Menu

#60 Odd use of tcp_wrappers in rquota

closed-fixed
Jan Kara
None
5
2009-04-28
2009-04-08
Tomas Hoger
No

rquotad seems to re-use good_client implementation from portmap (in rquota_svc.c). The way good_client called tcp_wrappers via hosts_ctl was not correct, possibly causing hosts access rules defined in hosts.{allow,deny} not to be honored. Further discussion about this related to nfs-utils can be found in Red Hat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=458676

Most of the problems mentioned in that bug should now longer apply to current rquotad, as following commit addressed most of the problems:

http://linuxquota.cvs.sourceforge.net/viewvc/linuxquota/quota-tools/rquota_svc.c?r1=1.17&r2=1.18

However, it seems that current good_client should still allow connection that is supposed to be denied via hostname-based rule in hosts.deny (no hostname is used in the first hosts_ctl call, so the hostname based rule is skipped during the first call, which may allow connection, so subsequent hosts_ctl calls with hostname / aliases are not reached at all). Red Hat bug also links the patch used for nfs-utils, that should be usable for quota as well.

Unlike good_client, tcp_wrappers do not try to handle host aliases, so the change may break setups where hosts.allow contains rule using host alias (not canonical name) and hosts.deny contains ALL rule. However, such rules are unlikely to exist in existing setups using quota version prior to Jan Kara's commit mentioned above.

Discussion

  • Jan Kara

    Jan Kara - 2009-04-22
    • assigned_to: nobody --> jkar8572
     
  • Jan Kara

    Jan Kara - 2009-04-28

    Thanks for the pointer. I've thought about it for a while and I agree that the solution NFS took is probably the best way out of the trouble. Fixed in CVS.

     
  • Jan Kara

    Jan Kara - 2009-04-28
    • status: open --> closed-fixed
     

Anonymous
Anonymous

Add attachments
Cancel