Subject: overwrite and upload

From: Charles Bruneteau <[email-masked]>
Date: Tue, 27 Apr 1999 11:56:56 +0200

hi,

i'm configuring a wuftp (2.4.2 VR17) server with guests accounts and the
-r option.
it works great but i'm a bit surprised with something with overwriting
and uploading :

   i have these lines in my ftpaccess :
                    ...
                overwrite yes guest
                    ...
                upload  /     /*/incoming yes * 501   0660 nodirs
                upload  /*   /*/outgoing yes *  502  0240 nodirs
                upload  /     *  no
                upload  /*   *  no

    the user 4001 has the homedirectory  :  /4001
    the user 5001 has the homedirectory  :  /

    i touch a random file in /4001/incoming :
               -rw-------   1  5001     500      2380 Apr 27 11:23
y1RHOCx

    here are the attributes of /4001/incoming :
                drwx--x--x   2  4001     500       512 Apr 27 11:18
incoming

    when a the guest user 5001 type the command 'put  a_file  y1RHOCx',
the attributes become :
               -rw-------   1  4001     500      2380 Apr 27 11:23
y1RHOCx

so the owner of the file has changed (as specified in the upload line in
ftpaccess, i guess), but the rights should be 0660 ?

i wonder if an overwrite is considered as an upload ?

thanks for any advise

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 27 Apr 1999 09:28:43 -0400 (EDT)

On Tue, 27 Apr 1999, Charles Bruneteau wrote:

> i'm configuring a wuftp (2.4.2 VR17) server with guests accounts and
> the -r option. it works great but i'm a bit surprised with something
> with overwriting and uploading :
> 
> the user 4001 has the homedirectory: /4001
> the user 5001 has the homedirectory: /
> 
> here are the attributes of /4001/incoming:
>    drwx--x--x   2  4001     500       512 Apr 27 11:18 incoming
> 
> i touch a random file in /4001/incoming:
>    -rw-------   1  5001     500      2380 Apr 27 11:23 y1RHOCx
> 
> when a the guest user 5001 type the command 'put a_file y1RHOCx', the
> attributes become:
>    -rw-------   1  4001     500      2380 Apr 27 11:23 y1RHOCx
> 
> so the owner of the file has changed (as specified in the upload line
> in ftpaccess, i guess), but the rights should be 0660 ?
> 
> i wonder if an overwrite is considered as an upload?

ISTM overwrite should be considered an upload at least for the question,
"May I upload?"  Passing that it should obey existing ownerships and
permissions and not change those.

I just tested and, sure enough, you're right.  The upload clause is
resetting the owner user/group.  Everything else seems OK (upload check,
permissions check, permissions unchanged).

*sigh*

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Charles Bruneteau <[email-masked]>
Date: Wed, 28 Apr 1999 15:14:06 +0200

> permissions check, permissions unchanged).

Thanks for your answer

Actually i'm looking for the upload behavior : i don't want to allow file
creation in this directory, so overwriting an empty  file seems to be the
solution. Furthermore the user who transfer a file to this directory (and
other users from the same group) should not be able to read this file (or
any real file in the directory), this is where the upload behavior is
important.

In fact the actual behavior solves my problem, but i don't want to use a
"functionnality" which may be altered in future releases.

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 28 Apr 1999 09:47:07 -0400 (EDT)

> In fact the actual behavior solves my problem, but i don't want to use
> a "functionnality" which may be altered in future releases.

I'm planning on doing a patch today which will prevent ownership
user/group changes when upload overwrites an existing file.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Charles Bruneteau <[email-masked]>
Date: Thu, 29 Apr 1999 11:31:53 +0200

> user/group changes when upload overwrites an existing file.

Then there is something i don't get :
overwrite, chmod, etc. are flags controlling what a user can do, before (?)
checking the filesystem permissioning. I guess that when a user wants to rename
a file to an already existing file, the server checks the rename flag, and then
the overwrite one (i didn't test it). When a user "put" a file, it is an upload
; if the "put" occurs on an existing file, the server should also verify the
overwrite flag. I mean that both the upload and overwrite flags should be used
?

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 29 Apr 1999 09:34:56 -0400 (EDT)

On Thu, 29 Apr 1999, Charles Bruneteau wrote:

> overwrite, chmod, etc. are flags controlling what a user can do,
> before (?) checking the filesystem permissioning. I guess that when a
> user wants to rename a file to an already existing file, the server
> checks the rename flag, and then the overwrite one (i didn't test it).
> When a user "put" a file, it is an upload ; if the "put" occurs on an
> existing file, the server should also verify the overwrite flag. I
> mean that both the upload and overwrite flags should be used ?

When processing the STOR command, the daemon first checks the 'upload'
clause to determine if an upload of any kind is permitted in the target
area.  If so, it looks to see if the target file exists and, if it does,
checks the 'overwrite' clause to determine if overwritting files is also
permitted.  Finally, the daemon attempts to open the file allowing the
underlying system to check filesystem permissions.

Since neither RNFR nor RNTO involves a file transfer, the 'upload' clause
is not checked.  While RNTO could replace a file, that is not an overwrite
operation, so 'overwrite' is not checked.  For these commands, the daemon
simply checks the 'rename' clause to determine if the operations are
permitted the current user.

The idea is that, if everything is working properly in the daemon and
everything is configured properly, your should be able to run a site with
world read-write-execute permissions on all files and directories and
still maintain a modicum of security.  Of course, one should not simply
trust the daemon and should manage filesystem permissions and ownerships
properly.

--

---

From: Charles Bruneteau <[email-masked]>
Date: Thu, 29 Apr 1999 15:44:34 +0200

> trust the daemon and should manage filesystem permissions and ownerships

Yes everything seem logical. But i don't see why an overwrite should be considered
as an upload only for the question "May I upload?", and not for the modification of
the owner, group and file permission.

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 29 Apr 1999 09:56:52 -0400 (EDT)

On Thu, 29 Apr 1999, Charles Bruneteau wrote:

> Yes everything seem logical. But i don't see why an overwrite should
> be considered as an upload only for the question "May I upload?", and
> not for the modification of the owner, group and file permission.

The principle of least surprise: I have a file owned and permissioned as I
want.  I don't expect it to change.

The daemon is changing the ownership without changing permissions.  It
should be both or neither.  ISTM ownership didn't used to change but
something crept in (maybe as far back as the Hobbit patches).  It's a very
easy patch and I've already get it in test.

--

---

From: Gwendal Roue <[email-masked]>
Date: Thu, 29 Apr 1999 16:05:44 +0200

Sorry for disturbing you like that, but I can't manage unsubscribing
from wu-ftpd mailing-list. Anyone can definitely help ?

Thanks
Gwendal Roué