Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #52261 > unrolled thread

no permission as root?

Started byDie Optimisten <inform@die-optimisten.net>
First post2016-01-19 20:10 +0100
Last post2016-01-19 23:50 +0100
Articles 7 — 3 participants

Back to article view | Back to linux.debian.kernel

Contents

  no permission as root? Die Optimisten <inform@die-optimisten.net> - 2016-01-19 20:10 +0100
    Re: no permission as root? Julien Cristau <jcristau@debian.org> - 2016-01-19 20:10 +0100
      Re: no permission as root? Ben Hutchings <ben@decadent.org.uk> - 2016-01-19 20:30 +0100
      Re: no permission as root? Die Optimisten <inform@die-optimisten.net> - 2016-01-19 22:00 +0100
        Re: no permission as root? Julien Cristau <jcristau@debian.org> - 2016-01-19 22:00 +0100
          Re: no permission as root? Die Optimisten <inform@die-optimisten.net> - 2016-01-19 22:30 +0100
            Re: no permission as root? Ben Hutchings <ben@decadent.org.uk> - 2016-01-19 23:50 +0100

#52261 — no permission as root?

FromDie Optimisten <inform@die-optimisten.net>
Date2016-01-19 20:10 +0100
Subjectno permission as root?
Message-ID<qSJPc-3EO-13@gated-at.bofh.it>
Hi
I#m using normal Debian, without virtualization, etc
Why do I have access as user, but not as root????


tmp is tmpfs

softlink as User:
/tmp/X$ ln -s /mnt/A4/TmpTmp-Anschauen/RRÖ/ RR  # as User
root@PcDach:/tmp/X# dir RR/     # as Root
ls: cannot access RR/: Permission denied

root@PcDach:/tmp/X# rm RR
rm: remove symbolic link `RR'? y
root@PcDach:/tmp/X# ln -s /mnt/A4/TmpTmp-Anschauen/RRÖ/ RR
root@PcDach:/tmp/X# dir RR      # works

Version:
Linux RR 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u6 x86_64 GNU/Linux


thank you
Andrew

[toc] | [next] | [standalone]

#52262

FromJulien Cristau <jcristau@debian.org>
Date2016-01-19 20:10 +0100
Message-ID<qSJPd-3EO-27@gated-at.bofh.it>
In reply to#52261
On Tue, Jan 19, 2016 at 19:44:26 +0100, Die Optimisten wrote:

> 
> Hi
> I#m using normal Debian, without virtualization, etc
> Why do I have access as user, but not as root????
> 
google for nfs root squash.

Cheers,
Julien

[toc] | [prev] | [next] | [standalone]

#52263

FromBen Hutchings <ben@decadent.org.uk>
Date2016-01-19 20:30 +0100
Message-ID<qSK8x-3LS-1@gated-at.bofh.it>
In reply to#52262

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2016-01-19 at 20:06 +0100, Julien Cristau wrote:
> On Tue, Jan 19, 2016 at 19:44:26 +0100, Die Optimisten wrote:
> 
> > 
> > Hi
> > I#m using normal Debian, without virtualization, etc
> > Why do I have access as user, but not as root????
> > 
> google for nfs root squash.

I think this is 'protected symlinks' not rootsquash.

See <https://git.kernel.org/linus/800179c9b8a1e796e441674776d11cd4c05d61d7>.

Ben.

-- 
Ben Hutchings
Horngren's Observation:
                   Among economists, the real world is often a special case.

[toc] | [prev] | [next] | [standalone]

#52265

FromDie Optimisten <inform@die-optimisten.net>
Date2016-01-19 22:00 +0100
Message-ID<qSLxE-4AW-15@gated-at.bofh.it>
In reply to#52262

[Multipart message — attachments visible in raw view] — view raw

On 2016-01-19 20:06, Julien Cristau wrote:
> On Tue, Jan 19, 2016 at 19:44:26 +0100, Die Optimisten wrote:
>
>> Hi
>> I#m using/normal Debian, without virtualization, etc/
>> Why do I have access as user, but not as root????
>>
> google for nfs root squash.
>
> Cheers,
> Julien
Hi Julien,
Its local, without NFS!  (rootfs  ext2, mounted without acl, xattr, etc  )
Furthermore, if a user created the link, other users can't follow it,
other users can follow only, if created by root.

test@PcDach:/tmp/BB$ dir RR
lrwxrwxrwx 1 andreas andreas 39 Jan 19 21:25 RR -> /RRR/
test@PcDach:/tmp/BB$ dir RR/
ls: cannot access RR/: Permission denied
test@PcDach:/tmp/BB$
test@PcDach:/tmp/BB$ dir /RRR/    # shows all
total 82048
drwxrwxrwx  3 andreas test       4096 Jan 19 19:04 .
drwxrwxrwx  59 root    test      12288 Jan 15 17:10 ..
...

