I have a partition that's NFS-mounted from a Netapp SAN. I can create files in that partition, and I can chown those files to another user, any user, even root. How am I able to do so? I thought the kernel would prevent such a thing. I have done this again and again today, using multiple user IDs on the file.
I cannot do this in /tmp or in my home directory, which is locally-mounted.
I've never seen this behaviour before. Also, I note that setcap/getcap are not found on this machine.
I have checked my shell's capabilities and they are all 0's:
$ echo $$ 15007 $ cat /proc/15007/task/15007/status Name: bash State: S (sleeping) SleepAVG: 98% Tgid: 15007 Pid: 15007 PPid: 14988 TracerPid: 0 Uid: 71579 71579 71579 71579 Gid: 10000 10000 10000 10000 FDSize: 256 Groups: 9000 10000 10001 10013 10018 10420 24611 36021 ... CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000
I am on a Red Hat 5.3 virtual machine:
$ cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.3 (Tikanga)
Running an old kernel:
$ uname -r 2.6.18-274.7.1.el5
The NFS mount uses defaults:
$ cat /etc/fstab ... mynetapp00:/home /mnt/home nfs defaults 0 0
For user authentication, we're using Windows Active Directory with ldap on the Linux side:
$ grep passwd /etc/nsswitch.conf passwd: files ldap
I'm able to do anthing as sudo:
User mikes may run the following commands on this host: (ALL) ALL
because I'm one of the ADMINS (contents of /etc/sudoers):
User_Alias ADMINS = fred, tom, mikes ADMINS ALL=(ALL) ALL
...But I don't know how that's germaine, because sudo isn't involved. In any event, I was able to create a file and give it my ownership as a user "john" who's not found in /etc/sudoers:
# grep john /etc/sudoers # su - john $ touch /mnt/home/blah $ chown mikes /mnt/home/blah $ ls -l /mnt/home/blah -rwxrwxrwx 1 mikes DomainUsers 0 Oct 23 19:45 /mnt/home/blah
...and chown is not aliased (but we knew that, because if chown was an alias or some other program, then I would be able to change ownership in /tmp too):
$ alias alias l.='ls -d .* --color=tty' alias ll='ls -l --color=tty' alias ls='ls --color=tty' alias vi='vim' alias which='alias | /usr/bin/which --tty-only --read-alias --show-dot --show-tilde' $ which chown /bin/chown
P.S. I'm not kidding:
$ id uid=71579(mikes) gid=10000(DomainUsers) $ touch /mnt/home/blah $ chown john /mnt/home/blah $ ls -l /mnt/home/blah -rwxrwxrwx 1 john DomainUsers 0 Oct 23 19:04 /mnt/home/blah $ id john uid=37554(john) gid=10000(DomainUsers) $ chmod 755 /mnt/home/blah chmod: changing permissions of `/mnt/home/blah': Operation not permitted $ rm /mnt/home/blah $ ls -l /mnt/home/blah ls: /mnt/home/blah: No such file or directory $ touch /tmp/blah $ chown john /tmp/blah chown: changing ownership of `/tmp/blah': Operation not permitted