Re: [PATCH] Add a --mode option to chmod the mount point of the maps

[Ian Kent <raven@themaw.net>]

On Mon, 2015-09-14 at 10:42 +0200, Cyril B. wrote:
> Ian Kent wrote:
> > On Sun, 2015-09-13 at 15:56 +0200, Cyril B. wrote:
> >> It looks like the mount point of the maps have fixed permissions, 755. I
> >> need to have different permissions: in my use case, I want /home (which
> >> is handled by autofs) to be set to 751.
> >
> > Why is this needed?
> 
> Why do I want to set /home to 751? When it was set to 755, I frequently 
> had users believing there was a serious vulnerability because they could 
> list /home. Stupid, I know, but setting the permissions to 751 was a 
> trivial solution for this.
> 
> >> The initial permissions of /home are overwritten when autofs is started,
> >> so changing those doesn't help.
> >
> > They aren't overwritten.
> > The permissions are those of the autofs mount that is mounted
> > over /home.
> 
> I'm not sure I'm following you. Here's my auto.master:
> 
> /home program:/etc/auto.home

Which means there will be an autofs pseudo file system mounted on /home
when automount(8) starts.

This is how the kernel intercepts accesses to these and calls back to
the automount(8) daemon to request it perform mounts.

> 
> Before launching autofs, permissions are set to 751:
> 
> # ls -ald /home
> drwxr-x--x 2 root root 4096 Aug  7 11:09 /home
> 
> Once I've launched autofs, permissions are reset to 755:

The permissions are those of the root of the autofs pseudo file system,
the permissions of the underlying mount point aren't changed.

> 
> # ls -ald /home
> drwxr-xr-x 2 root root 0 Sep 14 10:32 /home
> 
> And when I quit autofs, my permissions are back to 751:

Because the autofs pseudo file system is then umounted and the
underlying directory is again visible.

> 
> # ls -ald /home
> drwxr-x--x 2 root root 4096 Aug  7 11:09 /home
> 
> What I want is to always have /home permissions set to 751.

I still don't understand how that's an effective security measure.

Anyone determined enough will be able to find out the directory names
and can then change to them, assuming the permissions of the mounts
themselves allow it.

No-one can do anything much in the autofs pseudo file system except the
daemon itself, and usually the request is that the mount points within
an autofs mount be seen, aka. the browse option, not hidden, ;)

So are you saying you don't have sufficient faith in the permissions set
on the file systems your mounting, that contain the information you want
to protect, that you must have the permissions of an intermediate file
system set to ensure that information about that vulnerability is not
seen?

Can't say I can see how this has any actual benefit at all.

Ian

--
To unsubscribe from this list: send the line "unsubscribe autofs" in