Uploaded image for project: 'Lustre'
  1. Lustre
  2. LU-4703

setxattr(2) will succeed by a non root user, against a file the user doesn't own.

Details

    • 3
    • 12938

    Description

      [root@localhost ~]# mount -t lustre 192.168.122.225@tcp:/testfs /mnt/
      [root@localhost ~]# ll /mnt/
      total 8
      drwxr-xr-x 2 dyl900 users 4096 Mar 4 16:08 dyl900
      drwxr-xr-x 2 mxa900 users 4096 Mar 4 16:08 mxa900
      [root@localhost ~]# su - dyl900
      [dyl900@localhost ~]$ cd /mnt/
      [dyl900@localhost mnt]$ getfacl ./mxa900

      1. file: mxa900/
      2. owner: mxa900
      3. group: users
        user::rwx
        group::r-x
        other::r-x

      [dyl900@localhost mnt]$ setfacl -m u:dyl900:rwx ./mxa900
      [dyl900@localhost mnt]$ getfacl ./mxa900

      1. file: mxa900/
      2. owner: mxa900
      3. group: users
        user::rwx
        user:dyl900:rwx
        group::r-x
        mask::rwx
        other::r-x

      On our production system, this allows a user access other users' files...

      Attachments

        Issue Links

          Activity

            [LU-4703] setxattr(2) will succeed by a non root user, against a file the user doesn't own.
            pjones Peter Jones made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: In Progress [ 3 ] New: Resolved [ 5 ]
            pjones Peter Jones made changes -
            Labels Original: mn4 patch New: patch
            pjones Peter Jones made changes -
            Fix Version/s New: Lustre 2.4.3 [ 10652 ]
            pjones Peter Jones made changes -
            Labels Original: mn4 mq114 patch New: mn4 patch
            pjones Peter Jones made changes -
            Fix Version/s New: Lustre 2.5.1 [ 10608 ]
            Fix Version/s Original: Lustre 2.5.2 [ 10645 ]
            utopiabound Nathaniel Clark made changes -
            Status Original: Open [ 1 ] New: In Progress [ 3 ]
            pjones Peter Jones made changes -
            Labels Original: mq114 patch New: mn4 mq114 patch
            adilger Andreas Dilger made changes -
            Affects Version/s New: Lustre 2.6.0 [ 10595 ]
            jhammond John Hammond made changes -
            Link New: This issue is related to LU-4704 [ LU-4704 ]
            pjones Peter Jones made changes -
            Assignee Original: WC Triage [ wc-triage ] New: Nathaniel Clark [ utopiabound ]

            People

              utopiabound Nathaniel Clark
              lidongyang Li Dongyang (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: