Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 283ebe3e authored by Trond Myklebust's avatar Trond Myklebust Committed by Anna Schumaker
Browse files

SUNRPC: Use the client user namespace when encoding creds 



When encoding AUTH_UNIX creds and AUTH_GSS upcalls, use the user namespace
of the process that created the rpc client.

Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 1a58e8a0

net/sunrpc/auth_gss/auth_gss.c

+8 −3
Original line number Diff line number Diff line
@@ -412,7 +412,10 @@ gss_upcall_callback(struct rpc_task *task) 


static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)

{

	uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);

	struct user_namespace *userns = gss_msg->auth->client->cl_cred ?

		gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;



	uid_t uid = from_kuid_munged(userns, gss_msg->uid);

	memcpy(gss_msg->databuf, &uid, sizeof(uid));

	gss_msg->msg.data = gss_msg->databuf;

	gss_msg->msg.len = sizeof(uid);
@@ -424,13 +427,15 @@ static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg, 
				const char *service_name,

				const char *target_name)

{

	struct user_namespace *userns = gss_msg->auth->client->cl_cred ?

		gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;

	struct gss_api_mech *mech = gss_msg->auth->mech;

	char *p = gss_msg->databuf;

	size_t buflen = sizeof(gss_msg->databuf);

	int len;



	len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,

			from_kuid(&init_user_ns, gss_msg->uid));

			from_kuid_munged(userns, gss_msg->uid));

	buflen -= len;

	p += len;

	gss_msg->msg.len = len;
@@ -706,7 +711,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) 
		goto err;

	}



	uid = make_kuid(&init_user_ns, id);

	uid = make_kuid(current_user_ns(), id);

	if (!uid_valid(uid)) {

		err = -EINVAL;

		goto err;

net/sunrpc/auth_unix.c

+5 −4
Original line number Diff line number Diff line
@@ -107,6 +107,8 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr) 
	__be32		*p, *cred_len, *gidarr_len;

	int		i;

	struct group_info *gi = cred->cr_cred->group_info;

	struct user_namespace *userns = clnt->cl_cred ?

		clnt->cl_cred->user_ns : &init_user_ns;



	/* Credential */
@@ -122,14 +124,13 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr) 
	p = xdr_reserve_space(xdr, 3 * sizeof(*p));

	if (!p)

		goto marshal_failed;

	*p++ = cpu_to_be32(from_kuid(&init_user_ns, cred->cr_cred->fsuid));

	*p++ = cpu_to_be32(from_kgid(&init_user_ns, cred->cr_cred->fsgid));

	*p++ = cpu_to_be32(from_kuid_munged(userns, cred->cr_cred->fsuid));

	*p++ = cpu_to_be32(from_kgid_munged(userns, cred->cr_cred->fsgid));



	gidarr_len = p++;

	if (gi)

		for (i = 0; i < UNX_NGROUPS && i < gi->ngroups; i++)

			*p++ = cpu_to_be32(from_kgid(&init_user_ns,

						     gi->gid[i]));

			*p++ = cpu_to_be32(from_kgid_munged(userns, gi->gid[i]));

	*gidarr_len = cpu_to_be32(p - gidarr_len - 1);

	*cred_len = cpu_to_be32((p - cred_len - 1) << 2);

	p = xdr_reserve_space(xdr, (p - gidarr_len - 1) << 2);