Andrew

[toc] | [prev] | [next] | [standalone]

#52266

FromJulien Cristau <jcristau@debian.org>
Date2016-01-19 22:00 +0100
Message-ID<qSLxF-4AW-21@gated-at.bofh.it>
In reply to#52265

[Multipart message — attachments visible in raw view] — view raw

Ah, right. That is the "protected symlinks" hardening feature.

Cheers,
Julien

On January 19, 2016 9:36:50 PM CET, Die Optimisten <inform@die-optimisten.net> wrote:
>On 2016-01-19 20:06, Julien Cristau wrote:
>> On Tue, Jan 19, 2016 at 19:44:26 +0100, Die Optimisten wrote:
>>
>>> Hi
>>> I#m using/normal Debian, without virtualization, etc/
>>> Why do I have access as user, but not as root????
>>>
>> google for nfs root squash.
>>
>> Cheers,
>> Julien
>Hi Julien,
>Its local, without NFS!  (rootfs  ext2, mounted without acl, xattr, etc
> )
>Furthermore, if a user created the link, other users can't follow it,
>other users can follow only, if created by root.
>
>test@PcDach:/tmp/BB$ dir RR
>lrwxrwxrwx 1 andreas andreas 39 Jan 19 21:25 RR -> /RRR/
>test@PcDach:/tmp/BB$ dir RR/
>ls: cannot access RR/: Permission denied
>test@PcDach:/tmp/BB$
>test@PcDach:/tmp/BB$ dir /RRR/    # shows all
>total 82048
>drwxrwxrwx  3 andreas test       4096 Jan 19 19:04 .
>drwxrwxrwx  59 root    test      12288 Jan 15 17:10 ..
>...
>
>Andrew

[toc] | [prev] | [next] | [standalone]

#52269

FromDie Optimisten <inform@die-optimisten.net>
Date2016-01-19 22:30 +0100
Message-ID<qSM0G-51n-3@gated-at.bofh.it>
In reply to#52266

[Multipart message — attachments visible in raw view] — view raw

Ok,
how can I disable it, can it be configured in /sys ?
Can't find it in any manpage. It should be documented somewhere!
It is helpful for nfs (or other remote access), but not local. If root 
already, there's no difference.
I say best would be a mount-option.

Andrew


On 2016-01-19 21:50, Julien Cristau wrote:
> Ah, right. That is the "protected symlinks" hardening feature.
>
> Cheers,
> Julien
>
> On January 19, 2016 9:36:50 PM CET, Die Optimisten 
> <inform@die-optimisten.net> wrote:
>
>     On 2016-01-19 20:06, Julien Cristau wrote:
>>     On Tue, Jan 19, 2016 at 19:44:26 +0100, Die Optimisten wrote:
>>
>>>     Hi
>>>     I#m using/normal Debian, without virtualization, etc/
>>>     Why do I have access as user, but not as root????
>>>
>>     google for nfs root squash.
>>
>>     Cheers,
>>     Julien
>     Hi Julien,
>     Its local, without NFS!  (rootfs  ext2, mounted without acl,
>     xattr, etc  )
>     Furthermore, if a user created the link, other users can't follow it,
>     other users can follow only, if created by root.
>
>     test@PcDach:/tmp/BB$ dir RR
>     lrwxrwxrwx 1 andreas andreas 39 Jan 19 21:25 RR -> /RRR/
>     test@PcDach:/tmp/BB$ dir RR/
>     ls: cannot access RR/: Permission denied
>     test@PcDach:/tmp/BB$
>     test@PcDach:/tmp/BB$ dir /RRR/    # shows all
>     total 82048
>     drwxrwxrwx  3 andreas test       4096 Jan 19 19:04 .
>     drwxrwxrwx  59 root    test      12288 Jan 15 17:10 ..
>     ...
>
>     Andrew
>

[toc] | [prev] | [next] | [standalone]

#52272

FromBen Hutchings <ben@decadent.org.uk>
Date2016-01-19 23:50 +0100
Message-ID<qSNg5-5Mk-1@gated-at.bofh.it>
In reply to#52269

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2016-01-19 at 22:05 +0100, Die Optimisten wrote:
> Ok,
> how can I disable it, can it be configured in /sys ?
> Can't find it in any manpage. It should be documented somewhere!
> It is helpful for nfs (or other remote access), but not local. If root 
> already, there's no difference.
> I say best would be a mount-option.

/proc/sys/fs/protected_hardlinks

Which is documented in Documentation/sysctl/fs.txt

Ben.

-- 
Ben Hutchings
Horngren's Observation:
                   Among economists, the real world is often a special case.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web