** Changed in: ntfs-3g (Ubuntu) Sourcepackagename: None => ntfs-3g ** This bug is no longer flagged as a security issue
** Summary changed: - [Hardy] fstab / mount ntfs privilege elevation + owner permissions not correctly enforced ** Description changed: - - I seem to be able to get a privilege elevation when mounting an ntfs device in fstab. This is on Hardy Alpha with all updates installed to date (2008-02-08). + I seem to be able to get a privilege elevation when mounting an ntfs + device in fstab. This is on Hardy Alpha with all updates installed to + date (2008-02-08). Take for example the /etc/fstab line: UUID=3E7EA4A67EA45903 /mnt/sda3 ntfs noexec,umask=337,uid=aoakley,gid=aoakley 0 1 If I mount this with mount /mnt/sda3 all looks fine. Doing ls -l /mnt shows as expected: dr--r----- 1 aoakley aoakley 12288 2008-02-08 22:51 sda3 However there seem to be two security issues. Firstly if I log on as "aoakley", I am able to WRITE to this mount, even though the permissions are read-only. For example, when logged on as aoakley, echo "hello world" >/mnt/sda3/x.txt works! Secondly, even when I log on as an entirely unrelated user who is NOT a member of the "aoakley" group, I can STILL write to this mount! For example, when logged on as guest (who is not a member of aoakley), echo "hello from guest" >/mnt/sda3/x.txt still works fine! Am I significantly misunderstanding user/group permissions on mounted devices, or is this a bug? ** Summary changed: - owner permissions not correctly enforced + DAC permissions not correctly enforced ** This bug has been flagged as a security issue -- DAC permissions not correctly enforced https://bugs.launchpad.net/bugs/190329 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
