https://bugzilla.novell.com/show_bug.cgi?id=304318 Jiri Dluhos changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |kernel-maintainers@forge.provo.novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c2 Frank-Michael Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|nfs mounts in fstab with "users" option work for|"user" and "users" options in fstab do not work |root user only |for nfs mounts Version|Beta 3 |RC 1 --- Comment #2 from Frank-Michael Fischer 2007-09-21 09:54:02 MST --- now with RC1 no improvement: both "user" and "users" options in fstab do not work for nfs mounts. Here is the export I can mount without any problems from four other system in the LAN: mifi@fmfwepa:~$ cat /etc/exports # /etc/exports: the access control list for filesystems which may be exported # to NFS clients. See exports(5). /home/ *(rw,no_root_squash,sync) Here my fstab lines: fmfwepa.cp:/home /mnt/fhome nfs noauto,users 0 0 or fmfwepa.cp:/home /mnt/fhome nfs noauto,user 0 0 and here is the standard, reproducable error message I am getting from openSUSE 10.3 RC1 only: mifi@littlerc1:~> mount /mnt/fhome mount: fmfwepa.cp:/home failed, reason given by server: Permission denied -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c3 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jeffm@novell.com Status|NEW |NEEDINFO Info Provider| |fmfischer@gmx.net --- Comment #3 from Jeff Mahoney 2007-09-27 12:12:24 MST --- Please attach your /var/log/messages so we can get a more detailed report. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c4 Frank-Michael Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|fmfischer@gmx.net | --- Comment #4 from Frank-Michael Fischer 2007-09-27 20:15:48 MST --- Created an attachment (id=175348) --> (https://bugzilla.novell.com/attachment.cgi?id=175348) /var/log/messages and the failed mount attempts as requested This has been reproduced with a fresh installation from factory as of today. Slight improvement: At least Gnome shows the error message now when trying to mount per mouse click. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c7 Frank-Michael Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|"user" and "users" options in fstab do not work |"user","users" and "auto" options in fstab do |for nfs mounts |not work for nfs mounts --- Comment #7 from Frank-Michael Fischer 2007-09-28 01:49:08 MST --- So I'll add the "auto" option problem to the bug summary. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c9 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mkoenig@novell.com, security-team@suse.de, | |coolo@novell.com AssignedTo|kernel-maintainers@forge.provo.novell.com |ro@novell.com --- Comment #9 from Ludwig Nussel 2007-10-05 02:08:01 MST --- Previously mounting nfs volumes was done by mount itself. Now it's an external helper. mount however drops privileges before calling external helpers. Therefore mount.nfs can a) not bind to a privileged port and b) cannot issue the final mount() syscall. There are two possible solutions: - make mount.nfs setuid root - change mount to not drop privileges. I guess the latter is not an option atm, therefore I'll open a separate audit request for mount.nfs to be setuid root. It has yet to be decided whether we then want to update permissions.rpm and nfs-utils.rpm for 10.3 to fix this bug. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c11 --- Comment #11 from Frank-Michael Fischer 2007-10-07 15:25:27 MST --- my wild guess: portmap is not running on your system? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c14 --- Comment #14 from Ruediger Oertel 2007-10-10 05:17:11 MST --- upstream installing some binary as suid root (or sgid root) and us packaging things this way are two completely different things. Most of all, any added suid/sgid binary needs to pass a security audit, which has proved a very, very valuable thing to do before installing something with such mighty permissions. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c18 --- Comment #18 from Ruediger Oertel 2007-10-11 18:13:16 MST --- yes, "user" and "users" are valid options. yes, this is broken right now. In order to fix this, mount.nfs needs to be made suid-root. To be allowed to do that, I need to get a security audit for this binary, otherwise I will not be able/allowed to make _any_ binary suid-root. Yes, it was my fault not to request the audit in time, but actually I never even tried nfs-mounts as a normal user (sorry, autofs addict ...) and this is the first bug report in this regard. The audit is already happening, once it is done, we can update the package with a suid-root mount.nfs binary. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c21 Paul Abrahams changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abrahams@acm.org --- Comment #21 from Paul Abrahams 2007-10-30 21:21:35 MST --- I encountered both problems in OpenSuSE 10.3 - the failure of user/users and the failure of the initial boot to do automounting of nsf volumes. I verified that setting the s bit on /sbin/mount.nfs (/sbin/umount.nfs is symlinked to it) makes the problem go away. I also encountered the rpc.statd problem but solved that one by enabling nfs server support in the runlevel options (overkill, to be sure). Comment #8 to the contrary, auto does not work for me with nfs. I have to mount the volumes explicitly after login. I suspect some problems with the runlevel dependencies (so that the mount happens too early) but I haven't been able to figure out what it is. A simple solution might be to do a second "mount -a" during initialization to catch the nsf mounts, in case everything else has to be mounted much earlier. A redundant "mount -a" should do no harm. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318#c23 --- Comment #23 from Paul Abrahams 2007-10-31 08:33:21 MST --- (In reply to comment #8 from Frank-Michael Fischer)

After having tested 10.3 final:

The "auto" option works now.

Not for me! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User ro@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c25 Ruediger Oertel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO Info Provider| |abrahams@acm.org --- Comment #25 from Ruediger Oertel 2008-05-02 08:00:44 MST --- are you sure that the nfs boot script is active on your system ? what does "/sbin/chkconfig -l nfs" show ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta@cboltz.de Status|NEEDINFO |ASSIGNED Info Provider|abrahams@acm.org | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User ro@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c28 Ruediger Oertel changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|ro@novell.com |nfbrown@novell.com Status|ASSIGNED |NEW --- Comment #28 from Ruediger Oertel 2008-05-24 03:13:03 MDT --- there is no agreement yet wrt. a suid-bit for this binary. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User nfbrown@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c30 Neil Brown changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |estellnb@gmail.com --- Comment #30 from Neil Brown 2008-05-26 22:38:44 MDT --- *** Bug 353538 has been marked as a duplicate of this bug. *** https://bugzilla.novell.com/show_bug.cgi?id=353538 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User coolo@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c32 --- Comment #32 from Stephan Kulow 2008-06-02 03:42:16 MDT --- After doing this, Ludwig's suggestion is to enhance mount to not drop its priviledge for "user" mounts. This is for 11.1 though -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User fmfischer@gmx.net added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c33 --- Comment #33 from Frank-Michael Fischer 2008-06-02 03:51:51 MDT --- So what does in mean for the "user" and "users" options for nfs mounts bug in fstab? Will 11.0 now fix the bug and 11.1 recreate bug or the other way around? As fstab is writable by root only I can't see any sense in creating this nfs mount problem. Whoever puts "user" and "users" options into fstab is root and root knows per definition what it is doing. Anything else will lead to security paranoia. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=304318 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=304318#c35 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #35 from Ludwig Nussel 2008-06-02 04:03:59 MDT --- nfs-utils lacks the necessary scriptlets for suid binary handling -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.