Bug 315445 – net-fs/samba-3.5.2: no setuid allowed with mount.cifs

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Jacob Middag 2010-04-15 12:06:32 UTC]

Security issues has brought the Samba people to disable mount.cifs for non-privileged users even if the setuid bits are set. This patch gives users the option to still do this or use mount.cifs in a different setuid program (as I do).

Reproducible: Always

Steps to Reproduce:
1. mount.cifs something

Actual Results:  
This mount.cifs program has been built with the ability to run as a setuid root program disabled.
mount.cifs has not been well audited for security holes. Therefore the Samba team does not recommend installing it as a setuid root program.


Expected Results:  
mounting of the requested smb share

This bug looks a lot like bug 186383.

[Comment 1 Jacob Middag 2010-04-15 12:07:47 UTC]

Created attachment 227893 [details, diff]
patch used to change source such that setuid is allowed

Used in new ebuild proposed in the next attachment

[Comment 2 Jacob Middag 2010-04-15 12:16:29 UTC]

Created attachment 227895 [details, diff]
Patch to change ebuild such that with use flag "setuid" set, the mount.cifs program is allowed to work with setuid

This patch changes to ebuild 3.5.2 and adds an use flag "setuid" which used to apply attachment 227893 [details, diff] such that wanted feature is obtained. However, is does NOT actualy set the set-user-ID bit at mount.cifs and umount.cifs, but instead print a warning telling people that it should be done manually and refer to the security implications.

[Comment 3 Jacob Middag 2010-04-15 12:18:02 UTC]

> 
> This bug looks a lot like bug 186383.
> 
I ment bug 232608

[Comment 4 Marcin Kryczek 2010-05-08 18:03:42 UTC]

thanks for that patch. personally i think it should automatically set suid on mount.cifs, becouse this is what user want by turning this flag on. 
it could of course print the security warning in addition
 

[Comment 5 Marcin Kryczek 2010-05-08 18:42:52 UTC]

BTW: this flag should be named 'suid' not 'setuid'. we already have such flag in portage

[Comment 6 Jacob Middag 2010-05-10 19:44:22 UTC]

You could change the patch, there's a line commented out that setuid the mount.cifs and umount.cifs executables and change the warning. I don't have to make a new patch, do I?

[Comment 7 Marcin Kryczek 2010-05-11 07:45:47 UTC]

of course not. i'm just adding my suggestions in case this patch would be added to official tree soon  

[Comment 8 Víctor Ostorga (RETIRED) 2010-06-09 03:08:51 UTC]

*** Bug 290383 has been marked as a duplicate of this bug. ***

[Comment 9 Marcin Kryczek 2010-06-21 17:46:41 UTC]

any chances to see that patch in official tree?

[Comment 10 MageSlayer 2010-12-30 16:43:46 UTC]

Created attachment 258444 [details, diff]
Patch for 3.5.6 to enable suid flag

[Comment 11 MageSlayer 2010-12-30 16:45:36 UTC]

I added a patch for the latest samba to make suid work again.
It also enables any mounts user wishes to have instead of just listed in /etc/fstab.
Please review and apply.

[Comment 12 Víctor Ostorga (RETIRED) 2011-01-28 15:33:58 UTC]

*** Bug 283615 has been marked as a duplicate of this bug. ***

[Comment 13 Víctor Ostorga (RETIRED) 2011-08-15 17:20:14 UTC]

This have been fixed in samba-3.6.0