getting rid of "mount: only root can ..."

getting rid of "mount: only root can ..."

[Andy Lutomirski]

This isn't really true any more.  Can we get rid of those checks or at
least have an option to turn them off?

-- 
Andy Lutomirski
AMA Capital Management, LLC

Re: getting rid of "mount: only root can ..."

[Dale R. Worley]

> From: Andy Lutomirski <luto@amacapital.net>
> 
> This isn't really true any more.  Can we get rid of those checks or at
> least have an option to turn them off?

My understanding is that whether the user has to be root when running
mount depends on the "user" and "users" options in fstab.  I assume
that "those checks" haven't changed recently because the required
behavior hasn't changed recently.

Dale

Re: getting rid of "mount: only root can ..."

[Andy Lutomirski]

On Fri, May 2, 2014 at 3:21 PM, Dale R. Worley <worley@alum.mit.edu> wrote:
>> From: Andy Lutomirski <luto@amacapital.net>
>>
>> This isn't really true any more.  Can we get rid of those checks or at
>> least have an option to turn them off?
>
> My understanding is that whether the user has to be root when running
> mount depends on the "user" and "users" options in fstab.  I assume
> that "those checks" haven't changed recently because the required
> behavior hasn't changed recently.

Blech.  I forgot that mount is setuid root.

What if mount determined that the requested option wasn't allowed by
fstab and instead fell back to dropping privileges and trying anyway?

--Andy

Re: getting rid of "mount: only root can ..."

[Dale R. Worley]

> From: Andy Lutomirski <luto@amacapital.net>

> What if mount determined that the requested option wasn't allowed by
> fstab and instead fell back to dropping privileges and trying anyway?

I'm not envisioning the problem that you're addressing very well.

What I was thinking is that, in the best of all worlds, if mount
doesn't permit the requested operation, it should correctly report the
test that failed.  For instance, sometimes only root may perform the
operation, and so mount should say

 "mount: only root can ..."

But if members of group 'foo' are permitted, then it should say

 "mount: only members of 'foo' and root can ..."

etc.

Dale

Re: getting rid of "mount: only root can ..."

[Andy Lutomirski]

On Mon, May 5, 2014 at 3:50 PM, Dale R. Worley <worley@alum.mit.edu> wrote:
>> From: Andy Lutomirski <luto@amacapital.net>
>
>> What if mount determined that the requested option wasn't allowed by
>> fstab and instead fell back to dropping privileges and trying anyway?
>
> I'm not envisioning the problem that you're addressing very well.

If I set up a user namespace in which non-root users can call mount
(the system call), it's annoying to work with because mount (the
util-linux program) just assumes that uid != 0 means that mount won't
work.

The issue here is that there are two conflicting sets of policy: the
in-kernel policy of who may mount/umount and the userspace policy of
who may use the setuid mount tool to mount as euid == 0 despite their
actual (kernel) privileges.

Re: getting rid of "mount: only root can ..."

[Karel Zak]

On Mon, May 05, 2014 at 03:58:50PM -0700, Andy Lutomirski wrote:
> On Mon, May 5, 2014 at 3:50 PM, Dale R. Worley <worley@alum.mit.edu> wrote:
> >> From: Andy Lutomirski <luto@amacapital.net>
> >
> >> What if mount determined that the requested option wasn't allowed by
> >> fstab and instead fell back to dropping privileges and trying anyway?
> >
> > I'm not envisioning the problem that you're addressing very well.
> 
> If I set up a user namespace in which non-root users can call mount
> (the system call), it's annoying to work with because mount (the
> util-linux program) just assumes that uid != 0 means that mount won't
> work.
> 
> The issue here is that there are two conflicting sets of policy: the
> in-kernel policy of who may mount/umount and the userspace policy of
> who may use the setuid mount tool to mount as euid == 0 despite their
> actual (kernel) privileges.

Andy is right, mount(8) is very paranoid when executed by non-root
users (sure, because it's suid almost everywhere).

I'll try to improve it to make it more usable with user namespaces.
The problem is that mount(8) is not just about mount(2) call only. If
we drop privileges then mount(8) will report problems with things like
FS detection, loopdevs setups, etc. It's necessary to review the code
and make errors/warnings somehow usable. ... added to my TODO for the
next week ;-)

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: getting rid of "mount: only root can ..."

[Dale R. Worley]

> From: Karel Zak <kzak@redhat.com>

> I'll try to improve it to make it more usable with user namespaces.
> The problem is that mount(8) is not just about mount(2) call only. If
> we drop privileges then mount(8) will report problems with things like
> FS detection, loopdevs setups, etc. It's necessary to review the code
> and make errors/warnings somehow usable. ... added to my TODO for the
> next week ;-)

Yeah, that's the only thing that will work well:  Have mount(8) and
the kernel both know what the rules are and enforce them
consistently.  And ideally, mount(8) should tell the user exactly what
the rule is that's being violated.

Dale

Re: getting rid of "mount: only root can ..."

[Andy Lutomirski]

[-- Attachment #1: Type: text/plain, Size: 887 bytes --]

On May 6, 2014 6:50 AM, "Dale R. Worley" <worley@alum.mit.edu> wrote:
>
> > From: Karel Zak <kzak@redhat.com>
>
> > I'll try to improve it to make it more usable with user namespaces.
> > The problem is that mount(8) is not just about mount(2) call only. If
> > we drop privileges then mount(8) will report problems with things like
> > FS detection, loopdevs setups, etc. It's necessary to review the code
> > and make errors/warnings somehow usable. ... added to my TODO for the
> > next week ;-)
>
> Yeah, that's the only thing that will work well:  Have mount(8) and
> the kernel both know what the rules are and enforce them
> consistently.  And ideally, mount(8) should tell the user exactly what
> the rule is that's being violated.
>

A kind of hackish solution would be for mount --nopriv or whatever to drop
privileges immediately and stop enforcing any policy at all.

--Andy

[-- Attachment #2: Type: text/html, Size: 1210 bytes --]

Re: getting rid of "mount: only root can ..."

[Dale R. Worley]

> From: Andy Lutomirski <luto@amacapital.net>
> 
> A kind of hackish solution would be for mount --nopriv or whatever to drop
> privileges immediately and stop enforcing any policy at all.

Given what Karel has said, I'm not sure that would give the correct
behavior:

    The problem is that mount(8) is not just about mount(2) call only. If
    we drop privileges then mount(8) will report problems with things like
    FS detection, loopdevs setups, etc. It's necessary to review the code
    and make errors/warnings somehow usable.

Dale