From: Udo Grabowski (udo.grabowski@imk.fzk.de)
Date: Tue Nov 12 2002 - 08:27:33 EST
Thanks to Dr. Thomas Blinn and Martin Moore !
There's no consensus on the topic yet, Dr.Blinn says it's
supposed to work like required by default when exporting
in a homogeneous environment. We meet al the requirements
mentioned, but it does not work on a Tru64-Solaris mix.
Mr. Moore states that only a suid root script can do this
(in the general case ?). But that can only be done if the
filesystem is exported with the 'root=...' option (see man
exports), which maps root on different machines to uid 0
instead of nobody, opening more severe security holes.
Life would be much easier if there were no crackers...
==================== Original question =====================
We try to allow non-root chowns on exported filesystems
on Tru64 5.1a, NFS V3. On Solaris, this is forbidden by
default (Posix compatibility), but can be allowed by
setting the parameter rstchown to 0 in /etc/system. I
cannot find any analogous parameter in sysconfigtab for
Tru64.
We know that this may open security holes, but we think
we are in a secure enough environment, and we need this
for specific tasks.
------------------------------------------------------------
Dr.Thomas Blinn writes:
In my recollection (but I'd have to do some tests to confirm
this), the behavior you want is the default provided that the
user ID maps correctly (that is, the user who wants to do the
"chown" really does own the resource based on their user ID).
Of course, to make this work, both the client and the server
have to cooperate and the client has to pass the right credentials,
etc. I have had this "just work" in the homogeneous case (both
systems running Tru64 UNIX, same user ID mapping in effect on
both through NIS or local passwd files being identical).
------------------------------------------------------------
Martin Moore writes:
No inherent way to do it in the system (i.e., no parameter,
option, etc.) You'd have to write your own wrapper program
that runs setuid root and performs the chown.
-- Dr. Udo Grabowski email: udo.grabowski@imk.fzk.de Institut f. Meteorologie und Klimaforschung II, Forschungszentrum Karslruhe Postfach 3640, D-76021 Karlsruhe, Germany Tel: (+49) 7247 82-6026 http://www.fzk.de/imk/imk2/ame/grabowski/ Fax: " -6141
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:48:59 EDT