From owner-freebsd-bugs  Thu Jul 17 21:10:07 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id VAA26098
          for bugs-outgoing; Thu, 17 Jul 1997 21:10:07 -0700 (PDT)
Received: (from gnats@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id VAA26092;
          Thu, 17 Jul 1997 21:10:03 -0700 (PDT)
Resent-Date: Thu, 17 Jul 1997 21:10:03 -0700 (PDT)
Resent-Message-Id: <199707180410.VAA26092@hub.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@FreeBSD.ORG, gene@starkhome.cs.sunysb.edu
Received: from bsd7.cs.sunysb.edu (bsd7.cs.sunysb.edu [130.245.1.197])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id VAA25928
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 17 Jul 1997 21:06:11 -0700 (PDT)
Received: (from uucp@localhost)
	by bsd7.cs.sunysb.edu (8.8.5/8.8.5) with UUCP id AAA29737
	for FreeBSD-gnats-submit@freebsd.org; Fri, 18 Jul 1997 00:06:09 -0400 (EDT)
Received: (from gene@localhost)
	by starkhome.cs.sunysb.edu (8.8.5/8.8.5) id XAA09260;
	Thu, 17 Jul 1997 23:32:12 -0400 (EDT)
Message-Id: <199707180332.XAA09260@starkhome.cs.sunysb.edu>
Date: Thu, 17 Jul 1997 23:32:12 -0400 (EDT)
From: Gene Stark <gene@starkhome.cs.sunysb.edu>
Reply-To: gene@starkhome.cs.sunysb.edu
To: FreeBSD-gnats-submit@FreeBSD.ORG
X-Send-Pr-Version: 3.2
Subject: kern/4115: SunOS NFS file has wrong owner if creator has EUID = 65534
Sender: owner-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         4115
>Category:       kern
>Synopsis:       SunOS NFS file has wrong owner if creator has EUID = 65534
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 17 21:10:02 PDT 1997
>Last-Modified:
>Originator:     Gene Stark
>Organization:
SUNY at Stony Brook CS Dept.
>Release:        FreeBSD 2.2.2-RELEASE i386
>Environment:

	FreeBSD machine with NFS mounted volumes being served
	by Sparc IPX's running SunOS 4.1.3.

>Description:

	When a program that is running setuid to "nobody" (UID 65534)
	creates a file on an NFS mounted volume being served by a
	Sparc IPX running SunOS 4.1.3, the file comes out being owned
	by a bizarre user ID:

	-rwxr-xr-x  1 4294967  daemon  0 Jul 17 23:16 foo

>How-To-Repeat:

Compile the following program, chown to nobody (UID 65534),
chmod 4711, then run it, specifying as argument a path on the
NFS mounted volume.  Observe that a file with a bogus UID is
created.  If a path is specified on the local FreeBSD machine,
everything is normal.
#include <unistd.h>
#include <sys/types.h>

main(int argc, char *argv[])
{
        printf("UID: %ld, EUID: %ld\n", getuid(), geteuid());
        creat(argv[1], 0777);
}

>Fix:
	
	Unknown.

>Audit-Trail:
>Unformatted: