[linux-cifs-client,0/3] cifs: some random patches for 2.6.31

Commit Message

Jeff Layton May 26, 2009, 8:30 p.m. UTC

On Tue, 26 May 2009 12:28:56 -0500
Steve French <[e-mail]> wrote:

> On Tue, May 26, 2009 at 11:42 AM, Jeff Layton <[e-mail]> wrote:
> > On Tue, 26 May 2009 10:08:27 -0500
> > default, but 0744 (or 0755 even) would be an improvement. VFAT seems to
> > default to 0755, so maybe we should just go with that.  
> 
> No problem at all using the 0755 default, unless other users object it
> seems better than current default

Here's an updated patch that makes the default file_mode/dir_mode 0755.

That just leaves patch 1 in this series up in the air. Does it look ok
as-is?

Thanks,

Comments

Steve French May 26, 2009, 9:30 p.m. UTC | #1

Merged the latter two, and will look at the first one tomorrow when I
get more time.

On Tue, May 26, 2009 at 3:30 PM, Jeff Layton <[e-mail]> wrote:
> On Tue, 26 May 2009 12:28:56 -0500
> Steve French <[e-mail]> wrote:
>
>> On Tue, May 26, 2009 at 11:42 AM, Jeff Layton <[e-mail]> wrote:
>> > On Tue, 26 May 2009 10:08:27 -0500
>> > default, but 0744 (or 0755 even) would be an improvement. VFAT seems to
>> > default to 0755, so maybe we should just go with that.
>>
>> No problem at all using the 0755 default, unless other users object it
>> seems better than current default
>
> Here's an updated patch that makes the default file_mode/dir_mode 0755.
>
> That just leaves patch 1 in this series up in the air. Does it look ok
> as-is?
>
> Thanks,
> --
> Jeff Layton <[e-mail]>
>

Patch

>From fe9eecff60c81effc399d766f3b82021d98f101f Mon Sep 17 00:00:00 2001
From: Jeff Layton <[e-mail]>
Date: Tue, 26 May 2009 16:28:11 -0400
Subject: [PATCH] cifs: tighten up default file_mode/dir_mode

The current default file mode is 02767 and dir mode is 0777. This is
extremely "loose". Given that CIFS is a single-user protocol, these
permissions allow anyone to use the mount -- in effect, giving anyone on
the machine access to the credentials used to mount the share.

Change this by making the default permissions restrict write access to
the default owner of the mount. Give read and execute permissions to
everyone else. These are the same permissions that VFAT mounts get by
default so there is some precedent here.

Note that this patch also removes the mandatory locking flags from the
default file_mode. After having looked at how these flags are used by
the kernel, I don't think that keeping them as the default offers any
real benefit. That flag combination makes it so that the kernel enforces
mandatory locking.

Since the server is going to do that for us anyway, I don't think we
want the client to enforce this by default on applications that just
want advisory locks. Anyone that does want this behavior can always
enable it by setting the file_mode appropriately.

Signed-off-by: Jeff Layton <[e-mail]>
---
 fs/cifs/connect.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4f5a03c..0426dd0 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -827,9 +827,9 @@  cifs_parse_mount_options(char *options, const char *devname,
 	vol->target_rfc1001_name[0] = 0;
 	vol->linux_uid = current_uid();  /* use current_euid() instead? */
 	vol->linux_gid = current_gid();
-	vol->dir_mode = S_IRWXUGO;
-	/* 2767 perms indicate mandatory locking support */
-	vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
+
+	/* default to only allowing write access to owner of the mount */
+	vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 
 	/* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 	vol->rw = true;
-- 
1.6.0.6