Bug 9195 - parental control does not work, (acl is not added is the mounted partition)
Summary: parental control does not work, (acl is not added is the mounted partition)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 3
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: MGA2TOO has_procedure MGA3-32-OK MGA3...
Keywords: PATCH, validated_update
: 9367 (view as bug list)
Depends on:
Blocks: 6400 7775 10513
  Show dependency treegraph
 
Reported: 2013-02-27 11:34 CET by Christophe De Natale
Modified: 2017-01-11 16:41 CET (History)
16 users (show)

See Also:
Source RPM: drakguard-0.7.8-3.mga3
CVE:
Status comment:


Attachments
lspcidrake -v command result (3.86 KB, application/octet-stream)
2013-02-27 11:34 CET, Christophe De Natale
Details
Add acl option only for ext2/3 or reiserfs file systems (1.83 KB, patch)
2013-03-15 13:49 CET, Derek Jennings
Details | Diff

Description Christophe De Natale 2013-02-27 11:34:05 CET
Created attachment 3555 [details]
lspcidrake -v command result

Theme name: oxygen-gtk
Kernel version = 3.8.0-desktop-2.mga3
Distribution=Mageia release 3 (Cauldron) for i586
CPU=Intel(R) Pentium(R) M processor 1.73GHz

Parental control enable via control panel
Pop-up open asks to restart system in order to enable applications acl function
System restart but no succes, still the same pop-up
David Walser 2013-02-27 12:45:01 CET

CC: (none) => thierry.vignaud
Component: Security => RPM Packages
QA Contact: security => (none)

David Walser 2013-02-27 12:45:16 CET

CC: (none) => mageia

Comment 1 Manuel Hiebel 2013-02-27 22:04:11 CET
it grep output of mount and as there is nothing even acl is written in the fstab, in goes into a loop

CC: (none) => mageia, tmb
Summary: parental control => parental control does not work, (acl is not added is the mounted partition)

Comment 2 Manuel Hiebel 2013-02-27 22:05:18 CET
s/even/even if/ s/in/it/
Comment 3 Colin Guthrie 2013-02-27 23:06:25 CET
FWIW, acl option shouldn't be needed on ext4 IIRC.

No idea about the parental control stuff tho'.
Comment 4 Manuel Hiebel 2013-03-13 22:13:59 CET
*** Bug 9367 has been marked as a duplicate of this bug. ***

CC: (none) => anantg

Manuel Hiebel 2013-03-13 22:14:19 CET

Whiteboard: (none) => MGA2TOO

Comment 5 Derek Jennings 2013-03-15 01:09:50 CET
Problem appears to be only present on systems with only ext4 partitions. ext3 or ext3 with ext4 systems do not show the problem.

drakguard tests for acl support by parsing the output of a 'mount' command. If any partition is listed with acl support then drakguard is satisfied. 

However ext4 partitions do not list acl in their mount parameters regardless of whether acl is enabled in fstab. I think this is because the Mageia kernel has CONFIG_EXT4_FS_POSIX_ACL kernel configuration set.

A second circumstance which will confuse drakguard exists when fstab contains a comment line containing the string 'ext'. The regex in drakguard is not smart enough to realise it is a comment.

CC: (none) => derekjenn

Comment 6 Anant Gowerdhan 2013-03-15 01:22:13 CET
Oh wow you gave a nice explanation. Thanks for your help and your work around works very well. Thanks alot
Comment 7 Marja Van Waes 2013-03-15 07:28:46 CET
(In reply to Anant Gowerdhan from comment #6)
> Oh wow you gave a nice explanation. Thanks for your help and your work
> around works very well. Thanks alot

more about djennings's workarounds here
https://forums.mageia.org/en/viewtopic.php?f=7&t=4528&p=31979#p31977
and here
https://forums.mageia.org/en/viewtopic.php?f=7&t=4528&p=31979#p31969

CC: (none) => marja11

Comment 8 Derek Jennings 2013-03-15 13:49:32 CET
Created attachment 3615 [details]
Add acl option only for ext2/3 or reiserfs file systems

This proposed patch works for me.
It ignores commented out lines, and only sets the acl option for ext2, ext3, or reiserfs  partitions.
ext4 and btrfs partitions have acl implicitly enabled in the kernel so do not need the acl option.
Derek Jennings 2013-03-15 13:50:44 CET

Keywords: (none) => PATCH

Comment 9 Anant Gowerdhan 2013-03-15 18:59:46 CET
Derek, The Patch didn't work.
Comment 10 Thierry Vignaud 2013-03-15 19:42:52 CET
Fixed in SVN.
(http://svn.mandriva.com/viewvc/soft/drakguard/trunk/)
Can you check?

