[OpenAFS] permission to run 'fs examine'
Thu, 17 Mar 2016 22:48:49 +0100
In the stable release series for Unix it actually happened mid 2013, =
with the 1.6.4 release. The relevant passage in the release notes was:
* Allow the fileserver to return volume data like quota or free =
which is available publicly elsewhere, without the additional =
check for read permissions on a volume's root directory the =
We should probably adapt the fs_examine manpage. Any volunteers?
On Mar 17, 2016, at 22:20 , Jeffrey Altman wrote:
> This change occurred in 2012. See http://gerrit.openafs.org/7705
> The "fs examine" command causes the cache manager to issue a
> RXAFS_GetVolumeStatus RPC. The returned data is publicly accessible =
> the volserver RPCs so there was no benefit to locking it down via the
> fileserver RPCs.
> The Windows operating system requires knowledge of the volume size, =
> space, quota and other statistics independent of the access rights of
> the user processes. See the commit message for further details.
> Jeffrey Altman
> On 3/17/2016 3:43 PM, Richard Brittain wrote:
>> I discovered an apparent change in the access control on "fs examine"
>> recently. The docs say you need 'r' access on the root of the volume
>> for this to work, and that definitely used to work. We use this =
>> a wrapper script for more convenient quota checking, and I was used =
>> getting the permission errors, but not any more.
>> Now it seems to work all the time regardless of tokens or volume ACL,
>> from clients on Linux, Mac and Windows. Our servers are a mishmash =
>> versions. The DBs are 126.96.36.199 and 1.6.5, and the file servers 1.6.9
>> and 188.8.131.52. If this access control is a function of the DB =
>> then the timing of our upgrade to 184.108.40.206 might be consistent with =
>> this started.
>> PRIVILEGE REQUIRED
>> The issuer must have the "r" (read) permission on the ACL of the =
>> directory of the volume that
>> houses the file or directory named by the -path argument, and "l"
>> (list) permission on the ACL of each
>> directory that precedes it in the pathname.
15738 Zeuthen, Germany