linux-kernel - Re: [PATCH] NFSv3: cached permissions subset enhancement, v2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <48B71FFA.9050801@redhat.com>
Date:	Thu, 28 Aug 2008 18:00:26 -0400
From:	Peter Staubach <staubach@...hat.com>
To:	Joe Korty <joe.korty@...r.com>
CC:	"Myklebust, Trond" <Trond.Myklebust@...app.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] NFSv3: cached permissions subset enhancement, v2

Joe Korty wrote:
> On Thu, Aug 28, 2008 at 02:28:48PM -0400, Joe Korty wrote:
>   
>> On Thu, Aug 28, 2008 at 12:03:47PM -0400, Myklebust, Trond wrote:
>>     
>>> This isn't a good solution. The correct thing to do here is to resend
>>> the request for just those permissions that the VFS requested.
>>>       
>> Is there any chance that the cached permissions are shared amoung
>> multiple open(2)'s of the same file?  If sharing happens then we
>> really need to cache all of MAY_EXEC | MAY_WRITE | MAY_READ, rather
>> than just that subset asked for by the open(2) that happens to
>> be the one filling in the cache.
>>
>> In any case, I've rewritten the patch per the above suggestion, and
>>     
>
>
> Hi Trond,
> I've tested the new patch with the test sequence mentioned in the
> original customer bug report, and it seems to work.

It would also be good to pursue getting that NFS server fixed.
It is not protocol compliant.  That's not the way that the
ACCESS operation is specified to work.  The server explicitly
should not return NFS3ERR_ACCESS when access is denied.  The
status portion of the return is supposed to indicate the success
or failure of the ACCESS operation itself, not the access
rights that a process may have w.r.t. a file.  The bitmask is
to be used for that.

       ps
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/