From pst@red.jnx.com  Thu Jul 18 16:32:03 1996
Received: from red.jnx.com (ppp-2-219.sntc01.pacbell.net [206.170.2.219])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id QAA28011
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 18 Jul 1996 16:32:01 -0700 (PDT)
Received: (from pst@localhost) by red.jnx.com (8.7.5/8.7.3) id PAA14261; Thu, 18 Jul 1996 15:22:36 -0700 (PDT)
Message-Id: <199607182222.PAA14261@red.jnx.com>
Date: Thu, 18 Jul 1996 15:22:36 -0700 (PDT)
From: Paul Traina <pst@jnx.com>
Reply-To: pst@jnx.com
To: FreeBSD-gnats-submit@freebsd.org
Subject: vnode-pager
X-Send-Pr-Version: 3.2

>Number:         1399
>Category:       kern
>Synopsis:       invoking setuid programs over NFS case vnode_pager error msgs
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    dyson
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 18 16:40:02 PDT 1996
>Closed-Date:    Tue Apr 14 12:06:02 PDT 1998
>Last-Modified:  Tue Apr 14 12:06:14 PDT 1998
>Originator:     Paul Traina
>Release:        FreeBSD 2.2-CURRENT i386
>Organization:
Juniper Networks, Inc.
>Environment:

FreeBSD 2.2-CURRENT FreeBSD 2.2-CURRENT #0: Wed Jul 17 18:28:54 PDT 1996

>Description:

vnode_pager_getpages: I/O read error
vm_fault: pager input (probably hardware) error, PID 12278 failure
pid 12278 (R), uid 0: exited on signal 11

Is generated when I attempt to execute a setuid root program over NFS where
the setuid program can no longer read itself once it has begun to operate.
>How-To-Repeat:

I created the following program:

-r-sr-x---  1 root  pst  13039 Jul 17 14:05 bin/i386/foobar

Once the program begins to execute, it is no longer readable by the new
effective UID because this program is being read in over NFS and the
standard root privilege mapping prohibits reading.

Changing the permissions on the program to

-r-sr-xr-x  1 root  pst  13039 Jul 17 14:05 bin/i386/foobar

solves the problem, but clearly the error message is incorrect, and in fact
we should handle this situation a tad more gracefully.  I don't have the
slightest idea how to change the vnode pager, but it probably should continue
to operate under the original uid of the invoker (ugh, what would that change
break elsewhere?) as a conservative measure since the invoker could never
have started the program otherwise.

>Fix:
	

>Release-Note:
>Audit-Trail:

From: J Wunsch <j@uriah.heep.sax.de>
To: pst@jnx.com
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: kern/1399: vnode-pager
Date: Fri, 19 Jul 1996 08:33:46 +0200 (MET DST)

 As Paul Traina wrote:
 
 > -r-sr-x---  1 root  pst  13039 Jul 17 14:05 bin/i386/foobar
 > 
 > Once the program begins to execute, it is no longer readable by the new
 > effective UID because this program is being read in over NFS and the
 > standard root privilege mapping prohibits reading.
 
 That should not really matter at all.  Look at the following:
 
 j@uncle 51% ls -l /usr/X11R6/bin/xterm
 -rws--x--x  1 root  bin  155648 Jun  2 11:05 /usr/X11R6/bin/xterm*
 
 This is clearly not readable by the invoker unless he is already
 superuser (which i am not).  It can be executed nevertheless.
 
 Ah, i think i see where the difference is: my xterm is _executable_ by
 UID nobody as well. . . Yep, if i remove the x bit for the world, it
 fails as well.
 
 -- 
 cheers, J"org
 
 joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
 Never trust an operating system you don't have sources for. ;-)
Responsible-Changed-From-To: freebsd-bugs->dyson 
Responsible-Changed-By: pst 
Responsible-Changed-When: Fri Feb 14 10:09:03 PST 1997 
Responsible-Changed-Why:  
State-Changed-From-To: open->closed 
State-Changed-By: phk 
State-Changed-When: Tue Apr 14 12:06:02 PDT 1998 
State-Changed-Why:  
see PR 5148 
>Unformatted:
