@tat.physik.uni-tuebingen.de ^^^^^ ^^^^^
| |