We are currently putting our new NetApp ONTAP GX system into production.
From the NFS point of view, the particularity of this product is that it
allows to "assemble" multiple volumes within a "unified" namespace,
using so-called "junctions", and access this "unified" namespace with a
(apparently) single mount operation.
Now, when using VServer - even from the host point of view - only the
root user is able to "roam" through the mounted hierarchy (as separate
volumes get automatically mounted in the background and appear in
'/proc/mounts'). Non-root user get a "Operation not permitted" message
as soon as they try to go pass the initially mounted volume.
This problem seem absolutely similar to what was discussed in this
We have verified that removing the VServer-added checks in the
'vfs_kern_mount' function (in '<kernel-source>/fs/super.c') "solves" the
problem (we used the latest 220.127.116.11 vanilla kernel and 18.104.22.168.14pre4
VServer patches to perform this verification).
Now to the questions:
1. What is the security impact of removing those checks (iow. is it a
"MUST NOT!!!" or a "well... that's being overkill anyway" ) ?
2. Can we imagine to perform those checks slightly differently, in
order to allow non-root users to use such "joined" NFS exports, both
from the host and guests (since we're no kernel gurus, we don't know
which function/capability to start looking for) ?
Thank you very much for your help and time.
-- CÚdric Dufour @ Idiap Research Institute Phone: +41 27 721 77 40 Fax: +41 27 721 77 12 Mail: Idiap Research Institute Case postale 592 Centre du Parc 1920 Martigny (VS) Suisse (Switzerland) Web: www.idiap.ch <http://www.idiap.ch>Received on Thu Jul 23 12:20:09 2009