From roman@seznam.cz  Fri Jun  7 09:01:39 2002
Return-Path: <roman@seznam.cz>
Received: from email.seznam.cz (smtp.seznam.cz [212.80.76.43])
	by hub.freebsd.org (Postfix) with SMTP id BF43C37B404
	for <FreeBSD-gnats-submit@freebsd.org>; Fri,  7 Jun 2002 09:01:37 -0700 (PDT)
Received: (qmail 65021 invoked from network); 7 Jun 2002 16:01:28 -0000
Received: from ppp92.brno.worldonline.cz (HELO variola) (212.11.105.92)
  by smtp.seznam.cz with SMTP; 7 Jun 2002 16:01:28 -0000
Received: from roman by variola with local (Exim 3.13 #1 (Debian))
	id 17GHDp-00009l-00
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 07 Jun 2002 12:43:57 +0200
Message-Id: <20020607124356.A599@variola>
Date: Fri, 7 Jun 2002 12:43:56 +0200
From: neologism <neologism@seznam.cz>
Sender: <roman@seznam.cz>
Reply-To: neologism@seznam.cz
To: FreeBSD-gnats-submit@freebsd.org
Subject: a change to msdosfs permissions behaviour according to noexec
X-Send-Pr-Version: 3.113

>Number:         38986
>Category:       kern
>Synopsis:       a change to msdosfs permissions behaviour according to noexec
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    trhodes
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jun 07 09:10:01 PDT 2002
>Closed-Date:    Sat Aug 09 22:34:22 PDT 2003
>Last-Modified:  Sat Aug 09 22:34:22 PDT 2003
>Originator:     neologism
>Release:        FreeBSD 4.4-RELEASE i386
>Organization:
>Environment:
System: FreeBSD variola 4.4-RELEASE FreeBSD 4.4-RELEASE #0: Sat Jan 12 11:09:42 GMT 2002 root@:/usr/src/sys/compile/MYKERNEL i386

>Description:

Current implementation of permission checking in msdosfs doesn't reflect
setting of noexec at mount time. I'm sending a patch which changes this
behaviour. Now if noexec is set rights are set to 644 instead of 755.
I hope its done the right way.

>How-To-Repeat:

it is default behaviour

>Fix:

--- sys/msdosfs/msdosfs_vnops.c	Tue Jul 18 13:19:13 2000
+++ /root/msdosfs_vnops.c	Sat May 11 14:18:09 2002
@@ -354,10 +354,21 @@
 		fileid += dep->de_diroffset / sizeof(struct direntry);
 	}
 	vap->va_fileid = fileid;
-	if ((dep->de_Attributes & ATTR_READONLY) == 0)
-		mode = S_IRWXU|S_IRWXG|S_IRWXO;
-	else
-		mode = S_IRUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH;
+	/*
+	 * Previously NOEXEC was used just in exec checking, rights were always
+	 * shown with +x. This should prevent such behaviour
+	 */
+	if ((pmp->pm_mountp->mnt_flag & MNT_NOEXEC) == 0) {
+		if ((dep->de_Attributes & ATTR_READONLY) == 0)
+			mode = S_IRWXU|S_IRWXG|S_IRWXO;
+		else
+			mode = S_IRUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH;
+	} else {
+		if ((dep->de_Attributes & ATTR_READONLY) == 0)
+			mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_WOTH;
+		else
+			mode = S_IRUSR|S_IRGRP|S_IROTH;
+	}
 	vap->va_mode = mode & pmp->pm_mask;
 	vap->va_uid = pmp->pm_uid;
 	vap->va_gid = pmp->pm_gid;
>Release-Note:
>Audit-Trail:

From: Ceri Davies <setantae@submonkey.net>
To: neologism <neologism@seznam.cz>
Cc: FreeBSD-gnats-submit@FreeBSD.org
Subject: Re: kern/38986: a change to msdosfs permissions behaviour according to noexec
Date: Fri, 7 Jun 2002 17:15:52 +0100

 On Fri, Jun 07, 2002 at 12:43:56PM +0200, neologism wrote:
 > 
 > Current implementation of permission checking in msdosfs doesn't reflect
 > setting of noexec at mount time. I'm sending a patch which changes this
 > behaviour. Now if noexec is set rights are set to 644 instead of 755.
 > I hope its done the right way.
 
 Note that I'm not disputing this patch, I just wonder if it's necessary or
 just adding more strangeness to msdos filesystems.
 
