Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 186383 - mount.cifs - non-root cannot mount samba shares from fstab due to bad SUID check
Summary: mount.cifs - non-root cannot mount samba shares from fstab due to bad SUID check
Status: RESOLVED UPSTREAM
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: x86 Linux
: High minor (vote)
Assignee: Gentoo's SAMBA Team
URL:
Whiteboard:
Keywords:
: 192379 194799 (view as bug list)
Depends on:
Blocks:
 
Reported: 2007-07-23 21:51 UTC by Cornelius Weig
Modified: 2011-07-01 16:07 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cornelius Weig 2007-07-23 21:51:19 UTC
Non-root users cannot mount shares even the share has a correct entry in /etc/fstab.
This is because mount.cifs is found in /sbin/ but this is only a symlink to

lrwxrwxrwx 1 root root 21 Jul 23 22:34 mount.cifs -> ../usr/bin/mount.cifs

and mount checks if the SUID bit has been set:

$ strace mount /my_share
(...)
close(3)                                = 0
munmap(0xb7f53000, 4096)                = 0
stat64("/sbin/mount.cifs", {st_mode=S_IFREG|S_ISUID|0711, st_size=22864, ...}) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7df0908) = 5478
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 255}], 0, NULL) = 5478
exit_group(255)

Removing the symlink /sbin/mount.cifs solves the problem so I suggest to cancel the following lines from the ebuild:

	if use kernel_linux ; then
		# mount backend
		dodir /sbin
		dosym ../usr/bin/smbmount /sbin/mount.smbfs
		dosym ../usr/bin/mount.cifs /sbin/mount.cifs
	fi

On the other hand, these lines may be needed by some other package...

Reproducible: Always

Steps to Reproduce:
1. mount a share as non-root user:
$ mount /share
mount error: permission denied or not superuser and mount.cifs not installed SUID

BUT

$ ls -la `which mount.cifs`
-rws--x--x 1 root root 22864 Jul 23 22:30 /usr/bin/mount.cifs
Comment 1 Jakub Moc (RETIRED) gentoo-dev 2007-07-24 06:05:39 UTC
Reproduced w/ sys-apps/util-linux-2.12r-r7. Removing the symlink won't fix anything, you'll get

<snip>
mount: wrong fs type, bad option, bad superblock on /my_share, missing codepage or other error 
In some cases useful info is found in syslog - try 
dmesg | tail  or so
</snip>

instead. mount shouldn't be stupid and shouldn't check SUID on symlink but on the real thing, IMO.
Comment 2 SpanKY gentoo-dev 2007-07-24 08:03:21 UTC
that is a samba error, not a util-linux one

if you ran `mount.cifs` by hand you'd see the same problem

i looked into this once before quite a long time ago and recall samba doing this on purpose by design ...
Comment 3 Cornelius Weig 2007-07-24 12:11:16 UTC
Well, removing the symlink in /sbin did fix it for me. But I agree the SUID check should be performed on the real thing and not on the link. Maybe the upstream people should look into this.
Comment 4 Jakub Moc (RETIRED) gentoo-dev 2007-09-13 06:58:22 UTC
*** Bug 192379 has been marked as a duplicate of this bug. ***
Comment 5 Jakub Moc (RETIRED) gentoo-dev 2007-10-05 14:23:07 UTC
*** Bug 194799 has been marked as a duplicate of this bug. ***
Comment 6 Jakub Moc (RETIRED) gentoo-dev 2008-02-15 14:25:18 UTC
*** Bug 210235 has been marked as a duplicate of this bug. ***
Comment 7 Jakub Moc (RETIRED) gentoo-dev 2008-02-18 07:22:23 UTC
*** Bug 210235 has been marked as a duplicate of this bug. ***
Comment 8 Pekka Paalanen 2008-02-19 20:16:01 UTC
I was going to reply in bug 210235 but it seems you want my rant here, even though this bug seems to be about running 'mount' and using fstab, when my issue is exactly the one in the Bug 210235, i.e., running mount.cifs by hand.

Yes, I was bitten by the removal of suid root from mount.cifs. Making the file suid root *fixed* it for me, and I can again mount shares by hand. I never do it via fstab, since I don't want anyone to use my (or root's) credentials in the fileservers, and the mount point is in my home directory.

btw. I checked and I do have /sbin/mount.cifs -> /usr/bin/mount.cifs symlink here, but no /sbin/umount.cifs symlink.

net-fs/mount-cifs-3.0.28

I simply want to stress that making the binaries suid root does fix the problem in Bug 210235. I'm not sure it will fix the problem in this bug, since I don't use fstab for it.

And like already pointed out in the other bug, stat() will check the permissions on the linked-to file, not the symlink. At least according to documentation.
Comment 9 Ryan Tandy 2008-02-19 20:28:34 UTC
Cross posting this from bug 210235 (apologies for the duplication), although I do believe it's a separate issue.

From the man page for mount.cifs(8):

       The   mount.cifs  utility  attaches  the  UNC  name  (exported  network
       resource) to the local directory mount-point. It is possible to set the
       mode  for  mount.cifs  to  setuid root to allow non-root users to mount
       shares to directories for which they have write permission.

So regardless of any actual bugs affecting the issue, I believe the wording here implies that the choice of whether to mark the binary setuid is up to the local system admin, and therefore should not be setuid by default.  My preferred solution would be a USE flag, 'suid' perhaps, so that Portage knows about the changed mode; a note in the ebuild that the mode needs to be manually changed to enable mounting by non-root users would also be acceptable.

As in comment #8, I'd like to emphasize that setting the binary setuid *does* work for me as advertised by the documentation.
Comment 10 MageSlayer 2009-01-31 17:53:56 UTC
(In reply to comment #9)
> Cross posting this from bug 210235 (apologies for the duplication), although I
> do believe it's a separate issue.

> As in comment #8, I'd like to emphasize that setting the binary setuid *does*
> work for me as advertised by the documentation.

Same stroy for me - without manually gining suid to /usr/bin/mount.cifs user-mount doesnot work. 
P.S. Samba v3.0.33, mount-cifs v3.0.28

BTW, what's the problem of giving suid use-flag like guys for ntfs3g did?

Comment 11 Víctor Ostorga (RETIRED) gentoo-dev 2011-07-01 16:07:01 UTC
Please use net-fs/cifs-utils instead. It has available the setuid USE flag