Messages in this thread | | | Date | Fri, 12 Mar 1999 08:47:32 -0800 (PST) | From | Simon Kirby <> | Subject | Re: [patch] fix for major securty problem in dquota code |
| |
On 12 Mar 1999, Jes Sorensen wrote:
> >>>>> "Andrea" == Andrea Arcangeli <andrea@e-mind.com> writes: > > Andrea> My friend Andrea Borgia (master admin of our University) > Andrea> reported to me this afternoon that dquota could be overridden > Andrea> by the nfs-server on 2.2.x kernels. > > Andrea> I took a look and and the problem was exactly what I > Andrea> anticipated to you today (since you said me that quota was > Andrea> fine except when using the nfs-userspace-server, that's the > Andrea> only bit of code that play with fsuid ;). The problem is that > Andrea> dquot think that the initiator of the operation is the euid of > Andrea> nfsd (and nfsd run as root) and not the euid of the student > Andrea> that is using the NFS client (stored instead in the fsuid > Andrea> field). > > Andrea, if you got your head down in the dquota code (and have an idea > about what is going on there) you might want to look at the fact that > it is not SMP safe. I have a report from a guy who had it blow up on > him like 1-2 times/day when running on SMP, whereas it seems to be > fine on UP. > > Don't take this as a 'you have to fix it' message, only a suggestion > if you have nothing better to do ;-)
Alan did something in 2.2.2-ac7 that fixed this for us (we got our first SMP machine that had to use quotas a week or so ago and I put on 2.2.2-ac1...it blew up as soon as I turned on quotas and typed "sync"). Upgrading to ac7 on that machine has fixed/avoided the problem from what I can see (it's running fine for a few days now :)).
Simon-
| Simon Kirby | Systems Administration | | mailto:sim@netnation.com | NetNation Communications | | http://www.netnation.com/ | Tech: (604) 684-6892 |
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |