Bug 169039 - GFS POSIX bug: opened fds not pertaining access permissions after setuid
Summary: GFS POSIX bug: opened fds not pertaining access permissions after setuid
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Cluster Suite
Classification: Retired
Component: gfs
Version: 4
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Ben Marzinski
QA Contact: GFS Bugs
URL: http://lists.samba.org/archive/samba/...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-09-22 13:34 UTC by Axel Thimm
Modified: 2010-01-12 03:07 UTC (History)
2 users (show)

Fixed In Version: RHBA-2006-0169
Clone Of:
Environment:
Last Closed: 2006-01-06 20:19:53 UTC
Embargoed:


Attachments (Terms of Use)
patch to remove invalid permission checking (546 bytes, patch)
2005-09-28 15:04 UTC, Ben Marzinski
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2006:0169 0 normal SHIPPED_LIVE GFS-kernel bug fix update 2006-01-06 05:00:00 UTC

Description Axel Thimm 2005-09-22 13:34:54 UTC
Description of problem:
Samba 3 opens fds as root, then setuids to the connecting user. Trying to access
these fds are falsly checked against the new effective uid, instead of the old
one at open time.

Version-Release number of selected component (if applicable):
GFS-kernel-2.6.9-35.5

How reproducible:
always

Steps to Reproduce:
1.open("somefile", O_RDWR, 0600) as root
2.switch to a user with set(res)uid/gid, who doesn't have write access to this   
  file
3.Try to expand this file with ftruncate

(note: the above is what samba does and fails, simply writing to that file
should also fail)

Actual results:
The ftruncate fails

Expected results:
ftruncate should succeed.

Additional info:
This bug is exhibited by Samba when placing its *.tdb database files containing
metadata about locks, connections, crypt tokens etc. on a GFS filesystem.
The latter trick is vital for creating a poor-man's-clustered-samba solution.

See also the mail thread in the URL.

Comment 1 Ben Marzinski 2005-09-23 19:52:24 UTC
Actually, it seems like only setattr requests are incorrectly checked.  Reads and
writes are POSIX compliant.

Comment 2 Axel Thimm 2005-09-24 13:41:29 UTC
Do you mean setxattr from the POSIX ACL draft? Perhaps that one, too, but
already ftruncate fails (resizing a file).


Comment 3 Ben Marzinski 2005-09-26 14:15:01 UTC
I actually mean system calls that use the filesystem specific setattr hook in VFS
(which is linked to gfs_setattr in gfs. This is where the bug is). Truncating a
file is one such call. Sorry for not being clear about that.  The only question
I have is why IS gfs checking permissions in gfs_setattr. I'm trying to make sure
that there isn't some reason why it is necessary.  I currently can't see one. If
it's unnecessary, I'll just remove the check. If it is... that's a little more
complicated.

Comment 4 Ben Marzinski 2005-09-27 19:54:06 UTC
I pulled the check from gfs_setattr

Comment 5 Axel Thimm 2005-09-28 00:42:18 UTC
Is this as trivial to fix on RHEL4U1 (or U2) as it sounds? Otherwise could you
provide a patch? I'd like to continue tetsing Samba on GFS.

Thanks for the fast fix!

Comment 6 Ben Marzinski 2005-09-28 15:04:25 UTC
Created attachment 119371 [details]
patch to remove invalid permission checking

Here is a patch that should apply cleanly to any RHEL4 kernel, that will fix
this

Comment 7 Ben Marzinski 2005-09-28 15:07:43 UTC
You can also checkout the RHEL4 branch of CVS, which has this change.
Unfortunately it is too late in the release cycle to restart QA. So unless the
U2 kernel changes (which will force us to retest anyway) this fix will not make
it into U2.

Comment 9 Ben Marzinski 2005-10-10 23:26:51 UTC
This fix will not make the U2 release.

Comment 10 Axel Thimm 2005-10-10 23:39:36 UTC
Does that mean that it will only apper on U3, or will there be updated
GFS-kernel packages before that?

If the fix takes too long to surface rhn channels I would repackage GFS-kernel
for RHELU2 with the patch from comment #6. I could also make them unofficially
available through ATrpms, if there is interest.

Comment 12 Red Hat Bugzilla 2006-01-06 20:19:53 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2006-0169.html



Note You need to log in before you can comment on or make changes to this bug.