linux-ext4 - Re: [PATCH] ext4: enable acls and user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110224135740.GF23042@quack.suse.cz>
Date:	Thu, 24 Feb 2011 14:57:40 +0100
From:	Jan Kara <jack@...e.cz>
To:	Theodore Tso <tytso@....EDU>
Cc:	Jan Kara <jack@...e.cz>, Eric Sandeen <sandeen@...hat.com>,
	ext4 development <linux-ext4@...r.kernel.org>
Subject: Re: [PATCH] ext4: enable acls and user_xattr by default

On Thu 24-02-11 07:19:46, Theodore Tso wrote:
> 
> On Feb 24, 2011, at 6:49 AM, Jan Kara wrote:
> 
> >  I agree it may cause surprises although it's not true that ACL's remove
> > rights. Rather on contrary ACL's can only give additional rights (i.e. you
> > have 600 file + user foo can also read it) thus noacl->acl transition might
> > be insecure if you have some old unwanted ACL's pending.
> 
> My understanding of how POSIX acls work is that the if you want to give
> read access to user "foo" (where "foo" is not the user) is you first have to 
> open up the file permissions to do the equivalent of "o+r".
  I've actually tried that before posting my email and it's not like that.
I did:
jack@...ck:~/source> echo 'aaa' >/tmp/f
jack@...ck:~/source> chmod 600 /tmp/f
jack@...ck:~/source> setfacl -m u:nobody:rw /tmp/f
jack@...ck:~/source> sudo su nobody -c "cat /tmp/f"
aaa
jack@...ck:~/source> sudo su news -c "cat /tmp/f"
cat: /tmp/f: Permission denied

> See: http://acl.bestbits.at/man/man5/acl.txt
> 
> And then note how ACL_MASK corresponds to the permissions bits...
  OK, I see but then look at setfactl(1), commentary of -n option:
The default  behavior of  setfacl  is  to  recalculate  the ACL mask entry,
unless a mask entry was explicitly given.  The mask entry is set to the
union of all  permissions  of the owning group, and all named user and
group entries. (These are  exactly  the  entries  affected  by  the mask
entry).

  So setfacl(1) by default makes the mask logic void.

								Honza
-- 
Jan Kara <jack@...e.cz>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html