Subject: NetApp filers and NFS junctions: Operation not permitted
From:Cédric Dufour - Idiap Research Institute <cedric.dufour@idiap.ch>
Date: Thu, 23 Jul 2009 13:19:48 +0200
Thu, 23 Jul 2009 13:19:48 +0200
Hello,

We are currently putting our new NetApp ONTAP GX system into production.
From the NFS point of view, the particularity of this product is that it
allows to "assemble" multiple volumes within a "unified" namespace,
using so-called "junctions", and access this "unified" namespace with a
(apparently) single mount operation.

Now, when using VServer - even from the host point of view - only the
root user is able to "roam" through the mounted hierarchy (as separate
volumes get automatically mounted in the background and appear in
'/proc/mounts'). Non-root user get a "Operation not permitted" message
as soon as they try to go pass the initially mounted volume.

This problem seem absolutely similar to what was discussed in this
thread: http://www.paul.sladen.org/vserver/archives/200709/0046.html

We have verified that removing the VServer-added checks in the
'vfs kern mount' function (in '<kernel-source>/fs/super.c') "solves" the
problem (we used the latest 2.6.30.2 vanilla kernel and 2.3.0.36.14pre4
VServer patches to perform this verification).

Now to the questions:

 1. What is the security impact of removing those checks (iow. is it a
"MUST NOT!!!" or a "well... that's being overkill anyway" ) ?

 2. Can we imagine to perform those checks slightly differently, in
order to allow non-root users to use such "joined" NFS exports, both
from the host and guests (since we're no kernel gurus, we don't know
which function/capability to start looking for) ?

Thank you very much for your help and time.

Cheers

-- 

Cédric Dufour @ Idiap Research Institute

Phone:  +41 27 721 77 40
Fax:    +41 27 721 77 12
Mail:   Idiap Research Institute
        Case postale 592
        Centre du Parc
        1920 Martigny (VS)
        Suisse (Switzerland)
Web:    www.idiap.ch <http://www.idiap.ch>



Hello,

We are currently putting our new NetApp ONTAP GX system into production. From the NFS point of view, the particularity of this product is that it allows to "assemble" multiple volumes within a "unified" namespace, using so-called "junctions", and access this "unified" namespace with a (apparently) single mount operation.

Now, when using VServer - even from the host point of view - only the root user is able to "roam" through the mounted hierarchy (as separate volumes get automatically mounted in the background and appear in '/proc/mounts'). Non-root user get a "Operation not permitted" message as soon as they try to go pass the initially mounted volume.

This problem seem absolutely similar to what was discussed in this thread: http://www.paul.sladen.org/vserver/archives/200709/0046.html

We have verified that removing the VServer-added checks in the 'vfs_kern_mount' function (in '<kernel-source>/fs/super.c') "solves" the problem (we used the latest 2.6.30.2 vanilla kernel and 2.3.0.36.14pre4 VServer patches to perform this verification).

Now to the questions:

 1. What is the security impact of removing those checks (iow. is it a "MUST NOT!!!" or a "well... that's being overkill anyway" ) ?

 2. Can we imagine to perform those checks slightly differently, in order to allow non-root users to use such "joined" NFS exports, both from the host and guests (since we're no kernel gurus, we don't know which function/capability to start looking for) ?

Thank you very much for your help and time.

Cheers

--
Cédric Dufour @ Idiap Research Institute

Cédric Dufour @ Idiap Research Institute

Phone:  +41 27 721 77 40
Fax:    +41 27 721 77 12
Mail:   Idiap Research Institute
        Case postale 592
        Centre du Parc
        1920 Martigny (VS)
        Suisse (Switzerland)
Web:    www.idiap.ch