 Mounting an ffs filesystem noexec doesn't do this - is there any reason why
 msdosfs ones should ?
 
 Just something for whoever may want to commit this to think about.
 
 Ceri

From: neologism <neologism@seznam.cz>
To: Ceri Davies <setantae@submonkey.net>
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: kern/38986: a change to msdosfs permissions behaviour according to noexec
Date: Fri, 7 Jun 2002 18:53:24 +0200

 On Fri, Jun 07, 2002 at 05:15:52PM +0100, Ceri Davies wrote:
 > On Fri, Jun 07, 2002 at 12:43:56PM +0200, neologism wrote:
 > > 
 > > Current implementation of permission checking in msdosfs doesn't reflect
 > > setting of noexec at mount time. I'm sending a patch which changes this
 > > behaviour. Now if noexec is set rights are set to 644 instead of 755.
 > > I hope its done the right way.
 > 
 > Note that I'm not disputing this patch, I just wonder if it's necessary or
 > just adding more strangeness to msdos filesystems.
 
 it's very small so I consider it no problem
  
 > Mounting an ffs filesystem noexec doesn't do this - is there any reason why
 > msdosfs ones should ?
 
 ffs has permissions unix way, msdosfs doesn't. You simply cannot set
 chmod a-x * ! I want this for comfortable MC (midnight commander) browsing
 through files. You know click enter on .gz file opens it. If it is not +x.
 But if it hurts so much...
  
 > Just something for whoever may want to commit this to think about.
 
 It's up to you to decide...
  
 > Ceri
 
 Roman Divacky

From: Bruce Evans <bde@zeta.org.au>
To: neologism <neologism@seznam.cz>
Cc: freebsd-gnats-submit@FreeBSD.ORG
Subject: Re: kern/38986: a change to msdosfs permissions behaviour according
 to noexec
Date: Sat, 8 Jun 2002 14:59:20 +1000 (EST)

 On Fri, 7 Jun 2002, neologism wrote:
 
 >  On Fri, Jun 07, 2002 at 05:15:52PM +0100, Ceri Davies wrote:
 >  > On Fri, Jun 07, 2002 at 12:43:56PM +0200, neologism wrote:
 >  > >
 >  > > Current implementation of permission checking in msdosfs doesn't reflect
 >  > > setting of noexec at mount time. I'm sending a patch which changes this
 >  > > behaviour. Now if noexec is set rights are set to 644 instead of 755.
 >  > > I hope its done the right way.
 >  >
 >  > Note that I'm not disputing this patch, I just wonder if it's necessary or
 >  > just adding more strangeness to msdos filesystems.
 >
 >  it's very small so I consider it no problem
 >
 >  > Mounting an ffs filesystem noexec doesn't do this - is there any reason why
 >  > msdosfs ones should ?
 >
 >  ffs has permissions unix way, msdosfs doesn't. You simply cannot set
 >  chmod a-x * ! I want this for comfortable MC (midnight commander) browsing
 >  through files. You know click enter on .gz file opens it. If it is not +x.
 >  But if it hurts so much...
 >
 >  > Just something for whoever may want to commit this to think about.
 
 This has been thought about before in response to a patch like the one in
 this PR, resulting in a better patch in PR 35699 (don't make mount -noexec
 affect permissions, since it doesn't for real filesystems, but work around
 the fundamental limitations of the -m flag by adding a -M flag to control
 the mode of directories).
 
 Bruce
 
State-Changed-From-To: open->closed 
State-Changed-By: trhodes 
State-Changed-When: Fri Sep 13 19:54:46 PDT 2002 
State-Changed-Why:  
Over to me for review.  I've spoken to bde about this for a few moments 
and perhaps I/we can come up with an improvement. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38986 
State-Changed-From-To: closed->open 
State-Changed-By: trhodes 
State-Changed-When: Sat Sep 14 13:18:21 PDT 2002 
State-Changed-Why:  
ooops.  Score one 'duh' point for me ;) 


Responsible-Changed-From-To: freebsd-bugs->trhodes 
Responsible-Changed-By: trhodes 
Responsible-Changed-When: Sat Sep 14 13:18:21 PDT 2002 
Responsible-Changed-Why:  
ooops.  Score one 'duh' point for me ;) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38986 
State-Changed-From-To: open->closed 
State-Changed-By: trhodes 
State-Changed-When: Sat Aug 9 22:33:27 PDT 2003 
State-Changed-Why:  
Close this PR as I have a better patch in PR 35699 which is currently 
under my review.  Thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38986 
>Unformatted:
