Commit 6473a559 authored by Steve French's avatar Steve French

[CIFS] Fix missing permission check on setattr when noperm mount option is

disabled.  Also set mode, uid, gid better on mkdir and create for the
case when Unix Extensions is not enabled and setuids is enabled. This is
necessary to fix the hole in which chown could be allowed for non-root
users in some cases if root mounted, and also to display the mode and uid
properly in some cases.
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent 3abb9272
...@@ -6,7 +6,7 @@ stress on writes). Modify cifs Kconfig options to expose CONFIG_CIFS_STATS2 ...@@ -6,7 +6,7 @@ stress on writes). Modify cifs Kconfig options to expose CONFIG_CIFS_STATS2
Fix SFU style symlinks and mknod needed for servers which do not support the Fix SFU style symlinks and mknod needed for servers which do not support the
CIFS Unix Extensions. Fix setfacl/getfacl on bigendian. Timeout negative CIFS Unix Extensions. Fix setfacl/getfacl on bigendian. Timeout negative
dentries so files that the client sees as deleted but that later get created dentries so files that the client sees as deleted but that later get created
on the server will be recognized. on the server will be recognized. Add client side permission check on setattr.
Version 1.38 Version 1.38
------------ ------------
......
...@@ -278,7 +278,9 @@ A partial list of the supported mount options follows: ...@@ -278,7 +278,9 @@ A partial list of the supported mount options follows:
(such as Windows), permissions can also be checked at the (such as Windows), permissions can also be checked at the
client, and a crude form of client side permission checking client, and a crude form of client side permission checking
can be enabled by specifying file_mode and dir_mode on can be enabled by specifying file_mode and dir_mode on
the client the client. Note that the mount.cifs helper must be
at version 1.10 or higher to support specifying the uid
(or gid) in non-numberic form.
gid If CIFS Unix extensions are not supported by the server gid If CIFS Unix extensions are not supported by the server
this overrides the default gid for inodes. this overrides the default gid for inodes.
file_mode If CIFS Unix extensions are not supported by the server file_mode If CIFS Unix extensions are not supported by the server
...@@ -345,7 +347,10 @@ A partial list of the supported mount options follows: ...@@ -345,7 +347,10 @@ A partial list of the supported mount options follows:
client system. It is typically only needed when the server client system. It is typically only needed when the server
supports the CIFS Unix Extensions but the UIDs/GIDs on the supports the CIFS Unix Extensions but the UIDs/GIDs on the
client and server system do not match closely enough to allow client and server system do not match closely enough to allow
access by the user doing the mount. access by the user doing the mount, but it may be useful with
non CIFS Unix Extension mounts for cases in which the default
mode is specified on the mount but is not to be enforced on the
client (e.g. perhaps when MultiUserMount is enabled)
Note that this does not affect the normal ACL check on the Note that this does not affect the normal ACL check on the
target machine done by the server software (of the server target machine done by the server software (of the server
ACL against the user name provided at mount time). ACL against the user name provided at mount time).
...@@ -368,15 +373,21 @@ A partial list of the supported mount options follows: ...@@ -368,15 +373,21 @@ A partial list of the supported mount options follows:
setuids If the CIFS Unix extensions are negotiated with the server setuids If the CIFS Unix extensions are negotiated with the server
the client will attempt to set the effective uid and gid of the client will attempt to set the effective uid and gid of
the local process on newly created files, directories, and the local process on newly created files, directories, and
devices (create, mkdir, mknod). devices (create, mkdir, mknod). If the CIFS Unix Extensions
are not negotiated, for newly created files and directories
instead of using the default uid and gid specified on the
the mount, cache the new file's uid and gid locally which means
that the uid for the file can change when the inode is
reloaded (or the user remounts the share).
nosetuids The client will not attempt to set the uid and gid on nosetuids The client will not attempt to set the uid and gid on
on newly created files, directories, and devices (create, on newly created files, directories, and devices (create,
mkdir, mknod) which will result in the server setting the mkdir, mknod) which will result in the server setting the
uid and gid to the default (usually the server uid of the uid and gid to the default (usually the server uid of the
user who mounted the share). Letting the server (rather than user who mounted the share). Letting the server (rather than
the client) set the uid and gid is the default. This the client) set the uid and gid is the default. If the CIFS
parameter has no effect if the CIFS Unix Extensions are not Unix Extensions are not negotiated then the uid and gid for
negotiated. new files will appear to be the uid (gid) of the mounter or the
uid (gid) parameter specified on the mount.
netbiosname When mounting to servers via port 139, specifies the RFC1001 netbiosname When mounting to servers via port 139, specifies the RFC1001
source name to use to represent the client netbios machine source name to use to represent the client netbios machine
name when doing the RFC1001 netbios session initialize. name when doing the RFC1001 netbios session initialize.
...@@ -418,6 +429,13 @@ A partial list of the supported mount options follows: ...@@ -418,6 +429,13 @@ A partial list of the supported mount options follows:
byte range locks). byte range locks).
remount remount the share (often used to change from ro to rw mounts remount remount the share (often used to change from ro to rw mounts
or vice versa) or vice versa)
sfu When the CIFS Unix Extensions are not negotiated, attempt to
create device files and fifos in a format compatible with
Services for Unix (SFU). In addition retrieve bits 10-12
of the mode via the SETFILEBITS extended attribute (as
SFU does). In the future the bottom 9 bits of the mode
mode also will be emulated using queries of the security
descriptor (ACL).
The mount.cifs mount helper also accepts a few mount options before -o The mount.cifs mount helper also accepts a few mount options before -o
including: including:
......
version 1.37 October 9, 2005 Version 1.39 November 30, 2005
A Partial List of Missing Features A Partial List of Missing Features
================================== ==================================
...@@ -58,7 +58,7 @@ o) Improve performance of readpages by sending more than one read ...@@ -58,7 +58,7 @@ o) Improve performance of readpages by sending more than one read
at a time when 8 pages or more are requested. In conjuntion at a time when 8 pages or more are requested. In conjuntion
add support for async_cifs_readpages. add support for async_cifs_readpages.
p) Add support for storing symlink and fifo info to Windows servers p) Add support for storing symlink info to Windows servers
in the Extended Attribute format their SFU clients would recognize. in the Extended Attribute format their SFU clients would recognize.
q) Finish fcntl D_NOTIFY support so kde and gnome file list windows q) Finish fcntl D_NOTIFY support so kde and gnome file list windows
......
...@@ -228,8 +228,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode, ...@@ -228,8 +228,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
else { else {
rc = cifs_get_inode_info(&newinode, full_path, rc = cifs_get_inode_info(&newinode, full_path,
buf, inode->i_sb,xid); buf, inode->i_sb,xid);
if(newinode) if(newinode) {
newinode->i_mode = mode; newinode->i_mode = mode;
if((oplock & CIFS_CREATE_ACTION) &&
(cifs_sb->mnt_cifs_flags &
CIFS_MOUNT_SET_UID)) {
newinode->i_uid = current->fsuid;
newinode->i_gid = current->fsgid;
}
}
} }
if (rc != 0) { if (rc != 0) {
......
...@@ -710,7 +710,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode) ...@@ -710,7 +710,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
char *full_path = NULL; char *full_path = NULL;
struct inode *newinode = NULL; struct inode *newinode = NULL;
cFYI(1, ("In cifs_mkdir, mode = 0x%x inode = 0x%p ", mode, inode)); cFYI(1, ("In cifs_mkdir, mode = 0x%x inode = 0x%p", mode, inode));
xid = GetXid(); xid = GetXid();
...@@ -768,6 +768,15 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode) ...@@ -768,6 +768,15 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
/* BB to be implemented via Windows secrty descriptors /* BB to be implemented via Windows secrty descriptors
eg CIFSSMBWinSetPerms(xid, pTcon, full_path, mode, eg CIFSSMBWinSetPerms(xid, pTcon, full_path, mode,
-1, -1, local_nls); */ -1, -1, local_nls); */
if(direntry->d_inode) {
direntry->d_inode->i_mode = mode;
if(cifs_sb->mnt_cifs_flags &
CIFS_MOUNT_SET_UID) {
direntry->d_inode->i_uid =
current->fsuid;
direntry->d_inode->i_gid =
current->fsgid;
}
} }
} }
kfree(full_path); kfree(full_path);
...@@ -1111,9 +1120,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs) ...@@ -1111,9 +1120,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
cFYI(1, ("In cifs_setattr, name = %s attrs->iavalid 0x%x ", cFYI(1, ("In cifs_setattr, name = %s attrs->iavalid 0x%x ",
direntry->d_name.name, attrs->ia_valid)); direntry->d_name.name, attrs->ia_valid));
cifs_sb = CIFS_SB(direntry->d_inode->i_sb); cifs_sb = CIFS_SB(direntry->d_inode->i_sb);
pTcon = cifs_sb->tcon; pTcon = cifs_sb->tcon;
if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM == 0) {
/* check if we have permission to change attrs */
rc = inode_change_ok(direntry->d_inode, attrs);
if(rc < 0) {
FreeXid(xid);
return rc;
} else
rc = 0;
}
down(&direntry->d_sb->s_vfs_rename_sem); down(&direntry->d_sb->s_vfs_rename_sem);
full_path = build_path_from_dentry(direntry); full_path = build_path_from_dentry(direntry);
up(&direntry->d_sb->s_vfs_rename_sem); up(&direntry->d_sb->s_vfs_rename_sem);
...@@ -1153,7 +1173,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs) ...@@ -1153,7 +1173,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
1 /* 45 seconds */); 1 /* 45 seconds */);
cFYI(1,("Wrt seteof rc %d", rc)); cFYI(1,("Wrt seteof rc %d", rc));
} }
} } else
rc = -EINVAL;
if (rc != 0) { if (rc != 0) {
/* Set file size by pathname rather than by handle /* Set file size by pathname rather than by handle
either because no valid, writeable file handle for either because no valid, writeable file handle for
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment