Re: [patch] fix for major securty problem in dquota code

Jes Sorensen (Jes.Sorensen@cern.ch)
12 Mar 1999 11:08:10 +0100


>>>>> "Andrea" == Andrea Arcangeli <andrea@e-mind.com> writes:

Andrea> My friend Andrea Borgia (master admin of our University)
Andrea> reported to me this afternoon that dquota could be overridden
Andrea> by the nfs-server on 2.2.x kernels.

Andrea> I took a look and and the problem was exactly what I
Andrea> anticipated to you today (since you said me that quota was
Andrea> fine except when using the nfs-userspace-server, that's the
Andrea> only bit of code that play with fsuid ;). The problem is that
Andrea> dquot think that the initiator of the operation is the euid of
Andrea> nfsd (and nfsd run as root) and not the euid of the student
Andrea> that is using the NFS client (stored instead in the fsuid
Andrea> field).

Andrea, if you got your head down in the dquota code (and have an idea
about what is going on there) you might want to look at the fact that
it is not SMP safe. I have a report from a guy who had it blow up on
him like 1-2 times/day when running on SMP, whereas it seems to be
fine on UP.

Don't take this as a 'you have to fix it' message, only a suggestion
if you have nothing better to do ;-)

Jes

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/