[SOLVED] user removed from one group can still get that group's permission

LanFan.BlueSailor · 08-20-2012, 08:42 PM

This is my first post in this forum. Sorry if I posted it in the wrong place.

I use openLDAP for user management. A group foo is used to share some files among the users belong to group foo. The ownership of shared folder is root:foo, and the permission is set to 770. This will make sure that users not in group foo will be denied to access that folder.
For some reasons, the member of group foo varies occasionally. If a new user is added to group foo, a simple re-logon will gives the user correct id and groups, and get the access to the shared folder. Everything works fine.
The issue comes if the user is removed from group foo. After the remove and re-logon, the id and groups say the user is no longer the member of group foo (it should be the case). And this user should no long access that shared folder. However, this user can still cd to that shared folder without a permission denied error message.
So, why user removed from one group can still get that group's permission, even after re-logon.

I tried restart my ldap service to refresh the user info, but no help. Only a reboot of the box will make the user get the right permission. So I think it's could be a user credential cache. But I do not know how to flush it without a reboot.

What should I do to get the right permission? Any help will be appreciated. thx

PS: Seems to be less related, but the shared folder is also a samba share. But the samba share got the right permission after a restart of smb service.

LanFan.BlueSailor · 08-20-2012, 08:58 PM

some code details are here.

Code:

drwxrwx--- 2 root pan_res 6 Aug 20 15:47 pan_res

pan_res is the shared folder for all members in group pan_res

Code:

[lanfan@beetle /smb]$ id
uid=1087(lanfan) gid=1001(pan) groups=1001(pan) context=user_u:system_r:unconfined_t
[lanfan@beetle /smb]$ groups
pan

user lanfan is just removed from group pan_res. And id and groups say it's no longer a member of that group

Code:

[lanfan@beetle /smb]$ cd pan_res/
[lanfan@beetle pan_res]$ ls

But I can still cd to that folder without an error.

Code:

[lijs@beetle /smb]$ id
uid=61317(lijs) gid=1001(pan) groups=1001(pan) context=user_u:system_r:unconfined_t
[lijs@beetle /smb]$ groups
pan
[lijs@beetle /smb]$ cd pan_res
pan_res: Permission denied.

For other users not in that group, it received a Permission denied error as expected.

Valery Reznic · 08-21-2012, 06:05 AM

Quote:

Originally Posted by LanFan.BlueSailor

some code details are here.

Code:

drwxrwx--- 2 root pan_res 6 Aug 20 15:47 pan_res

pan_res is the shared folder for all members in group pan_res

Code:

[lanfan@beetle /smb]$ id
uid=1087(lanfan) gid=1001(pan) groups=1001(pan) context=user_u:system_r:unconfined_t
[lanfan@beetle /smb]$ groups
pan

user lanfan is just removed from group pan_res. And id and groups say it's no longer a member of that group

Code:

[lanfan@beetle /smb]$ cd pan_res/
[lanfan@beetle pan_res]$ ls

But I can still cd to that folder without an error.

Code:

[lijs@beetle /smb]$ id
uid=61317(lijs) gid=1001(pan) groups=1001(pan) context=user_u:system_r:unconfined_t
[lijs@beetle /smb]$ groups
pan
[lijs@beetle /smb]$ cd pan_res
pan_res: Permission denied.

For other users not in that group, it received a Permission denied error as expected.

After you remove lanfan from the pan_res group did you log out and then log in?
Because id program don't show id/group for the current process, it's read /etc/passwd, /etc/group, whatever to get information.
So, while id output may be correct current process STILL may have more privileges that id shows.

By the way, what shared in this folder?
Not always, but often enough need in shared folder indicate that actually some version control needed instead.

rknichols · 08-21-2012, 11:38 AM

Quote:

Originally Posted by Valery Reznic

Because id program don't show id/group for the current process, it's read /etc/passwd, /etc/group, whatever to get information.

That is demonstrably not true:

Code:

[builder] ~ $ id
uid=505(builder) gid=505(builder) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[builder] ~ $ newgrp mock
[builder] ~ $ id
uid=505(builder) gid=468(mock) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

And, after editing /etc/group to remove "builder" from the "mock" group:

Code:

[builder] ~ $ grep mock /etc/group
mock:x:468:rnichols
[builder] ~ $ id
uid=505(builder) gid=468(mock) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

The id program does read /etc/passwd and /etc/group, but only to map numeric IDs to names.

