uid of user who mounts

uid of user who mounts

[Steve French]

To allow user unmounts of cifs shares (much like the setuid smbumount
utility allows for smbfs), it has been suggested that the cifs vfs could
return the uid of the mounter in /proc/mounts  This would avoid having
to add an ioctl (as smbfs did) and seems as secure as the ioctl approach
(to get the uid of the original mounter).

If user mounts are allowed, is there any worse security exposure in
letting the tool check the uid who mounted via /proc/mounts (to allow
user unmount).   

Is there any precedent for the name for the name of such a parm?  I was
thinking of "mnt_uid" since simply using "uid=" would seem to overload
the meaning of "uid", which is already used as a mount parm by various
filesystems to signify the default uid for files ( ie in the cifs case
when mounting to Windows - and Unix CIFS protocol extensions are not
enabled) and it is not always the case that the default uid for files
would be the same as the uid of the person who mounted.

Re: uid of user who mounts

[Randy.Dunlap]

On Fri, 30 Jul 2004 21:05:09 -0500 Steve French wrote:

| To allow user unmounts of cifs shares (much like the setuid smbumount
| utility allows for smbfs), it has been suggested that the cifs vfs could
| return the uid of the mounter in /proc/mounts  This would avoid having
| to add an ioctl (as smbfs did) and seems as secure as the ioctl approach
| (to get the uid of the original mounter).
| 
| If user mounts are allowed, is there any worse security exposure in
| letting the tool check the uid who mounted via /proc/mounts (to allow
| user unmount).   
| 
| Is there any precedent for the name for the name of such a parm?  I was
| thinking of "mnt_uid" since simply using "uid=" would seem to overload
| the meaning of "uid", which is already used as a mount parm by various
| filesystems to signify the default uid for files ( ie in the cifs case
| when mounting to Windows - and Unix CIFS protocol extensions are not
| enabled) and it is not always the case that the default uid for files
| would be the same as the uid of the person who mounted.

For the last question, looks like "user=" is already used for that.
See 'man mount':

              user   Allow  an  ordinary  user to mount the file system.  The
                     name of the mounting user is written to mtab so that  he
                     can  unmount the file system again.  This option implies
                     the options noexec, nosuid, and nodev (unless overridden
                     by   subsequent   options,   as   in   the  option  line
                     user,exec,dev,suid).



--
~Randy

Re: uid of user who mounts

[Steve French]

Thanks - I had missed that - and it is a little cleaner to call it
"user" than "mount_uid" in the line in /proc/mounts, and there are no
existing parms returned that are similar (except "username" which should
be easy enough to understand). Interestingly I did not see other
filesystems returning that in /proc/mounts (I slightly prefer having it
stored in the filesystems kernel code and returned in showopts not just
put by userspace in the file mtab) - the only minor annoyance is that /
etc/mtab returns the username (rather than the uid).


On Fri, 2004-07-30 at 19:08 -0700, Randy.Dunlap wrote:
> On Fri, 30 Jul 2004 21:05:09 -0500 Steve French wrote:
> 
> | To allow user unmounts of cifs shares (much like the setuid smbumount
> | utility allows for smbfs), it has been suggested that the cifs vfs could
> | return the uid of the mounter in /proc/mounts  This would avoid having
> | to add an ioctl (as smbfs did) and seems as secure as the ioctl approach
> | (to get the uid of the original mounter).
> | 
> | If user mounts are allowed, is there any worse security exposure in
> | letting the tool check the uid who mounted via /proc/mounts (to allow
> | user unmount).   
> | 
> | Is there any precedent for the name for the name of such a parm?  I was
> | thinking of "mnt_uid" since simply using "uid=" would seem to overload
> | the meaning of "uid", which is already used as a mount parm by various
> | filesystems to signify the default uid for files ( ie in the cifs case
> | when mounting to Windows - and Unix CIFS protocol extensions are not
> | enabled) and it is not always the case that the default uid for files
> | would be the same as the uid of the person who mounted.
> 
> For the last question, looks like "user=" is already used for that.
> See 'man mount':
> 
>               user   Allow  an  ordinary  user to mount the file system.  The
>                      name of the mounting user is written to mtab so that  he
>                      can  unmount the file system again.  This option implies
>                      the options noexec, nosuid, and nodev (unless overridden
>                      by   subsequent   options,   as   in   the  option  line
>                      user,exec,dev,suid).
> 
> 
> 
> --
> ~Randy

Re: uid of user who mounts

[Miklos Szeredi]

Steve French wrote:
> 
> Thanks - I had missed that - and it is a little cleaner to call it
> "user" than "mount_uid" in the line in /proc/mounts, and there are no
> existing parms returned that are similar (except "username" which should
> be easy enough to understand). Interestingly I did not see other
> filesystems returning that in /proc/mounts (I slightly prefer having it
> stored in the filesystems kernel code and returned in showopts not just
> put by userspace in the file mtab) - the only minor annoyance is that /
> etc/mtab returns the username (rather than the uid).

I support adding 'user=UID' to the /proc/mounts output.  Actually I
have an older patch which contains this feature.  This is slightly big
patch which also deals with completely elliminating the need for a
suid mount program for some specific filesystems.  See:

http://marc.theaimsgroup.com/?l=linux-fsdevel&m=108116200509753&w=2

Miklos

Re: uid of user who mounts

[Steve French]

That is an interesting patch. 

