From mboxrd@z Thu Jan 1 00:00:00 1970 From: Neil Brown Subject: Re: Pass "allow owner override" flags from NFSD down to actual FS. Date: Thu, 27 Apr 2006 10:28:16 +1000 Message-ID: <17488.4128.223730.153313@cse.unsw.edu.au> References: <20060422202935.GU22333@linuxhacker.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: linux-fsdevel@vger.kernel.org Return-path: Received: from mx2.suse.de ([195.135.220.15]:15802 "EHLO mx2.suse.de") by vger.kernel.org with ESMTP id S1751338AbWD0A21 (ORCPT ); Wed, 26 Apr 2006 20:28:27 -0400 To: Oleg Drokin In-Reply-To: message from Oleg Drokin on Saturday April 22 Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Saturday April 22, green@linuxhacker.ru wrote: > Hello! > > NFSD does its own internal checks to possibly override restrictive file mode > for file owner already, to allow writing into (opened) file with some > restrictive mode (like 0000). But it does not pass this info down to > actual filesystems, and if that filesystem is also doing permission checks > in open, such an open would fail at FS-level. > (I thought of making an example with NFS exported with NFS, but this appears > to be not allowed, so I choose different example). > For example Lustre is contacting its metadata server for every open, and > metadata server does permission checks for open, obviously. > > I wonder if something like the patch below can be useful for any other > distributed FS now in use and ultimately to end up accepted into vanilla > tree? > Would it be acceptable for the lowlevel filesystem to simply always assume OWNER_OVERRIDE?? There are no security concerns in allowing read or write access to an owner. The IRUSR bit is almost entirely pointless, and the IWUSR bit is at most hint for user-level processes. Given that you know the syscall interface will be checking these, and given that they have no security implication, is there really any value in having the lowlevel filesystem check them as well? Other than that, my only concern is that it seems to allow a user-space application to open a file with O_OWNER_OVERRIDE and you would want that sort of change to get wide visibility. I don't think it is a problem, but there might be those who would. NeilBrown