Keywords: (none) => NEEDINFO

Comment 11 Marja Van Waes 2013-03-15 19:50:49 CET
(In reply to Thierry Vignaud from comment #10)
> Fixed in SVN.
> (http://svn.mandriva.com/viewvc/soft/drakguard/trunk/)
> Can you check?

mandriva? ;)

or here:

http://svnweb.mageia.org/soft/drakguard/trunk/
Comment 12 Thierry Vignaud 2013-03-15 19:56:43 CET
The later of course
Comment 13 Derek Jennings 2013-03-16 18:00:54 CET
Sorry, that does not work.

Line 299
if (cat_('/boot/config') =~ /_FS_POSIX_ACL=y/ || grep { $_ && !/acl/ } chomp_(cat_($fstab_file)) && grep { $_ && !/^#/ && m/ext/ } chomp_(cat_($fstab_file)))

returns true even when the acl option is present in fstab

and Line 316
    if (grep { /,acl/ } @mount) {

still has the problem that the mount command never lists acl for ext4 partitions
 so this test always fails.
Dimitrios Glentadakis 2013-03-26 19:10:37 CET

CC: (none) => dglent

Comment 14 André DESMOTTES 2013-03-31 11:32:39 CEST
Hi,

I tried the patch but it doesn't work, I still have the loop. I have four ext4 partitions (with acl option), two nfs, one ntfs (Windows) and the swap. No commented lines.

CC: (none) => lebarhon

Comment 15 Marja Van Waes 2013-04-01 12:35:25 CEST
(In reply to André DESMOTTES from comment #14)
> Hi,
> 
> I tried the patch but it doesn't work, I still have the loop. I have four
> ext4 partitions (with acl option), two nfs, one ntfs (Windows) and the swap.
> No commented lines.

To make it more clear, André talked about attachment 3615 [details]

https://ml.mageia.org/l/arc/doc-discuss/2013-04/msg00000.html (reload after confirming you're not a spammer)

>
> Which one did you try, the one that is attached to the bug report, or the one
> that Thierry committed? IINM they are different
>
>
The one that is attached to the bug report
Anne Nicolas 2013-04-01 22:08:30 CEST

CC: (none) => ennael1

Comment 16 Guillaume 2013-05-24 18:09:40 CEST
Well, to be clear, if the system is installed on an ext4 partition, this message is useless because this option does not concern a system installed on an ex4 partition ?
If so, the problem should be simply resolved by removing the concerned part in the appropriate file, isn't it ?

Version: Cauldron => 3
CC: (none) => guillaume.ber17

Comment 17 thierry THunot 2013-06-03 22:14:10 CEST
Hi,
i try your solution. but there is another problem, when parental control is active you can make a research whith google, you have results but when you click on all the link in the page you can't connect the site.... 
have you got a solution?

CC: (none) => tthunot

Comment 18 thierry THunot 2013-06-03 23:35:47 CEST
this is the message that firefox send when i want to go to the result link


ERROR
The requested URL could not be retrieved

L'erreur suivante s'est produite en essayant d'accéder à l'URL : http://fr.yahoo.com/_ylt=A03uvwmpCq1RhrgAx1RNhJp4/RV=1/RE=1371504554/RH=ZnIueWFob28uY29t/RO=2/RU=aHR0cDovL2ZyLnNwb3J0cy55YWhvby5jb20vdmlkZW8vbW9uYWNvLXBzZy1mYWxjYW8tcGx1cy1mb3J0LTE0NTYwNDk5NC5odG1s/RS=%5EADAruNnv.MxvLXeuzyeMC1jkA3_bDs-

    Accès interdit.

La configuration du contrôle d'accès, empêche votre requête d'être acceptée. Si vous pensez que c'est une erreur, contactez votre fournisseur d'accès.

Votre administrateur proxy est root.

Générer le Mon, 03 Jun 2013 21:32:35 GMT par unconfigured (squid/3.2.10)
Comment 19 thierry THunot 2013-06-06 06:37:53 CEST
i use mageia 2 squid package then parental control is ok on mageia3....
Comment 20 thierry THunot 2013-06-06 22:34:21 CEST
Squid does not start automatically it is blocked by the icapd.service which not start. At the end of the timeout squid start and works but with packages of the version 2
Derek Jennings 2013-07-01 15:57:01 CEST

Blocks: (none) => 6400

Comment 21 Derek Jennings 2013-07-01 18:45:59 CEST
SRPMS  drakguard-0.7.11-1.mga3.src.rpm
       drakguard-0.7.11-1.mga2.src.rpm

RPMS   drakguard-0.7.11-1.mga2.noarch.rpm
       drakguard-0.7.11-1.mga3.noarch.rpm

Updates are mga2 and mga3 core/updates_testing
Packages are 'noarch' so there is no need to test different architectures.


Advisory
========
This is a bugfix update to allow drakguard to use local time when setting internet blackout periods, and to corret a bug when enabling Access Control Lists on ext4 file systems.

Test Procedure
-------------
Part 1 - Ensure ACL can be set on ext4 partitions. Bug9195
--------------------------------------------------

Requirement - Computer with at least one ext4 or btrfs partition.

1/ Before upgrading drakguard start the old version and observe how you get a pop up message saying ACL must be enabled. After enabling ACL you are instructed to reboot and on starting drakguard again you see the same message.

2/ Edit /etc/fstab and remove the option .acl  from any hard drive partition on which it appears. There is no need to reboot or remount the partitions.

3/ Install drakguard-0.7.11-1 from core/updates_testing, and start it.

4/ If all your partitions are ext4 or btrfs then you should not see any pop up and you are ready to start using drakguard.

5/ If you have one or more partitions that are ext2, ext3, or reiserfs you should see the pop up offering to set acl. Select 'Yes'. Before rebooting examine /etc/fstab and observe that any line for an ext2/3 or reiserfs partition now has ,acl set as an option.

6/ reboot and start drakguard again. You should now not see any pop up and you are ready to test ACL command blocking.

7/ Check the 'enable parental control' box and select the 'Block Programs' Tab.
Add the command /usr/bin/ping  to the list of blocked programs and select 'OK'

8/ Open a terminal and try to ping another computer (Do this as your user NOT as root)
$ ping google.com
bash: /usr/bin/ping: Permission denied

9/ Now unblock the ping command and observe it works again.


Part 2 - Testing setting blackout periods with local time Bug 6400
---------------------------------------------------------

1/ Determine your offset from UTC with the commands
date -u 
date 

2/ Open drakguard - Set the checkboxes to 'enable parental control' and 'Time Control'. Select your user to have network access in the user Access box.

3/ If you are WEST of UTC (your time is less than UTC) set the start time to be some hours in the past, and the end time  to be a few minutes in the future (local time) and select OK

4/ Confirm you still have network access.

5/ Wait until one minute past the end time, and try again. Your user access should now be blocked.

If you are EAST of UTC, then proceed as above but set the Start time to be a few minutes in the future and check service starts at that time.

Part 2 Complete.

Keywords: NEEDINFO => (none)
Assignee: bugsquad => derekjenn

Derek Jennings 2013-07-01 18:47:34 CEST

Status: NEW => ASSIGNED
Assignee: derekjenn => qa-bugs

Comment 22 Rémi Verschelde 2013-07-02 16:29:24 CEST
Testing complete Mageia 3 i586.

I followed the procedure from comment 21, thanks Derek!
I did not really understand the different expected behaviour for users East or West of UTC, but for me the network restriction worked as expected: I gave me a timespan of 3 minutes of network (local time, which is UTC+2 for me), and after that the network was blocked.

Whiteboard: MGA2TOO => MGA2TOO has_procedure MGA3-32-OK

Comment 23 Derek Jennings 2013-07-02 21:00:01 CEST
(In reply to Rémi Verschelde from comment #22)
> I did not really understand the different expected behaviour for users East
> or West of UTC, but for me the network restriction worked as expected: I

Sorry if I confused you there  Rémi. The object was to make sure there was no overlap between the access window and UTC so we can be sure it is working on local time.  I was probably being too anal.
Comment 24 Rémi Verschelde 2013-07-02 21:06:09 CEST
(In reply to Derek Jennings from comment #23)
> 
> Sorry if I confused you there  Rémi. The object was to make sure there was
> no overlap between the access window and UTC so we can be sure it is working
> on local time.  I was probably being too anal.

No problem, now I understand :)
Another way is to test with a timespan < 1h as I did, since no countries are in UTC±½ ;)

CC: (none) => remi

Comment 25 André DESMOTTES 2013-07-05 09:33:53 CEST
Hello,

With mga2 64b and Cauldron 64b, drakguard 0.7.11 doesn't solve the ACL loop problem.

/ ext4
/home ext4
/media/windows ntfs-3g
/mnt/documents nfs
/mnt/multimedia nfs

no acl option in fstab.
Comment 26 Derek Jennings 2013-07-05 13:20:00 CEST
(In reply to André DESMOTTES from comment #25)
> Hello,
> 
> With mga2 64b and Cauldron 64b, drakguard 0.7.11 doesn't solve the ACL loop
> problem.
> 
> / ext4
> /home ext4
> /media/windows ntfs-3g
> /mnt/documents nfs
> /mnt/multimedia nfs
> 
> no acl option in fstab.


Yep. In an ext 4 only environment you get a recurring "enabled but not activated message"  hold off testing while I fix it.  Thanks
Derek Jennings 2013-07-05 13:26:52 CEST

Assignee: qa-bugs => derekjenn

Derek Jennings 2013-07-10 09:43:55 CEST

Blocks: (none) => 10513

Derek Jennings 2013-07-10 09:44:58 CEST

Blocks: (none) => 7775

Comment 27 Derek Jennings 2013-07-12 00:31:47 CEST
New packages in Updates testing soon

SRPMS  drakguard-0.7.14-1.mga3.src.rpm
       drakguard-0.7.14-1.mga2.src.rpm

RPMS   drakguard-0.7.14-1.mga3.noarch.rpm
       drakguard-0.7.14-1.mga2.noarch.rpm

These packages should fix the recurring message in an ext4 only environment described in comment 25

In addition two other bugs are fixed
Bug 7775 interferences between urpmi and parental control (drakguard)
Bug 10513 Parental control does not work with squid 3.2

New Advisory
------------
This is a bugfix update to fix a number of bugs in drakguard.
mga 6400 -Use local time when setting internet blackout periods.
mga 9195 -ACL on ext4 partitions.
mga 7775 -Allow urpmi network access when parental controls enabled.
mga 10513 -Allow drakguard to work with squid 3.2

Test Procedure
---------------
As described in comment 21 with the addition of tests for mga7775 and mga10513

mga7775 test
------------
Install the text based browser 'links'
Prior to installing drakguard-0.7.14-1 enable parental controls and check the box to 'block all network traffic'
Open a terminal and enter su to become root user.
Enter 'links http://www.mirrorservice.org/pub/mageia.org'  Observe in links you can see that connection has been blocked.
Remove the connection block in drakguard.

Install drakguard-0.7.14-1 and repeat
Observe that links now shows you can access the site 

mga 10513 test
--------------
In Mageia 3 prior to installing drakguard-0.7.14-1 enable parental control in drakguard. Do NOT check 'block all traffic'

With a browser, browse to the test page http://dansguardian.org/downloads/test.zip

Observe that you do you see the blue blocking screen from dansguardian. Instead you see a grey error page. The small text at the bottom indicates it is coming from squid.
Disable drakguard. Upgrade to drakguard-0.7.14-1 and repeat.
Observe you now see the blue page from dansguardian.

Mageia 2 should work OK with both old and new versions of drakguard.
Derek Jennings 2013-07-13 10:28:59 CEST

Assignee: derekjenn => qa-bugs

Comment 28 Dave Hodgins 2013-07-20 00:35:34 CEST
Advisory 9195.adv uploaded to svn.

CC: (none) => davidwhodgins

Comment 29 Dave Hodgins 2013-07-21 04:46:16 CEST
Testing complete on Mageia 3 x86_64. Testing Mageia 2 shortly.

Keywords: (none) => validated_update
Whiteboard: MGA2TOO has_procedure MGA3-32-OK => MGA2TOO has_procedure MGA3-32-OK MGA3-64-OK
CC: (none) => sysadmin-bugs

Comment 30 Dave Hodgins 2013-07-21 05:00:52 CEST
Testing complete on Mageia 2. Could someone from the sysadmin team
push 9195.adv to updates.

Whiteboard: MGA2TOO has_procedure MGA3-32-OK MGA3-64-OK => MGA2TOO has_procedure MGA3-32-OK MGA3-64-OK MGA2-64-OK MGA2-32-OK

Comment 31 Nicolas Vigier 2013-07-21 12:05:56 CEST
http://advisories.mageia.org/MGAA-2013-0068.html

Status: ASSIGNED => RESOLVED
CC: (none) => boklm
Resolution: (none) => FIXED

Nicolas Vigier 2014-05-08 18:05:24 CEST

CC: boklm => (none)

Comment 32 Daniel BEZIVIN 2017-01-11 16:41:50 CET
*** Bug 20102 has been marked as a duplicate of this bug. ***

CC: (none) => daniel.bezivin


Note You need to log in before you can comment on or make changes to this bug.