I confirmed what Randy had mantioned about the user= entries in mtab
allowing umounts (at least it works that way for a few of the local
filesystems I tried) but did not seem to work so well on other
filesystems - I had odd results on umounting my cifs mounts e.g. - after
adding at mount time "user=someuser" to /etc/mtab (by a minor change to
the mount helper mount.cifs.c, when running mount.cifs suid).  umount of
those mounts failed and has been tricky to debug through a privately
built version of umount via ddd (although it is clearly not making it
down to the cifs filesystem on the user umount so the problem is in libc
or in fs/namespace.c) - so I am tracing through fs/namespace.c now.

On Sat, 2004-07-31 at 04:35, Miklos Szeredi wrote:
> Steve French wrote:
> > 
> > Thanks - I had missed that - and it is a little cleaner to call it
> > "user" than "mount_uid" in the line in /proc/mounts, and there are no
> > existing parms returned that are similar (except "username" which should
> > be easy enough to understand). Interestingly I did not see other
> > filesystems returning that in /proc/mounts (I slightly prefer having it
> > stored in the filesystems kernel code and returned in showopts not just
> > put by userspace in the file mtab) - the only minor annoyance is that /
> > etc/mtab returns the username (rather than the uid).
> 
> I support adding 'user=UID' to the /proc/mounts output.  Actually I
> have an older patch which contains this feature.  This is slightly big
> patch which also deals with completely elliminating the need for a
> suid mount program for some specific filesystems.  See:
> 
> http://marc.theaimsgroup.com/?l=linux-fsdevel&m=108116200509753&w=2
> 
> Miklos

Re: uid of user who mounts

[Miklos Szeredi]

Steve French wrote:
>
> I confirmed what Randy had mantioned about the user= entries in mtab
> allowing umounts (at least it works that way for a few of the local
> filesystems I tried) but did not seem to work so well on other
> filesystems - I had odd results on umounting my cifs mounts e.g. - after
> adding at mount time "user=someuser" to /etc/mtab (by a minor change to
> the mount helper mount.cifs.c, when running mount.cifs suid).  umount of
> those mounts failed

I've seen failure to unmount only if there is no matching entry in
/etc/fstab.  It sounds a bit too much paranoia, but who knows.

Miklos

Re: uid of user who mounts

[Steve French]

On Sat, 2004-07-31 at 19:31 +0200, Miklos Szeredi wrote:
> Steve French wrote:
> >
> > I confirmed what Randy had mantioned about the user= entries in mtab
> > allowing umounts (at least it works that way for a few of the local
> > filesystems I tried) but did not seem to work so well on other
> > filesystems - I had odd results on umounting my cifs mounts e.g. - after
> > adding at mount time "user=someuser" to /etc/mtab (by a minor change to
> > the mount helper mount.cifs.c, when running mount.cifs suid).  umount of
> > those mounts failed
> 
> I've seen failure to unmount only if there is no matching entry in
> /etc/fstab.  It sounds a bit too much paranoia, but who knows.
> 
> Miklos

This is getting hard to debug because the mount and umount that ship
with Fedora doesn't match the behavior of mount & umount current source
on kernel.org for the mount utils.  What I have discovered so far is
that the failure in unmount is the check in sys_umount in fs/namespace.c

        if (!capable(CAP_SYS_ADMIN))

which fails presumably because mount did not find a match in /etc/fstab
although I have tried various experiments and it looks like the umount
should have matched the /etc/mtab entry.  My guess is that the matching
rules don't work very well for filesystems unless they specify either a
physical device or name (I had been specifying a UNC name as the device,
but am experimenting with having cifs use the nfs server:export format
to see if that will make umount happier).

Re: uid of user who mounts

[Steve French]

Well, the user unmount of mount.cifs user mounts works on Suse
Workstation with their default umount (the minor change I made was to
/sbin/mount.cifs to add the "user=" that Randy suggested to
mount.cifs.c), even though not on my Fedora install, might be something
slightly different about the Fedora umount or some obscure user error.

Re: uid of user who mounts

[Andries Brouwer]

On Sat, Jul 31, 2004 at 10:21:48AM -0500, Steve French wrote:

> I confirmed what Randy had mantioned about the user= entries in mtab
> allowing umounts (at least it works that way for a few of the local
> filesystems I tried) but did not seem to work so well on other
> filesystems - I had odd results on umounting my cifs mounts e.g. - after
> adding at mount time "user=someuser" to /etc/mtab (by a minor change to
> the mount helper mount.cifs.c, when running mount.cifs suid).  umount of
> those mounts failed and has been tricky to debug through a privately
> built version of umount via ddd (although it is clearly not making it
> down to the cifs filesystem on the user umount so the problem is in libc
> or in fs/namespace.c) - so I am tracing through fs/namespace.c now.

This discussion sounds as if you do think that this is somehow kernel-related.
But it is not. Mount is suid and does certain things in a certain way.
For filesystems that have their own private mount program, that private
mount program is responsible for what happens.

Andries

Re: uid of user who mounts

[Miklos Szeredi]

> This discussion sounds as if you do think that this is somehow
> kernel-related.  But it is not. Mount is suid and does certain
> things in a certain way.

OK.  That doesn't mean, that adding user=UID to the mount options in
/proc/mounts isn't a good idea.  It is, since that would make it
possible to get rid of /etc/mtab, which causes problems for example if
private namespaces are used.



Miklos