Messages in this thread Patch in this message | | | From | (H.J. Lu) | Subject | Re: NFS question | Date | Wed, 30 Sep 1998 21:17:58 -3100 (PDT) |
| |
> > > > But I guess some flame about this change could arise. From now on the files > > with mode 711 couldn't be executed on remote machine. We checked FreeBSD > > behaviour under similar circumstances - it allows execution of 711 files, > > but it also allows such a files to be read :( >
Ooops. That is a real bug. Please try the new patch here.
> > > > > BTW, I have another note abouk knfsd. While playing with compiling various > > kernels and turning the machine on/off many times, I've noticed strange > > messages (probably from kexportfs, or, more exactly from kernel while > > executing kexportfs) about 'invalid argument'. I've noticed also, that such >
It is fixed for the next release.
> > > a messages appear only if the file /var/lib/nfs/rmtab exists and is not empty. > > Client machines are running 2.0.30; but I think they're not guilty - if > > they are down correctly, rmtab file becomes empty. When I shut my box down, > > rmtab does not get clear, but after reboot aforementioned problems appear. > > Moreover, some records may appear in rmtab twice while being _exactly_ equal. > > Is it possible to detect if remote nfs mount is still active and then > > leave only such records in rmtab file? >
It is fixed for the next release.
H.J. ------ Index: fs/nfsd/vfs.c =================================================================== RCS file: /home/work/cvs/linux/linux/fs/nfsd/vfs.c,v retrieving revision 1.5 diff -u -p -r1.5 vfs.c --- fs/nfsd/vfs.c 1998/09/29 14:33:26 1.5 +++ fs/nfsd/vfs.c 1998/10/01 04:09:52 @@ -267,9 +274,17 @@ printk("nfsd_setattr: size change??\n"); /* Change the attributes. */ if (iap->ia_valid) { + kernel_cap_t saved_cap; + iap->ia_valid |= ATTR_CTIME; iap->ia_ctime = CURRENT_TIME; + if (current->fsuid != 0) { + saved_cap = current->cap_effective; + cap_clear(current->cap_effective); + } err = notify_change(dentry, iap); + if (current->fsuid != 0) + current->cap_effective = saved_cap; if (err) goto out_nfserr; if (EX_ISSYNC(fhp->fh_export)) @@ -531,10 +546,17 @@ nfsd_write(struct svc_rqst *rqstp, struc /* clear setuid/setgid flag after write */ if (err >= 0 && (inode->i_mode & (S_ISUID | S_ISGID))) { struct iattr ia; + kernel_cap_t saved_cap; ia.ia_valid = ATTR_MODE; ia.ia_mode = inode->i_mode & ~(S_ISUID | S_ISGID); + if (current->fsuid != 0) { + saved_cap = current->cap_effective; + cap_clear(current->cap_effective); + } notify_change(dentry, &ia); + if (current->fsuid != 0) + current->cap_effective = saved_cap; } fh_unlock(fhp); /* unlock inode */ @@ -726,6 +748,7 @@ nfsd_truncate(struct svc_rqst *rqstp, st struct inode *inode; struct iattr newattrs; int err; + kernel_cap_t saved_cap; err = fh_verify(rqstp, fhp, S_IFREG, MAY_WRITE | MAY_TRUNC); if (err) @@ -743,7 +766,13 @@ nfsd_truncate(struct svc_rqst *rqstp, st DQUOT_INIT(inode); newattrs.ia_size = size; newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME; + if (current->fsuid != 0) { + saved_cap = current->cap_effective; + cap_clear(current->cap_effective); + } err = notify_change(dentry, &newattrs); + if (current->fsuid != 0) + current->cap_effective = saved_cap; if (!err) { vmtruncate(inode, size); if (inode->i_op && inode->i_op->truncate) @@ -1232,6 +1261,7 @@ nfsd_permission(struct svc_export *exp, { struct inode *inode = dentry->d_inode; int err; + kernel_cap_t saved_cap; if (acc == MAY_NOP) return 0; @@ -1275,11 +1312,19 @@ nfsd_permission(struct svc_export *exp, if (inode->i_uid == current->fsuid /* && !(acc & MAY_TRUNC) */) return 0; + if (current->fsuid != 0) { + saved_cap = current->cap_effective; + cap_clear(current->cap_effective); + } + err = permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC)); /* Allow read access to binaries even when mode 111 */ - if (err == -EPERM && S_ISREG(inode->i_mode) && acc == MAY_READ) + if (err == -EACCES && S_ISREG(inode->i_mode) && acc == MAY_READ) err = permission(inode, MAY_EXEC); + + if (current->fsuid != 0) + current->cap_effective = saved_cap; return err? nfserrno(-err) : 0; } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |