[OpenAFS] permission to run 'fs examine'

[Stephan Wiesand]

In the stable release series for Unix it actually happened mid 2013, =
with the 1.6.4 release. The relevant passage in the release notes was:

    * Allow the fileserver to return volume data like quota or free =
space,
      which is available publicly elsewhere, without the additional =
access
      check for read permissions on a volume's root directory the =
fileserver
      performed before.

We should probably adapt the fs_examine manpage. Any volunteers?

- Stephan

On Mar 17, 2016, at 22:20 , Jeffrey Altman wrote:

> This change occurred in 2012.  See http://gerrit.openafs.org/7705
>=20
> The "fs examine" command causes the cache manager to issue a
> RXAFS_GetVolumeStatus RPC.  The returned data is publicly accessible =
via
> the volserver RPCs so there was no benefit to locking it down via the
> fileserver RPCs.
>=20
> The Windows operating system requires knowledge of the volume size, =
free
> space, quota and other statistics independent of the access rights of
> the user processes.  See the commit message for further details.
>=20
> Jeffrey Altman
>=20
>=20
> On 3/17/2016 3:43 PM, Richard Brittain wrote:
>> I discovered an apparent change in the access control on "fs examine"
>> recently.  The docs say you need 'r' access on the root of the volume
>> for this to work, and that definitely used to work.  We use this =
inside
>> a wrapper script for more convenient quota checking, and I was used =
to
>> getting the permission errors, but not any more.
>>=20
>> Now it seems to work all the time regardless of tokens or volume ACL,
>> from clients on Linux, Mac and Windows.  Our servers are a mishmash =
of
>> versions.  The DBs are 1.6.14.1 and 1.6.5, and the file servers 1.6.9
>> and 1.6.14.1.  If this access control is a function of the DB =
servers,
>> then the timing of our upgrade to 1.6.14.1 might be consistent with =
when
>> this started.
>>=20
>> PRIVILEGE REQUIRED
>>   The issuer must have the "r" (read) permission on the ACL of the =
root
>> directory of the volume that
>>   houses the file or directory named by the -path argument, and "l"
>> (list) permission on the ACL of each
>>   directory that precedes it in the pathname.
>>=20
>>=20
>> Richard
> <jaltman.vcf>

--=20
Stephan Wiesand
DESY -DV-
Platanenenallee 6
15738 Zeuthen, Germany