From: Ondrej Palkovsky <ondrap@penguin.cz>
To: linux-fsdevel@vger.kernel.org
Subject: setfsuid() and access() syscall
Date: Tue, 04 Aug 2009 22:55:35 +0200 [thread overview]
Message-ID: <4A78A047.8040800@penguin.cz> (raw)
Hello,
the access() syscall (to find out if the user has permission to do
something on file) does not seem to reflect the setfsuid() syscall.
There are 2 conflicting pieces of information:
- kernel/sys.c:
/*
* "setfsuid()" sets the fsuid - the uid used for filesystem checks. This
* is used for "access()" and for the NFS daemon (letting nfsd stay at
* whatever uid it wants to). It normally shadows "euid", except when
* explicitly set by setfsuid() or for access..
*/
- fs/namei.c
/*
* access() needs to use the real uid/gid, not the effective uid/gid.
* We do this by temporarily clearing all FS-related capabilities and
* switching the fsuid/fsgid around to the real ones.
*/
The resulting behaviour (2.6.18, 2.6.28, source code for 2.6.30 seems to
be the same) seems to be that access() is dependent on uid, not fsuid -
this seems to me to be a bug, which unfortunately somewhat inhibits
multithreaded file servers that want to use access() e.g. for ACL
checks. Is there some reason why it is implemented the way it is as it
looks like an intention?
Best regards
Ondrej Palkovsky
next reply other threads:[~2009-08-04 21:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-08-04 20:55 Ondrej Palkovsky [this message]
2009-08-04 21:29 ` setfsuid() and access() syscall Matthew Wilcox
2009-08-05 7:57 ` Ondrej Palkovsky
2009-08-04 21:53 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4A78A047.8040800@penguin.cz \
--to=ondrap@penguin.cz \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).