Re: Error's opening credentials file.

On Fri, 2 Apr 2010 15:12:12 -0400
Jeff Layton <[email protected]> wrote:

> On Fri, 2 Apr 2010 17:11:20 +0200
> Stef Bon <[email protected]> wrote:
> 
> > Hello,
> > 
> > I'm using a construction to make resources (local and remote) on a
> > userfriendly manner available in map in the users
> > home directory. These resources are USB devices (local) and FTP and
> > SSH hosts, and SMB shares.
> > 
> > For mounting the construction is using the autofs automounter for Linux.
> > It's running with root permissions.
> > 
> > To mount SMB shares of course mount.cifs is used, and a personalized
> > credentialsfile. So the mountcommand looks like:
> > 
> > mount.cifs "//$SMM_name/$SMB_share" $mount_directory -o
> > ip=$SMB_ip,credentialsfile=/home/sbon/.smb/mount.cred
> > 
> > Now with the latest version of cifs.utils 4.2, it does not mount. The
> > error it gives is:
> > 
> > error -1 (Unknown error 4294967295) opening credential file
> > /home/sbon/.smb/mount.cred
> > 
> > Now after some trying, when I put the credential file in a subdir of
> > root's home, it's ok:
> > 
> > mv /home/sbon/.smb/mount.cred /root/.smb
> > 
> > and I adjust the config of my construction to look for this
> > credentialfile, everything works again.
> > 
> > The permissions of the cred file is not changed! Apparently the
> > mount.cifs command also looks at the
> > directories above it (parents).
> > 
> > Now checking the code the function that reads the cred file is
> > open_cred_file, which uses the access call to check access.
> > Obviously that function checks the permissions of all the parent dirs,
> > and sees that the user root has not enough permissions, which is not
> > true.
> > 
> > IT's not such a big problem, I've got it working again, but it should
> > be documented.
> > 
> > Stef
> 
> What was the last version on which this worked? Are you mount.cifs as a
> setuid root program? Is mount.cifs linked against libcap?
> 

Does the attached patch fix the problem?

-- 
Jeff Layton <[email protected]>

_______________________________________________
linux-cifs-client mailing list
[email protected]
https://lists.samba.org/mailman/listinfo/linux-cifs-client

From d652b86adc7e9c62ba71b315e91fdd24af0063d8 Mon Sep 17 00:00:00 2001
From: Jeff Layton <[email protected]>
Date: Fri, 2 Apr 2010 16:02:37 -0400
Subject: [PATCH] mount.cifs: if real uid is 0, child must keep CAP_DAC_OVERRIDE

...otherwise, root may not be able to read credential files. The ideal
thing would be to remove it from the effective set, and only turn it
on when needed, but for now this should fix the immediate problem.

Signed-off-by: Jeff Layton <[email protected]>
---
 mount.cifs.c |   17 ++++++++++-------
 1 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/mount.cifs.c b/mount.cifs.c
index ab155e3..7d1fa83 100644
--- a/mount.cifs.c
+++ b/mount.cifs.c
@@ -1150,7 +1150,7 @@ add_mtab_exit:
 static int
 drop_capabilities(int parent)
 {
-	int rc = 0;
+	int rc = 0, ncap;
 	cap_t caps;
 	cap_value_t cap_list[2];
 
@@ -1168,17 +1168,20 @@ drop_capabilities(int parent)
 		goto free_caps;
 	}
 
-	/* parent needs to keep some capabilities */
-	if (parent) {
-		cap_list[0] = CAP_SYS_ADMIN;
-		cap_list[1] = CAP_DAC_OVERRIDE;
-		if (cap_set_flag(caps, CAP_PERMITTED, 2, cap_list, CAP_SET) == -1) {
+	if (parent || getuid() == 0) {
+		ncap = 1;
+		cap_list[0] = CAP_DAC_OVERRIDE;
+		if (parent) {
+			cap_list[1] = CAP_SYS_ADMIN;
+			++ncap;
+		}
+		if (cap_set_flag(caps, CAP_PERMITTED, ncap, cap_list, CAP_SET) == -1) {
 			fprintf(stderr, "Unable to set permitted capabilities: %s\n",
 				strerror(errno));
 			rc = EX_SYSERR;
 			goto free_caps;
 		}
-		if (cap_set_flag(caps, CAP_EFFECTIVE, 2, cap_list, CAP_SET) == -1) {
+		if (cap_set_flag(caps, CAP_EFFECTIVE, ncap, cap_list, CAP_SET) == -1) {
 			fprintf(stderr, "Unable to set effective capabilities: %s\n",
 				strerror(errno));
 			rc = EX_SYSERR;
-- 
1.6.6.1