Security hole in linux-2.0.31-pre9 (NFS related)

Hubert Mantel (mantel@suse.de)
Tue, 7 Oct 1997 16:18:25 +0200 (MEST)


Hello,

I just discovered the following behaviour:

Given the following file:

Mandelbrot:/home/alex/mantel/Kernel # l test
-rw------- 1 mantel suse 149 Oct 7 16:09 test

The file is on a NFS-mounted filesystem with root_squash, so root cannot
read the file:

Mandelbrot:/home/alex/mantel/Kernel # cat test
cat: test: I/O error
Mandelbrot:/home/alex/mantel/Kernel # cat test
cat: test: Permission denied

Now, after the owner has read the file on the same machine, it is readable
by root afterwards:

Mandelbrot:/home/alex/mantel/Kernel # cat test
blabla

Seems like some problem with the NFS caching code?
The server is running linux-2.0.31-pre2(DaveM), the client is running
linux-2.0.31-pre9(Linus).

Hubert