Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #67324

Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2)

Cross-posted to 2 groups.

Show all headers | View raw

On Wed, Jun 17, 2020 at 5:31 PM J. Bruce Fields <bfields@redhat.com> wrote:
>
> On Wed, Jun 17, 2020 at 04:42:56PM +0200, Andreas Gruenbacher wrote:
> > Hi Bruce,
> >
> > On Wed, Jun 17, 2020 at 2:58 AM J. Bruce Fields <bfields@redhat.com> wrote:
> > > I think I'll send the following upstream.
> >
> > looking good, but how about using a little helper for this?
>
> I like it.  And the new comment's helpful too.
>
> >
> > Also I'm not sure if ecryptfs gets this right, so taking the ecryptfs
> > list into the CC.
>
> Yes, questions I had while doing this:
>
>         - cachefiles, ecrypfs, devtmpfs, and unix_mknod skip the check,
>           is that OK for all of them?  (Overlayfs too, I think?--that
>           code's harder to follow.
>
>         - why don't vfs_{create,mknod,mkdir} do the IS_POSIXACL check
>           themselves?  Even if it's unnecessary for some callers, surely
>           it wouldn't be wrong?

That's a good question. The security_path_{mkdir,mknod} hooks would
then probably be passed the original create mode before applying the
umask, but at that point it's not clear what the new inode's final
mode will be, anyway.

> I also wondered why both vfs_{create,mknod,mkdir} and the callers were
> calling security hooks, but now I see that the callers are calling
> security_path_* hooks and the vfs_ functions are calling
> security_inode_* hooks, so I guess they're not redundant.
>
> Though now I wonder why some of the callers (nfsd, overlayfs) are
> skipping the security_path_* hooks.

The path based security hooks are only used by apparmor and tomoyo.
Those hooks basically control who (which process) can do what where in
the filesystem, but nfsd isn't aware of the "who", and overlayfs is a
layer below the "where".

Andreas

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#962254: NFS(v4) broken at 4.19.118-2 Elliott Mitchell <ehem+debian@m5p.com> - 2020-06-05 07:50 +0200
  Processed: Re: Bug#962254: NFS(v4) broken at 4.19.118-2 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-06-05 08:50 +0200
  Bug#962254: NFS(v4) broken at 4.19.118-2 Salvatore Bonaccorso <carnil@debian.org> - 2020-06-05 08:50 +0200
    Bug#962254: NFS(v4) broken at 4.19.118-2 Elliott Mitchell <ehem+debian@m5p.com> - 2020-06-05 20:20 +0200
      Bug#962254: NFS(v4) broken at 4.19.118-2 Salvatore Bonaccorso <carnil@debian.org> - 2020-06-05 20:40 +0200
        Bug#962254: NFS(v4) broken at 4.19.118-2 Elliott Mitchell <ehem+debian@m5p.com> - 2020-06-06 00:40 +0200
        Bug#934160: Bug#962254: NFS(v4) broken at 4.19.118-2 Elliott Mitchell <ehem+debian@m5p.com> - 2020-06-09 04:00 +0200
  Processed: Re: Bug#962254: NFS(v4) broken at 4.19.118-2 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-06-09 04:00 +0200
  Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported ZFS (with acltype=off) (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Salvatore Bonaccorso <carnil@debian.org> - 2020-06-13 15:00 +0200
  Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported ZFS (with acltype=off) (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) "J. Bruce Fields" <bfields@redhat.com> - 2020-06-15 17:10 +0200
    Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Salvatore Bonaccorso <carnil@debian.org> - 2020-06-15 21:00 +0200
  Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) "J. Bruce Fields" <bfields@redhat.com> - 2020-06-16 04:50 +0200
    Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Salvatore Bonaccorso <carnil@debian.org> - 2020-06-16 07:40 +0200
    Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Salvatore Bonaccorso <carnil@debian.org> - 2020-06-16 18:30 +0200
      Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) "J. Bruce Fields" <bfields@redhat.com> - 2020-06-17 03:10 +0200
        Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl Salvatore Bonaccorso <carnil@debian.org> - 2020-06-17 07:10 +0200
  Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Salvatore Bonaccorso <carnil@debian.org> - 2020-06-16 07:40 +0200
  Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) "J. Bruce Fields" <bfields@redhat.com> - 2020-06-17 17:40 +0200
    Bug#962254: Umask ignored when mounting NFSv4.2 share of an exported Filesystem with noacl (was: Re: Bug#962254: NFS(v4) broken at 4.19.118-2) Andreas Gruenbacher <agruenba@redhat.com> - 2020-06-17 19:00 +0200

csiph-web