Bug 782455 - rpc.statd does not chown the sm.bak dir before dropping privs
Summary: rpc.statd does not chown the sm.bak dir before dropping privs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: nfs-utils
Version: 5.7
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Steve Dickson
QA Contact: yanfu,wang
URL:
Whiteboard:
Depends On:
Blocks: 668957 743405
TreeView+ depends on / blocked
 
Reported: 2012-01-17 14:28 UTC by Harald Klein
Modified: 2018-11-30 22:42 UTC (History)
6 users (show)

Fixed In Version: nfs-utils-1.0.9-64.el5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-01-08 07:34:24 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
patch containing a possible fix (530 bytes, patch)
2012-01-17 14:29 UTC, Harald Klein
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:0068 0 normal SHIPPED_LIVE nfs-utils bug fix and enhancement update 2013-01-07 15:27:25 UTC

Description Harald Klein 2012-01-17 14:28:00 UTC
Description of problem:

When the ownership of the sm/ dir is set to rpcuser:rpcuser, rpc.statd will drop the privileges in the drop_privs() function. This is done after doing the mkdir for the SM_BAK_DIR in shuffle_dirs(). This leads to a -EACCESS when rpc.statd tries to unlink the backup dir later:

Jan 17 08:49:00 localhost rpc.statd[25852]: unlink (/tmp/testdir/sm.bak/192.168.1.1): Permission denied

Version-Release number of selected component (if applicable):

tested with nfs-utils-1.0.9-59

Steps to Reproduce:
1. mkdir /tmp/testdir
1. let rpc.statd create its directories: rpc.statd -NFP /tmp/testdir
2. touch /tmp/testdir/sm/192.168.1.1
3. chown /tmp/testdir/sm to rpcuser:rpcuser (see bz#495066)
4. run rpc.statd: rpc.statd -NFP /tmp/testdir -n 192.168.1.2
  
Actual results:
rpc.statd runs as rpcuser:rpcuser and cannot unlink the sm.bak directory

Expected results:
sm.bak should have rpcuser:rpcuser ownership and rpc.statd should be able to unlink the sm.bak dir

Additional info:
patch attached to chown SM_BAK_DIR to the uid/gid of the SM_DIR in drop_privs()

Comment 1 Harald Klein 2012-01-17 14:29:00 UTC
Created attachment 555799 [details]
patch containing a possible fix

Comment 7 RHEL Program Management 2012-04-02 10:38:44 UTC
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.

Comment 8 yanfu,wang 2012-10-11 05:56:40 UTC
Reproduced on packag nfs-utils-1.0.9-60.el5:
[root@ibm-x3550m3-05 ~]# mkdir /tmp/testdir1
[root@ibm-x3550m3-05 ~]# rpc.statd -NFP /tmp/testdir1
[root@ibm-x3550m3-05 ~]# touch /tmp/testdir1/sm/192.168.1.1
[root@ibm-x3550m3-05 ~]# chown rpcuser:rpcuser /tmp/testdir1/sm
[root@ibm-x3550m3-05 ~]# ls -l /tmp/testdir1
total 24
drwx------ 2 rpcuser rpcuser 4096 Oct 10 23:41 sm
drwx------ 2 root    root    4096 Oct 10 23:41 sm.bak
-rw------- 1 root    root       4 Oct 10 23:41 state
[root@ibm-x3550m3-05 ~]# rpc.statd -NFP /tmp/testdir1 -n localhost
When above command done, got 'Permission denied' in /var/log/message:
Oct 10 23:42:08 ibm-x3550m3-05 rpc.statd[27119]: Version 1.0.9 Starting
Oct 10 23:42:08 ibm-x3550m3-05 rpc.statd[27119]: Flags: No-Daemon Notify-Only
Oct 10 23:42:38 ibm-x3550m3-05 rpc.statd[27119]: Can't notify 192.168.1.1, giving up.
Oct 10 23:42:38 ibm-x3550m3-05 rpc.statd[27119]: unlink (/tmp/testdir1/sm.bak/192.168.1.1): Permission denied

Verified on new packag nfs-utils-1.0.9-66.el5:
[root@ibm-x3550m3-05 ~]# ls -l /tmp/testdir/
drwx------ 2 rpcuser rpcuser 4096 10-10 23:37 sm
drwx------ 2 root    root    4096 10-10 23:35 sm.bak
-rw------- 1 root    root       4 10-10 23:36 state
[root@ibm-x3550m3-05 ~]# rpc.statd -NFP /tmp/testdir -n localhost
[root@ibm-x3550m3-05 ~]#  ls -l /tmp/testdir/
drwx------ 2 rpcuser rpcuser 4096 10-10 23:38 sm
drwx------ 2 rpcuser rpcuser 4096 10-10 23:38 sm.bak
             ^^^^^^^ ^^^^^^^
No 'Permission denied' about unlink now.

Comment 10 errata-xmlrpc 2013-01-08 07:34:24 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0068.html


Note You need to log in before you can comment on or make changes to this bug.