[OpenAFS] permission to run 'fs examine'

Stephan Wiesand stephan.wiesand@desy.de
Thu, 17 Mar 2016 22:48:49 +0100

In the stable release series for Unix it actually happened mid 2013, =
with the 1.6.4 release. The relevant passage in the release notes was:

    * Allow the fileserver to return volume data like quota or free =
      which is available publicly elsewhere, without the additional =
      check for read permissions on a volume's root directory the =
      performed before.

We should probably adapt the fs_examine manpage. Any volunteers?

- Stephan

On Mar 17, 2016, at 22:20 , Jeffrey Altman wrote:

> This change occurred in 2012.  See http://gerrit.openafs.org/7705
> The "fs examine" command causes the cache manager to issue a
> RXAFS_GetVolumeStatus RPC.  The returned data is publicly accessible =
> the volserver RPCs so there was no benefit to locking it down via the
> fileserver RPCs.
> The Windows operating system requires knowledge of the volume size, =
> space, quota and other statistics independent of the access rights of
> the user processes.  See the commit message for further details.
> Jeffrey Altman
> On 3/17/2016 3:43 PM, Richard Brittain wrote:
>> I discovered an apparent change in the access control on "fs examine"
>> recently.  The docs say you need 'r' access on the root of the volume
>> for this to work, and that definitely used to work.  We use this =
>> a wrapper script for more convenient quota checking, and I was used =
>> getting the permission errors, but not any more.
>> Now it seems to work all the time regardless of tokens or volume ACL,
>> from clients on Linux, Mac and Windows.  Our servers are a mishmash =
>> versions.  The DBs are and 1.6.5, and the file servers 1.6.9
>> and  If this access control is a function of the DB =
>> then the timing of our upgrade to might be consistent with =
>> this started.
>>   The issuer must have the "r" (read) permission on the ACL of the =
>> directory of the volume that
>>   houses the file or directory named by the -path argument, and "l"
>> (list) permission on the ACL of each
>>   directory that precedes it in the pathname.
>> Richard
> <jaltman.vcf>

Stephan Wiesand
Platanenenallee 6
15738 Zeuthen, Germany