From d2d591caf2c9b4cf2ebae708cc9b4c8b78ca5a5a Mon Sep 17 00:00:00 2001 From: Jeffrey Altman Date: Tue, 3 Jul 2012 15:58:01 -0400 Subject: [PATCH] viced: RXAFS_GetVolumeStatus remove access check The AFS file server had always performed a PRSFS_READ permission check on the volume's root directory (1.1) vnode before responding succesfully to the client. A successful response contains the following volume state information: Message of the day (if any) Offline message (if any) Online flag InService flag Blessed flag NeedsSalvage flag Type MinQuota MaxQuota BlocksInUse PartBlocksAvail PartMaxBlocks All of this information is publicly available to anonymous users via other services so it is odd that it is hidden from anonymous cache managers. As sites begin to tighten the ACLs on volumes due to privacy and security concerns this READ permission check is begin to cause problems for Windows clients that rely upon the quota and block counts to determine whether or not it is likely to be safe to perform an extending write. In many environments volumes are being configured such that the root directory is 'l' for all and only the subdirectories provide for 'ridw'. Under these situations the user is able to read/write the data but cannot determine how much free space is available. Since all of the data returned by RXAFS_GetVolumeStatus is publicly available, the patchset removes the access check entirely. Change-Id: Ic8a8d755b0ed61789a49243827083ae97c137560 Reviewed-on: http://gerrit.openafs.org/7705 Tested-by: BuildBot Reviewed-by: Jeffrey Altman Reviewed-by: Derrick Brashear --- src/viced/afsfileprocs.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/viced/afsfileprocs.c b/src/viced/afsfileprocs.c index e0a27e455..f99326e1a 100644 --- a/src/viced/afsfileprocs.c +++ b/src/viced/afsfileprocs.c @@ -5876,10 +5876,6 @@ SRXAFS_GetVolumeStatus(struct rx_call * acall, afs_int32 avolid, &rights, &anyrights))) goto Bad_GetVolumeStatus; - if ((VanillaUser(client)) && (!(rights & PRSFS_READ))) { - errorCode = EACCES; - goto Bad_GetVolumeStatus; - } (void)RXGetVolumeStatus(FetchVolStatus, Name, OfflineMsg, Motd, volptr); Bad_GetVolumeStatus: -- 2.39.5