From: Steve French <smfrench@austin.rr.com>
To: linux-kernel@vger.kernel.org
Subject: uid of person who mounts and user unmount
Date: Wed, 06 Apr 2005 21:36:24 -0500 [thread overview]
Message-ID: <42549CA8.8050104@austin.rr.com> (raw)
smbfs displays the uid of the mounter in show_mounts (viewable in
/proc/mounts ) and this would allow a setuid unmount program to check
the uid of the mounter via /proc/mounts (there is also an ioctl which
does something similar).
Is this approach secure enough?
I slightly prefer an approach in which a program that wishes to check if
the current->uid matches that of the mounter (or that uid which was
specified on the mount command option and which was saved in the fs's
superblock) simply calls an empty ioctl to the fs - which returns yes/no
(the uid of the current process, matches the uid of the process that did
the mount or not, this requires the fs to save the uid at mount but
presumably has the disadvantage of opening a file to get a handle that
you can use for the ioctl).
There are other ways to achieve somewhat similar effect - of allowing
user mounts and unmounts via fstab - but I have had users request a way
to do this via a setuid filesystem specific umount util.
Is there a security issue with displaying the uid of the mounter via the
fs's show_mounts (shows up in /proc/mounts)
reply other threads:[~2005-04-07 2:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42549CA8.8050104@austin.rr.com \
--to=smfrench@austin.rr.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox