cifs mount requested to be readonly is actually read write

[genunix]

This is a scary situation.

I have a user account setup on a Windows 2012 server with full Administrator rights. I want to use that account to mount a cifs share onto my CentOS 7 server however I want the mount to be read only. The man page for MOUNT.CIFS(8) is very clear on this option to be passed in a string of comma separated options thus :

Code: Select all

MOUNT.CIFS(8)             System Administration tools            MOUNT.CIFS(8)

NAME
       mount.cifs - mount using the Common Internet File System (CIFS)

SYNOPSIS
       mount.cifs {service} {mount-point} [-o options]

DESCRIPTION
       This tool is part of the cifs-utils suite.

.
.
.
       Options to mount.cifs are specified as a comma-separated list of
       key=value pairs. It is possible to send options other than those listed
       here, assuming that the cifs filesystem kernel module (cifs.ko)
       supports them. Unrecognized cifs mount options passed to the cifs vfs
       kernel code will be logged to the kernel log.
.
.
.
OPTIONS

       ro
           mount read-only

This seems all very clear to me and trivial.

Therefore with a Windows 2012 server at ip 192.168.1.5 it seems reasonable to do this :

Step ONE : look before you mount

Code: Select all

tbk2_# ls -lapb  /mnt/192_168_1_5/C
total 0
drwxr-xr-x. 2 root root  6 Feb 12 12:57 ./
drwxr-xr-x. 7 root root 46 Feb 18 22:12 ../

Step TWO : issue the mount command

Code: Select all

tbk2_# USER=theusername PASSWD=thepassword mount --verbose -t cifs \
> -o username=theusername,password=thepassword,servernetbiosname=WINSVRNAME,ip=192.168.1.5,noserverino,cache=strict,noacl,vers=3.0,nouser_xattr,ro \
> //192.168.1.5/C\$ /mnt/192_168_1_5/C

Step THREE : check dmesg for warnings

Code: Select all

tbk2_# dmesg | tail
[67259.496960] FS-Cache: Loaded
[67259.575239] RPC: Registered named UNIX socket transport module.
[67259.646155] RPC: Registered udp transport module.
[67259.702478] RPC: Registered tcp transport module.
[67259.758791] RPC: Registered tcp NFSv4.1 backchannel transport module.
[67259.904752] FS-Cache: Netfs 'nfs' registered for caching
[74762.621644] ISO 9660 Extensions: Microsoft Joliet Level 3
[74762.716713] ISO 9660 Extensions: RRIP_1991A
[74762.716982] SELinux: initialized (dev sr0, type iso9660), uses genfs_contexts
[106922.747802] SELinux: initialized (dev cifs, type cifs), uses genfs_contexts
tbk2_# 

Step FOUR : look at the mountpoint

Code: Select all

tbk2_# df -t cifs -h
Filesystem        Size  Used Avail Use% Mounted on
//192.168.1.5/C$  576G   37G  539G   7% /mnt/192_168_1_5/C

tbk2_# ls -lapb /mnt/192_168_1_5/C
total 2491169
drwxr-xr-x. 0 root root          0 Feb 12 11:18 $Recycle.Bin/
drwxr-xr-x. 2 root root       4096 Feb 18 22:13 ./
drwxr-xr-x. 7 root root         46 Feb 18 22:12 ../
-rwxr-xr-x. 0 root root       1024 Apr 18  2014 .rnd
-rwxr-xr-x. 0 root root          1 Jun  2  2012 BOOTNXT
drwxr-xr-x. 0 root root          0 Jul 26  2012 Documents\ and\ Settings/
drwxr-xr-x. 0 root root          0 Aug 13  2013 PerfLogs/
dr-xr-xr-x. 0 root root          0 Jul 10  2014 Program\ Files/
drwxr-xr-x. 0 root root          0 Aug  8  2014 Program\ Files\ (x86)/
drwxr-xr-x. 0 root root          0 Mar 12  2014 ProgramData/
drwxr-xr-x. 0 root root          0 Feb 18 20:05 System\ Volume\ Information/
drwxr-xr-x. 0 root root          0 Apr 17  2014 TEMP/
dr-xr-xr-x. 0 root root          0 Feb 12 11:18 Users/
drwxr-xr-x. 0 root root          0 Jul 25  2014 Windows/
-r-xr-xr-x. 0 root root     398156 Jul 25  2012 bootmgr
-rwxr-xr-x. 0 root root 1275068416 Feb 15 18:32 pagefile.sys
tbk2_# 

Everything looks fine thus far. However I was careful to ensure that the "ro" option was in the mount command above and therefore this should be a read only mountpoint right ?

Step FIVE : test a write to the cifs mountpoint

Code: Select all

tbk2_# touch /mnt/192_168_1_5/C/touchtest.foo
tbk2_# ls -l  /mnt/192_168_1_5/C/touchtest.foo
-rwxr-xr-x. 1 root root 0 Feb 18 22:33 /mnt/192_168_1_5/C/touchtest.foo
tbk2_# rm  /mnt/192_168_1_5/C/touchtest.foo

Everything stops right here as the mount was done read write and not readonly. This is a serious error.

Am I wrong somewhere here ?

Dennis

[genunix]

Looks to be a bug in the CIFs kernel module and I will file it into bugzilla over at their dev site and then follow up here later. Looks to be IBM types working on this downstream of the samba project.