Hello, We are currently putting our new NetApp ONTAP GX system into production. From the NFS point of view, the particularity of this product is that it allows to "assemble" multiple volumes within a "unified" namespace, using so-called "junctions", and access this "unified" namespace with a (apparently) single mount operation. Now, when using VServer - even from the host point of view - only the root user is able to "roam" through the mounted hierarchy (as separate volumes get automatically mounted in the background and appear in '/proc/mounts'). Non-root user get a "Operation not permitted" message as soon as they try to go pass the initially mounted volume. This problem seem absolutely similar to what was discussed in this thread: http://www.paul.sladen.org/vserver/archives/200709/0046.html We have verified that removing the VServer-added checks in the 'vfs kern mount' function (in '<kernel-source>/fs/super.c') "solves" the problem (we used the latest 2.6.30.2 vanilla kernel and 2.3.0.36.14pre4 VServer patches to perform this verification). Now to the questions: 1. What is the security impact of removing those checks (iow. is it a "MUST NOT!!!" or a "well... that's being overkill anyway" ) ? 2. Can we imagine to perform those checks slightly differently, in order to allow non-root users to use such "joined" NFS exports, both from the host and guests (since we're no kernel gurus, we don't know which function/capability to start looking for) ? Thank you very much for your help and time. Cheers -- Cédric Dufour @ Idiap Research Institute Phone: +41 27 721 77 40 Fax: +41 27 721 77 12 Mail: Idiap Research Institute Case postale 592 Centre du Parc 1920 Martigny (VS) Suisse (Switzerland) Web: www.idiap.ch <http://www.idiap.ch>
Cédric Dufour @ Idiap Research Institute
Phone: +41 27 721 77 40
Fax: +41 27 721 77 12
Mail: Idiap Research Institute
Case postale 592
Centre du Parc
1920 Martigny (VS)
Suisse (Switzerland)
Web: www.idiap.ch