Valery Reznic · 08-21-2012, 12:11 PM

Quote:

Originally Posted by rknichols

That is demonstrably not true:

Code:

[builder] ~ $ id
uid=505(builder) gid=505(builder) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[builder] ~ $ newgrp mock
[builder] ~ $ id
uid=505(builder) gid=468(mock) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

And, after editing /etc/group to remove "builder" from the "mock" group:

Code:

[builder] ~ $ grep mock /etc/group
mock:x:468:rnichols
[builder] ~ $ id
uid=505(builder) gid=468(mock) groups=468(mock),505(builder) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

The id program does read /etc/passwd and /etc/group, but only to map numeric IDs to names.

You are absolutely right, thank you for correction.
When I run id under strace before posting I somehow missed that it called getgroups.

My bad.

LanFan.BlueSailor · 08-21-2012, 07:11 PM

Quote:

Originally Posted by Valery Reznic

After you remove lanfan from the pan_res group did you log out and then log in?

Yes. I do log out and then log in. And user lanfan still have access to pan_res group.

Quote:

Originally Posted by Valery Reznic

By the way, what shared in this folder?

The folder is empty by now. But lanfan can even create/modify files in the shared folder after removed from pan_res group (and re-logon).

LanFan.BlueSailor · 08-21-2012, 07:24 PM

I tested on another box using the /etc/passwd and /etc/group for user management instead of openLDAP.

Everything goes fine: After remove user from that group, the user immediately get the permission denied error message.

So I think it's maybe a openLDAP related issue.

Any more suggestion? Any help will be appreciated. thx

Valery Reznic · 08-22-2012, 03:36 AM

Quote:

Originally Posted by LanFan.BlueSailor

I tested on another box using the /etc/passwd and /etc/group for user management instead of openLDAP.

Everything goes fine: After remove user from that group, the user immediately get the permission denied error message.

So I think it's maybe a openLDAP related issue.

Any more suggestion? Any help will be appreciated. thx

Could you test it
- on the box with openLDAP, but for directory that is not samba share.
- without openLDAP (i.e /etc/passwd, etc/group) but with directory on samba share
?

sundialsvcs · 08-22-2012, 09:25 AM

Do you have an openLDAP replication server that is not in sync? Is information previously obtained from LDAP being cached? How exactly do you connect to LDAP?

LanFan.BlueSailor · 08-22-2012, 07:55 PM

Quote:

Originally Posted by sundialsvcs

Do you have an openLDAP replication server that is not in sync?

No replication. Only one openLDAP server.

Quote:

Originally Posted by sundialsvcs

Is information previously obtained from LDAP being cached?

That what I first thought about. I tried to find where it cached the user credential and cleaned it. But I couldn't find where.

Quote:

Originally Posted by sundialsvcs

How exactly do you connect to LDAP?

Actually, I use a tool called authconfig provided by CentOS to setup the LDAP authentication.
I know little about the configuration details.

LanFan.BlueSailor · 08-22-2012, 08:34 PM

Quote:

Originally Posted by Valery Reznic

Could you test it
- on the box with openLDAP, but for directory that is not samba share.
- without openLDAP (i.e /etc/passwd, etc/group) but with directory on samba share
?

Things go even more complicated.

I tested on a new directory which is not a samba share, and received the permission denied message correctly.
I added this new directory to a new samba share, and this time received the permission denied message correctly.

Then I found that the previous shared directory is mounted from an NFS.
So, it's neither an openLDAP issue, nor a samba issue. It seems to be an NFS issue. Maybe I mounted this NFS with too high privileges.

I decide to use another share directory which is not from NFS. That's the easiest solution.
For NFS issue, I'll look into it at other times.

Thread solved. Thx for all your helps

Valery Reznic · 08-23-2012, 12:32 AM

Hmm, after all NFS turns out to be culprit. Interesting.

You said before that this shared directory is empty.
But what supposed to be shared here?