From owner-freebsd-fs@freebsd.org Thu Feb 27 22:11:55 2020 Return-Path: Delivered-To: freebsd-fs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id A54C0250FC1 for ; Thu, 27 Feb 2020 22:11:55 +0000 (UTC) (envelope-from pen@lysator.liu.se) Received: from mail.lysator.liu.se (mail.lysator.liu.se [IPv6:2001:6b0:17:f0a0::3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 48T6Mr4nBzz499X for ; Thu, 27 Feb 2020 22:11:52 +0000 (UTC) (envelope-from pen@lysator.liu.se) Received: from mail.lysator.liu.se (localhost [127.0.0.1]) by mail.lysator.liu.se (Postfix) with ESMTP id 4D66C40014 for ; Thu, 27 Feb 2020 23:11:49 +0100 (CET) Received: by mail.lysator.liu.se (Postfix, from userid 1004) id 3A22040012; Thu, 27 Feb 2020 23:11:49 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on bernadotte.lysator.liu.se X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,AWL autolearn=disabled version=3.4.2 X-Spam-Score: -1.0 Received: from [192.168.1.132] (h-201-140.A785.priv.bahnhof.se [98.128.201.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.lysator.liu.se (Postfix) with ESMTPSA id 8B89140010; Thu, 27 Feb 2020 23:11:48 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\)) Subject: Re: Linux could write to read only files on FreeBSD NFS server From: Peter Eriksson In-Reply-To: <707243CD-C67E-4DAD-AC5A-68EC11CFFDFD@lysator.liu.se> Date: Thu, 27 Feb 2020 23:11:48 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <6EC06026-DA28-4CAC-8D56-5C7856D4625E@lysator.liu.se> References: <707243CD-C67E-4DAD-AC5A-68EC11CFFDFD@lysator.liu.se> To: FreeBSD Filesystems X-Mailer: Apple Mail (2.3608.60.0.2.5) X-Virus-Scanned: ClamAV using ClamSMTP X-Rspamd-Queue-Id: 48T6Mr4nBzz499X X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=pass (policy=none) header.from=liu.se; spf=pass (mx1.freebsd.org: domain of pen@lysator.liu.se designates 2001:6b0:17:f0a0::3 as permitted sender) smtp.mailfrom=pen@lysator.liu.se X-Spamd-Result: default: False [-4.10 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+a:mail.lysator.liu.se]; MV_CASE(0.50)[]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-fs@freebsd.org]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; RCVD_COUNT_THREE(0.00)[4]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_ALL(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.0.f.7.1.0.0.0.b.6.0.1.0.0.2.list.dnswl.org : 127.0.11.0]; DMARC_POLICY_ALLOW(-0.50)[liu.se,none]; RCVD_TLS_LAST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:1653, ipnet:2001:6b0::/32, country:EU]; MID_RHS_MATCH_FROM(0.00)[]; IP_SCORE(-1.80)[ip: (-7.10), ipnet: 2001:6b0::/32(-1.04), asn: 1653(-0.83), country: EU(-0.01)] X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2020 22:11:55 -0000 I see that this was a bit unclear, writing to the protected file was via = NFS from a Linux (CentOS 7) client. I verified the ACLs and the file = content both via NFSv4 and locally on the FreeBSD server. Writing from an OmniOS (OpenSolaris) client fails. As does a local = write. As it should... Also, it=E2=80=99s not related to ACLs (atleast not directly). Using = =E2=80=9Cchmod=E2=80=9D gives the same effect: > $ rm -f x > $ touch x > $ chmod 000 x > $ ls -l x > ---------- 1 peter86 employee-liu.se 0 27 feb 22.46 x > $ echo foo >x > $ cat x > cat: x: Permission denied > $ chmod 600 x > cat x > foo Rick: Looking at a tcpdump capture of the NFS traffic from the Linux client it = seems to be doing: 1. Client -> Server: V4 Procedure: COMPOUND (1) SEQUENCE (53) PUTFH (22) OPEN (18)=20 share_access: OPEN4_SHARE_ACCESS_WRITE open type: OPEN4_NOCREATE ACCESS (3) Check: RD MD XT XE GETATTR (9) 2. Server -> Client: V4 Procedure: COMPOUND (1) Status: NFS4_OK Operations (5): SEQUENCE (53) Status: NFS4_OK PUTFH Status: NFS4_OK OPEN Status: NFS4_OK ACCESS [Access Denied] Status: NFS4_OK GETATTR Status: NFS4_OK 3. Client -> Server: V4 Procedure: COMPOUND (1) Tag: Operations: SEQUENCE (53)=20 PUTFH (22) WRITE (38) Stable: FILE_SYNC4 GETATTR (9) 4. Server -> Client V4 Procedure: COMPOUND Tag: Operations: SEQUENCE (53) Status: NFS4_OK PUTFH Status: NFS4_OK WRITE Status: NFS4_OK Committed: FILE_SYNC4 GETATTR Status: NFS4_OK (According to Wireshark) Looks like Linux ignores the Access Denied in packet 2 and just forges = ahead, and FreeBSD happily accepts the WRITE in packet 3=E2=80=A6 - Peter > On 27 Feb 2020, at 22:03, Peter Eriksson wrote: >=20 > I can verify that this indeed seems to be the case - the file owner = can always write to files, no matter the permissions set. >=20 > Tested both locally (on ZFS) and over NFS (from the same directory).