From nobody Thu Dec 4 08:53:25 1997 Received: (from nobody@localhost) by hub.freebsd.org (8.8.7/8.8.7) id IAA05918; Thu, 4 Dec 1997 08:53:25 -0800 (PST) (envelope-from nobody) Message-Id: <199712041653.IAA05918@hub.freebsd.org> Date: Thu, 4 Dec 1997 08:53:25 -0800 (PST) From: jose@we.lc.ehu.es To: freebsd-gnats-submit@freebsd.org Subject: login(1) fails when NFS-mounted homes are being exported from the server without remote root access X-Send-Pr-Version: www-1.0 >Number: 5219 >Category: bin >Synopsis: login(1) fails when NFS-mounted homes are being exported from the server without remote root access >Confidential: no >Severity: serious >Priority: medium >Responsible: steve >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Dec 4 09:00:00 PST 1997 >Closed-Date: Wed Feb 25 08:17:14 PST 1998 >Last-Modified: Wed Feb 25 08:18:08 PST 1998 >Originator: Jose M. Alcaide >Release: 2.2.5-RELEASE >Organization: Universidad del Pais Vasco - Dept. de Electricidad y Electronica >Environment: FreeBSD tiburon.we.lc.ehu.es 2.2.5-RELEASE FreeBSD 2.2.5-RELEASE #0: Wed Oct 29 15:20:18 CET 1997 root@tiburon.we.lc.ehu.es:/usr/src/sys/compile/TIBURON i386 >Description: This problem appeared in 2.2.2-RELEASE. When any home directory is NFS-mounted, but it is exported from the server without granting remote root access, all file operations made as root on that filesystem are seen by the server as made by "nobody". Login(1) calls setuid() too late, after calling chdir() and checking for the existence of .hushlogin. The consequence is that these file operations are made as root, and then are seen from the fileserver as made by "nobody", and they fail. As a result, login(1) cannot chdir() to the home directory, and says "No home directory - logging with home=/". >How-To-Repeat: See above. >Fix: The definitive fix needs a rearrangement of the actions implemented in login.c, moving the setuid() before the chdir() and any other accesses to the user's home directory. Meanwhile, a "chmod o+x ", granting search permission to any user, may do the trick. Of course, if the home directories are exported granting remote root access to the FreeBSD box(es), this problem does not manifest itself, but this has obvious security risks. >Release-Note: >Audit-Trail: From: "Jose M. Alcaide" To: freebsd-gnats-submit@freebsd.org, jose@we.lc.ehu.es Cc: Subject: Re: bin/5219: login(1) fails when NFS-mounted homes are being exported from the server without remote root access Date: Wed, 25 Feb 1998 11:36:58 +0100 This is the same problem as the one reported in bin/5145, so you can close this PR. -- JM ----------------------------------------------------------------------- Jose M. Alcaide | mailto:jose@we.lc.ehu.es Universidad del Pais Vasco | http://www.we.lc.ehu.es/~jose Dpto. de Electricidad y Electronica | Facultad de Ciencias - Campus de Lejona | Tel.: +34-4-4647700 x2624 48940 Lejona (Vizcaya) - SPAIN | Fax: +34-4-4858139 ----------------------------------------------------------------------- "Go ahead... make my day." - H. Callahan State-Changed-From-To: open->closed State-Changed-By: steve State-Changed-When: Wed Feb 25 08:17:14 PST 1998 State-Changed-Why: Duplicate of bin/5145. Responsible-Changed-From-To: freebsd-bugs->steve Responsible-Changed-By: steve Responsible-Changed-When: Wed Feb 25 08:17:14 PST 1998 Responsible-Changed-Why: >Unformatted: