lkml.org 
[lkml]   [1998]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: NFS question
Date
> > 
> > But I guess some flame about this change could arise. From now on the files
> > with mode 711 couldn't be executed on remote machine. We checked FreeBSD
> > behaviour under similar circumstances - it allows execution of 711 files,
> > but it also allows such a files to be read :(
>

Ooops. That is a real bug. Please try the new patch here.

>
> >
> > BTW, I have another note abouk knfsd. While playing with compiling various
> > kernels and turning the machine on/off many times, I've noticed strange
> > messages (probably from kexportfs, or, more exactly from kernel while
> > executing kexportfs) about 'invalid argument'. I've noticed also, that such
>

It is fixed for the next release.

>
> > a messages appear only if the file /var/lib/nfs/rmtab exists and is not empty.
> > Client machines are running 2.0.30; but I think they're not guilty - if
> > they are down correctly, rmtab file becomes empty. When I shut my box down,
> > rmtab does not get clear, but after reboot aforementioned problems appear.
> > Moreover, some records may appear in rmtab twice while being _exactly_ equal.
> > Is it possible to detect if remote nfs mount is still active and then
> > leave only such records in rmtab file?
>

It is fixed for the next release.



H.J.
------
Index: fs/nfsd/vfs.c
===================================================================
RCS file: /home/work/cvs/linux/linux/fs/nfsd/vfs.c,v
retrieving revision 1.5
diff -u -p -r1.5 vfs.c
--- fs/nfsd/vfs.c 1998/09/29 14:33:26 1.5
+++ fs/nfsd/vfs.c 1998/10/01 04:09:52
@@ -267,9 +274,17 @@ printk("nfsd_setattr: size change??\n");

/* Change the attributes. */
if (iap->ia_valid) {
+ kernel_cap_t saved_cap;
+
iap->ia_valid |= ATTR_CTIME;
iap->ia_ctime = CURRENT_TIME;
+ if (current->fsuid != 0) {
+ saved_cap = current->cap_effective;
+ cap_clear(current->cap_effective);
+ }
err = notify_change(dentry, iap);
+ if (current->fsuid != 0)
+ current->cap_effective = saved_cap;
if (err)
goto out_nfserr;
if (EX_ISSYNC(fhp->fh_export))
@@ -531,10 +546,17 @@ nfsd_write(struct svc_rqst *rqstp, struc
/* clear setuid/setgid flag after write */
if (err >= 0 && (inode->i_mode & (S_ISUID | S_ISGID))) {
struct iattr ia;
+ kernel_cap_t saved_cap;

ia.ia_valid = ATTR_MODE;
ia.ia_mode = inode->i_mode & ~(S_ISUID | S_ISGID);
+ if (current->fsuid != 0) {
+ saved_cap = current->cap_effective;
+ cap_clear(current->cap_effective);
+ }
notify_change(dentry, &ia);
+ if (current->fsuid != 0)
+ current->cap_effective = saved_cap;
}

fh_unlock(fhp); /* unlock inode */
@@ -726,6 +748,7 @@ nfsd_truncate(struct svc_rqst *rqstp, st
struct inode *inode;
struct iattr newattrs;
int err;
+ kernel_cap_t saved_cap;

err = fh_verify(rqstp, fhp, S_IFREG, MAY_WRITE | MAY_TRUNC);
if (err)
@@ -743,7 +766,13 @@ nfsd_truncate(struct svc_rqst *rqstp, st
DQUOT_INIT(inode);
newattrs.ia_size = size;
newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
+ if (current->fsuid != 0) {
+ saved_cap = current->cap_effective;
+ cap_clear(current->cap_effective);
+ }
err = notify_change(dentry, &newattrs);
+ if (current->fsuid != 0)
+ current->cap_effective = saved_cap;
if (!err) {
vmtruncate(inode, size);
if (inode->i_op && inode->i_op->truncate)
@@ -1232,6 +1261,7 @@ nfsd_permission(struct svc_export *exp,
{
struct inode *inode = dentry->d_inode;
int err;
+ kernel_cap_t saved_cap;

if (acc == MAY_NOP)
return 0;
@@ -1275,11 +1312,19 @@ nfsd_permission(struct svc_export *exp,
if (inode->i_uid == current->fsuid /* && !(acc & MAY_TRUNC) */)
return 0;

+ if (current->fsuid != 0) {
+ saved_cap = current->cap_effective;
+ cap_clear(current->cap_effective);
+ }
+
err = permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC));

/* Allow read access to binaries even when mode 111 */
- if (err == -EPERM && S_ISREG(inode->i_mode) && acc == MAY_READ)
+ if (err == -EACCES && S_ISREG(inode->i_mode) && acc == MAY_READ)
err = permission(inode, MAY_EXEC);
+
+ if (current->fsuid != 0)
+ current->cap_effective = saved_cap;

return err? nfserrno(-err) : 0;
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.068 / U:0.544 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site