<br><tt><font size=2>Stefan Bauer <stefan.bauer@cubewerk.de> wrote
on 27/07/2010 15:08:47:<br>
> Am 27.07.2010 15:53, chris@ccburton.com schrieb:<br>
> > There's some advantage in using sudo, but only if you have a
smaller<br>
> > subset of users who need to map shares.<br>
> > <br>
> > sudo still runs the broken mount.cifs as root which still doesn't<br>
> > check the users rights to a mount
point properly or<br>
> > ask for the password before checking
or<br>
> > check just before mounting the share
as root<br>
> > so all the user-accounts in your visudo group who can run mount.cifs<br>
> > as root can map their shares over any directory.<br>
> <br>
> This can be configured. </font></tt>
<br>
<br><tt><font size=2>But you aren't going to show us how ???</font></tt>
<br>
<br><tt><font size=2>Well . . .</font></tt>
<br>
<br><tt><font size=2>actually</font></tt>
<br>
<br><tt><font size=2>. . . no it can't can it ??</font></tt>
<br>
<br><tt><font size=2>You could try do something like this (from Johannes's
patch) </font></tt>
<br><tt><font size=2>in /etc/sudoers . . .</font></tt>
<br>
<br><tt><font size=2>%samba ALL = (ALL) /sbin/mount.cifs //*/* * -o username=*%*\,ip=127.0.0.1\,port=*</font></tt>
<br>
<br><tt><font size=2>but that allows the user to run mount.cifs with /sbin
as</font></tt>
<br><tt><font size=2>the mount point . . </font></tt>
<br>
<br><tt><font size=2>. . .so more likely you would try to pin it down .
. .</font></tt>
<br>
<br><tt><font size=2>user1 ALL = NOPASSWD: /sbin/mount.cifs //*/* /home/user1/mountpoint
-o username=*%*\,ip=127.0.0.1\,port=* ,/sbin/umount.cifs /home/user1/mountpoint
</font></tt>
<br><tt><font size=2>user2 ALL = NOPASSWD: /sbin/mount.cifs //*/* /home/user2/mountpoint
-o username=*%*\,ip=127.0.0.1\,port=* ,/sbin/umount.cifs /home/user2/mountpoint
</font></tt>
<br><tt><font size=2>etc.( sorry about the line wrap)</font></tt>
<br>
<br><tt><font size=2>YUK !</font></tt>
<br>
<br><tt><font size=2>I don't give users sudo access very much, and I don't
want</font></tt>
<br><tt><font size=2>to.</font></tt>
<br>
<br><tt><font size=2>The fixed</font></tt>
<br><tt><font size=2> </font></tt>
<br><tt><font size=2> /home/user1/mountpoint
</font></tt>
<br>
<br><tt><font size=2>is an attempt to stop for example</font></tt>
<br>
<br><tt><font size=2> /home/* ( works
for any user )</font></tt>
<br>
<br><tt><font size=2>being replaced by the user with </font></tt>
<br>
<br><tt><font size=2> /home/../sbin</font></tt>
<br>
<br>
<br>
<br><tt><font size=2>And what is the result of adding the parameters ??</font></tt>
<br>
<br><tt><font size=2>Well, it stops the prompting for a password,</font></tt>
<br>
<br><tt><font size=2>but then, if you </font></tt>
<br>
<br><tt><font size=2> ln -s /sbin /home/user1/mountpoint</font></tt>
<br>
<br><tt><font size=2>the sudo mount.cifs, now running as root will happily
mount the share</font></tt>
<br><tt><font size=2>over /sbin because it doesn't know anything
about the ouid.</font></tt>
<br>
<br><tt><font size=2>Try it !! ( well, not on /sbin / etc )</font></tt>
<br>
<br><tt><font size=2>Using sudo means that uou don't need any effort to
mess</font></tt>
<br><tt><font size=2>things up !!</font></tt>
<br>
<br>
<br><tt><font size=2>>If you grant a group of users the right to<br>
> run mount.cifs as root by sudo, it's your fault if they mount<br>
> private dirs over other directories afterwards.<br>
</font></tt>
<br><tt><font size=2>Hmmm. You prefer suid now, then ?? Or what ??</font></tt>
<br>
<br><tt><font size=2>> <br>
> If you bypass the permissions to run mount.cifs by sudo on purpose
-<br>
> there is no need to let mount.cifs check again the permissions.<br>
</font></tt>
<br><tt><font size=2>Not sure what you mean here !!</font></tt>
<br>
<br><tt><font size=2>> <br>
>> I suppose a fix will be along sometime, in the meantime don't
expect<br>
>> to be too much safer.<br>
<br>
>A fix for what? This is not a bug.</font></tt>
<br>
<br><tt><font size=2>The bug in mount.cifs</font></tt>
<br>
<br><tt><font size=2> </font></tt><a href="https://bugzilla.samba.org/show_bug.cgi?id=6853"><tt><font size=2>https://bugzilla.samba.org/show_bug.cgi?id=6853</font></tt></a>
<br>
<br><tt><font size=2>mount.cifs was intended to run suid, in fact suid
could have been</font></tt>
<br><tt><font size=2>invented for it.</font></tt>
<br>
<br><tt><font size=2>When mount.cifs finds it is suid, it checks the mount
point for</font></tt>
<br><tt><font size=2>the user's access level, and only mounts the share
( as root )</font></tt>
<br><tt><font size=2>if the user has write permission to the mount point,
ie not on</font></tt>
<br><tt><font size=2>/sbin etc</font></tt>
<br>
<br><tt><font size=2>Run under sudo, mount.cifs just mounts whatever you
want</font></tt>
<br><tt><font size=2>wherever you say !!</font></tt>
<br>
<br>
<br><tt><font size=2>The problem is that it doesn't check the user rights
last,</font></tt>
<br><tt><font size=2>it checks them first then asks for a password, and
helpfully</font></tt>
<br><tt><font size=2>waits while you remove the original mount point and
link</font></tt>
<br><tt><font size=2>somewhere else.</font></tt>
<br>
<br><tt><font size=2>A better bodge would be to remove the password prompting</font></tt>
<br><tt><font size=2>from mount.cifs and make a binary which is somewhat
safer,</font></tt>
<br><tt><font size=2>just for use here !!</font></tt>
<br>
<br><tt><font size=2>I'll have a look if I can find time.</font></tt>
<br>
<br><tt><font size=2>CB</font></tt>
<br>
<br><tt><font size=2>> <br>
> Stefan<br>
> <br>
> -- <br>
> Stefan Bauer -----------------------------------------<br>
> PGP: E80A 50D5 2D46 341C A887 F05D 5C81 5858 DCEF 8C34<br>
> -------- plzk.de - Linux - because it works ----------<br>
</font></tt>