https://bugzilla.novell.com/show_bug.cgi?id=463524 User mc@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c1 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |INVALID --- Comment #1 from Michael Calmer 2009-01-10 08:43:25 MST --- If I remember correctly, we had a security fix for pam_mount (11.0) because of these ignored options. Thank you for testing, that this is working. You can simply define what options are allowed and what options should be denied and what options are required. But you must do this in /etc/security/pam_mount.conf.xml Normal user can only use, what the admin allow to use. ########### from /etc/security/pam_mount.conf.xml ############# <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other"/> <!-- <mntoptions deny="suid,dev" /> <mntoptions allow="*" /> <mntoptions deny="*" /> --> <mntoptions require="nosuid,nodev"/> ################################################################ closing as "invalid" because this is a missconfiguration. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User mc@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c3 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |jengelh@medozas.de Resolution|INVALID | --- Comment #3 from Michael Calmer 2009-01-12 05:26:06 MST --- mounting cifs via luserconf works for me. You must add your special options to <mntoptions allow="..." /> But you are right, that the required and deny options are ignored. So I reopen this. Jan: or is there a reason, why in src/rdconf2.c: luserconf_volume_record_sane() the checks for required_ok() and deny_ok() only print a log messages and do not "return false" like allow_ok() does? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User mc@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c5 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #5 from Michael Calmer 2009-01-12 07:31:55 MST --- Fix submitted -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User jengelh@medozas.de added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c7 --- Comment #7 from Jan Engelhardt 2009-02-06 09:04:30 MST --- For the umpteenth time, I do not have any repo in OBS, so whatever home:j-engel is, it is NOT mine. But try http://tinyurl.com/jengftp/SUSE-11.1

why does this very mount work when in the global config instead of being in the luserconf file?

The allow/deny/require restrictions are only for luserconf files. Only root can edit the global volume list, so when s/he does, we assume root knows what root is doing. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User werner.flamme@ufz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c9 --- Comment #9 from Werner Flamme 2009-02-09 01:24:12 MST --- @Jan: I am very sorry, I did not know that home:j-engel did not belong to you. Thany you very much for making this very clear to me. I did not know that suser-jengelh is still the place where you put your work :-( (I disabled this repo in 10.3 (I think), because the packages provided there did not match very good in the other software from the release, it needed more aup-to-date-libs and so on... So, when the mntoptions tag is for luserconf only, and it is set to deny="suid,dev", it may not interfere with the cifs mounts I have inside the luserconf file, since there is no option like suid or dev. @Michael: thank you, I did a "rpm -Uvh http://download.opensuse.org/update/11.1-test/rpm/x86_64/pam_mount-0.47-12.1..." and will see tomorrow if it works... Regrads, Werner -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User mc@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c11 --- Comment #11 from Michael Calmer 2009-02-10 02:09:45 MST --- I think this is wanted by the author. options_require array is initialized with "nosuid,nodev" in the code. If you do not specify "require" on your own, the default is used. So please try to specify "require". It must have minimal one value to overwrite the default. Or simply add nodev and nosuid to .pam_mount.conf.xml . I think the original bug is fixed and it works now like it should work. Jan: <!-- The options listed in this directive are required for all volumes from a user config file. That is, any volume specified in a user config file that does not include these options will be ignored. Note: you must make sure that a required option is permitted (either by including it in options_allow, or by not including it in options_deny). I recommend requiring at least nosuid and nodev. This is ignored completely if the volume is configured to get its options and mount point from /etc/fstab. <mntoptions require="nosuid,nodev" /> --> Maybe you can say more explicite, that this is the default. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User werner.flamme@ufz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c13 --- Comment #13 from Werner Flamme 2009-02-10 03:03:10 MST --- @Jan: How short "oodles of time" may be... ;-) Your citation says "Note that commenting out mntoptions will give you the defaults. ": I did not comment it out, I have a non-commented '<mntoptions deny="suid,dev" />' entry in the file. The bazillion samples are commented out, of course. "You will need to explicitly initialize it with the empty string to reset the defaults to nothing": Again, I do not think to have a problem here. Do I have to "reset the defaults to nothing" though having a valid configuration entry? Does <mntoption /> require multiple settings? Isn't it enough to give '<mntoptions deny="suid,dev" />', must I have an additional '<mntoptions allow="*" />' entry? I use pam_mount for years (SUSE 8.2, I think), and even in oS 11.0 this was not the case. I had to have one entry for mntoptions, and that was it. And this is the way I understand "Note: you must make sure that a required option is permitted (either by including it in options_allow, or by not including it in options_deny)" from Michael's citation. In openSUSE 10.3 (just 2 SUSE versions ago), the respective comment was: ---snip--- # These directives determine which options may be specified in a user config # file (luserconf). You must include one of these directives if you have a # luserconf directive. You may not include both directives. # # If you have an options_allow directive, then the options listed in that # directive wil be allowed, and all others rejected. If you have an # options_deny directive, then the options listed will be denied, and all others # permitted. # # You may use the wildcard '*' to match all options. # I recommend not permitting the suid and dev options. # #options_allow nosuid,nodev,loop,encryption,fsck options_deny suid,dev #options_allow * #options_deny * ---pins--- So, here ist was "You must include one of these directives[...] You may not include both directives." Who ever it was that said "I recommend not permitting the suid and dev options", I followed this recommendation... and I still do. Regards, Werner -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User werner.flamme@ufz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c15 --- Comment #15 from Werner Flamme 2009-02-10 05:31:04 MST --- Jan, that's great! Now I have 3 lines in my /etc/security/pam.mount.conf.xml: <mntoptions require="" /> <mntoptions allow="*" /> <mntoptions deny="suid,dev" /> The result is (for one mount, as example): Feb 10 13:27:52 rz36 login[14950]: Luser volume for /home/wflamme/Documents/NetMounts/coder is missing options that are required by global <mntoptions> Gnarf. Where do I unset the "options that are required by global <mntoptions>"? Is it only one <mntoptions /> tag with all three attributes? This is not clear from the comments :-( Regards, Werner -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=463524 User werner.flamme@ufz.de added comment https://bugzilla.novell.com/show_bug.cgi?id=463524#c17 --- Comment #17 from Werner Flamme 2009-02-10 10:25:05 MST --- Ah, OK. So the conf reader knows that I do not require anything, I allow everything but suid and dev. Right? But why do I still find "is missing options that are required by global <mntoptions>" in my logs? When it is a config problem, blame on me. But I don't understand it yet :-( OK, finish for today... Regards, Werner -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.