Re: [OpenAFS] 1.3.77 under AIX 5.1: unusable

2005-02-06 Thread Derrick J Brashear
CRASH INFORMATION: CPU 0 CSA 2FF3B400 at time of crash, error code for LEDs: 3000 pvthread+004700 STACK: [05B53F2C]afs_RemoveVCB+C8 (69746572 [??]) [05B4A328]afs_GetDCache+001774 (33CF1720, , , 2FF3B188, Of course, nothing has changed in afs_RemoveVCB in some time. But, loo

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 05:44:16PM -0500, Derrick J Brashear wrote: [snip] > But, this is sort of a stupid argument, since I think everyone here is on > the same side: pags as groups are a problem. I started to argue with you, and had a whole rant even, but then skipped down to this. Yeah. :) -

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Todd Lewis
But, this is sort of a stupid argument, since I think everyone here is on the same side: pags as groups are a problem. FTR, I'm on the 3rd side: groups not being PAGs are the bigger problem. Closer to home, AFS (and now OpenAFS) should not feel free to use group numbers of already allocated group

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derrick J Brashear
On Sun, 6 Feb 2005, Matthew Miller wrote: Incidentally, Linux isn't Unix(tm), and my SunOS 4 system (which strictly speaking is BSD and not Unix(tm) either) didn't do it. And IIRC neither does Solaris, which is probably the most Unix(tm) of the bunch I routinely use. The standard scripts for Solari

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 02:51:53PM -0500, Derrick J Brashear wrote: > Before you spend time on it, well, I have code. I should finish it. I was > waiting for an interface to be exposed, and I will see if it has been > tonight and update if so. The plan was to use a keyring to store a pag > index

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 03:03:39PM -0500, Derrick J Brashear wrote: > >There are a lot of very good and valid reasons for doing this which I don't > >think this is the place to discuss -- the important thing is that assigning > >supplementary groups is perfectly reasonable, standard Unix behavior,

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Hendrik Hoeth
Thus spake Derrick J Brashear ([EMAIL PROTECTED]): > Incidentally, Linux isn't Unix(tm), and my SunOS 4 system (which > strictly speaking is BSD and not Unix(tm) either) didn't do it. And > IIRC neither does Solaris, which is probably the most Unix(tm) of the > bunch I routinely use. And neither

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derrick J Brashear
On Sun, 6 Feb 2005, Matthew Miller wrote: There are a lot of very good and valid reasons for doing this which I don't think this is the place to discuss -- the important thing is that assigning supplementary groups is perfectly reasonable, standard Unix behavior, and OpenAFS is the one imposing the

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derrick J Brashear
On Sun, 6 Feb 2005, Jim Rees wrote: But I agree that the current problem is with OpenAFS. If you would like to contribute code to use keyrings, I'm sure we'd be happy to look at it. Before you spend time on it, well, I have code. I should finish it. I was waiting for an interface to be exposed, a

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Jim Rees
the important thing is that assigning supplementary groups is perfectly reasonable, standard Unix behavior, and OpenAFS is the one imposing the "surprise" breakage. I would disagree with that. "Supplementary groups" was never standard Unix behavior. It was introduced by linux, which post-d

Re: [OpenAFS] OpenAFS 1.3.78 on Linux 2.6

2005-02-06 Thread Jason McCormick
--On Sunday, February 06, 2005 12:12:08 PM +0100 Mikkel Kruse Johnsen <[EMAIL PROTECTED]> wrote: > Hi > > You say that you don't have to export the syscall table. But when I run > the configure it still say it can't find the syscall and assuming it is > not exportet: > configure: warning: Cann

[OpenAFS] unable to stop openafs

2005-02-06 Thread Guillaume Rousse
I'm unable to umount an afs partition: umount /mnt/afs fails because peripheral is still occupied, however I can't see any process using any file located under /mnt/afs using lsof. It seems however to be the canonical way to stop the afsd daemon, as afsd -shutdown exit when the afs partition is

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 12:53:01PM -0500, Derek Atkins wrote: > The docs have always said "don't use Unix Groups in the range when > you use AFS" and goes on to describe how and why. So IMHO if someone > ignores the clearly docuemented "don't do this" they deserve to screw > themselves. No; they

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 12:51:45PM -0500, Derrick J Brashear wrote: > My suggestion in this case would be "stop giving users groups" but I don't > know your environment. [...] Environment is "standard chaotic university". However, everyone does have a specific globally assigned UID. There are a l

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 12:26:13PM -0500, Kris Van Hees wrote: > What you are seeing is due to how the PAG id is encoded in the groups. > With the new Linux 2.6 kernel stuff that should go away since other > facilities like the keyring support can be used for things like this. I guess that's part

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derek Atkins
Quoting Matthew Miller <[EMAIL PROTECTED]>: > On Sun, Feb 06, 2005 at 12:46:23PM -0500, Derek Atkins wrote: > > "Doctor, doctor, it hurts when I do this" > > Cute, but you miss the point: it could hurt when *other* people do this. I'd > be better if they weren't able to. The docs have always

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derrick J Brashear
On Sun, 6 Feb 2005, Matthew Miller wrote: On Sun, Feb 06, 2005 at 12:46:23PM -0500, Derek Atkins wrote: "Doctor, doctor, it hurts when I do this" Cute, but you miss the point: it could hurt when *other* people do this. I'd be better if they weren't able to. If the "su" command let any user chan

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
On Sun, Feb 06, 2005 at 12:46:23PM -0500, Derek Atkins wrote: > "Doctor, doctor, it hurts when I do this" Cute, but you miss the point: it could hurt when *other* people do this. I'd be better if they weren't able to. If the "su" command let any user change user ids with no authentication, wo

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Derek Atkins
"Doctor, doctor, it hurts when I do this" -derek Quoting Matthew Miller <[EMAIL PROTECTED]>: > I know I've said this before, but it was broken for a while, and now that > it's back, I wanted to aggitate about it a bit, because it's a real problem. > > > 1. Look in password file to find the

Re: [OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Kris Van Hees
What you are seeing is due to how the PAG id is encoded in the groups. With the new Linux 2.6 kernel stuff that should go away since other facilities like the keyring support can be used for things like this. The answer to the security risk of encoding the PAG in the group ids is of course in par

[OpenAFS] keeping openafs from breaking group security

2005-02-06 Thread Matthew Miller
I know I've said this before, but it was broken for a while, and now that it's back, I wanted to aggitate about it a bit, because it's a real problem. 1. Look in password file to find the group id of a professor or administrator or smart kid with papers you want to steal. Say, 44490. Userna

Re: [OpenAFS] openafs hanging at home

2005-02-06 Thread Derrick J Brashear
When you say afs is hanging, try changing the mtu setting on your ethernet interface to 1400, and see what happens, when it's booted linux. ___ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info

Re: [OpenAFS] openafs hanging at home

2005-02-06 Thread Sandro Weiser
Am Sonntag, 6. Februar 2005 01:28 schrieb Sandro Weiser: > Openafs is working fine on my laptop at my parents home and in > university. Only when using openafs at home on my laptop or the other pc > it hangs! I fiddling around now for nearly 4 weeks. It worked with 2.6.9, > but after upgrading to 2

Re: [OpenAFS] OpenAFS 1.3.78 on Linux 2.6

2005-02-06 Thread Mikkel Kruse Johnsen
Hi You say that you don't have to export the syscall table. But when I run the configure it still say it can't find the syscall and assuming it is not exportet: [EMAIL PROTECTED] openafs-1.3.78]$ ./configure --enable-bos-new-config --enable-largefile-fileserver --enable-supergroups --enable-f