lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150928174648.GA3190@fieldses.org> Date: Mon, 28 Sep 2015 13:46:48 -0400 From: "J. Bruce Fields" <bfields@...ldses.org> To: Andreas Grünbacher <andreas.gruenbacher@...il.com> Cc: Andreas Gruenbacher <agruenba@...hat.com>, Alexander Viro <viro@...iv.linux.org.uk>, Theodore Ts'o <tytso@....edu>, Andreas Dilger <adilger.kernel@...ger.ca>, Jeff Layton <jlayton@...chiereds.net>, Trond Myklebust <trond.myklebust@...marydata.com>, Anna Schumaker <anna.schumaker@...app.com>, linux-ext4@...r.kernel.org, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, Linux FS-devel Mailing List <linux-fsdevel@...r.kernel.org>, Linux NFS Mailing List <linux-nfs@...r.kernel.org>, Linux API Mailing List <linux-api@...r.kernel.org> Subject: Re: [PATCH v8 00/41] Richacls On Mon, Sep 28, 2015 at 07:10:06PM +0200, Andreas Grünbacher wrote: > 2015-09-28 18:35 GMT+02:00 J. Bruce Fields <bfields@...ldses.org>: > > On Mon, Sep 28, 2015 at 12:08:51AM +0200, Andreas Gruenbacher wrote: > >> Open issues in nfs: > >> > >> * When a user or group name cannot be mapped, nfs's idmapper always maps it > >> to nobody. That's good enough for mapping the file owner and owning > >> group, but not for identifiers in acls. For now, to get the nfs richacl > >> support somewhat working, I'm explicitly checking if mapping has resulted > >> in uid/gid 99 in the kernel. > >> > >> * When the nfs server replies with NFS4ERR_BADNAME for any user or group > >> name lookup, the client will stop sending numeric uids and gids to the > >> server even when the lookup wasn't numeric. From then on, the client > >> will translate uids and gids that have no mapping to the string "nobody", > >> and the server will reject them. This problem is not specific to acls. > > > > Do you have fixes in mind for these two issues? > > I'm not sure how to best fix the idmapper problem, with backwards > compatibility and all. I haven't looked at the current nfsidmap interface.... So it's completely lacking any way to communicate failure? > The second problem shouldn't be too hard to fix. Is it enough to turn off the failover in the case there's no possibility it could have been caused by a numeric id? If any user can set ACLs with arbitrary strings as names, then we'd be giving any user unprivileged user the ability to turn off numeric idmapping, so I think we need to fix that. --b. -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists