linux-kernel - Re: [PATCH] nfsd: Fix nfs4_disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <172617996236.17050.1069184645717662362@noble.neil.brown.name>
Date: Fri, 13 Sep 2024 08:26:02 +1000
From: "NeilBrown" <neilb@...e.de>
To: Pali Rohár <pali@...nel.org>
Cc: "Chuck Lever" <chuck.lever@...cle.com>, "Jeff Layton" <jlayton@...nel.org>,
 "Olga Kornievskaia" <okorniev@...hat.com>, "Dai Ngo" <Dai.Ngo@...cle.com>,
 "Tom Talpey" <tom@...pey.com>, linux-nfs@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] nfsd: Fix nfs4_disable_idmapping option

On Fri, 13 Sep 2024, Pali Rohár wrote:
> NFSv4 server option nfs4_disable_idmapping says that it turn off server's
> NFSv4 idmapping when using 'sec=sys'. But it also turns idmapping off also
> for 'sec=none'.
> 
> NFSv4 client option nfs4_disable_idmapping says same thing and really it
> turns the NFSv4 idmapping only for 'sec=sys'.
> 
> Fix the NFSv4 server option nfs4_disable_idmapping to turn off idmapping
> only for 'sec=sys'. This aligns the server nfs4_disable_idmapping option
> with its description and also aligns behavior with the client option.

Why do you think this is the right approach?
If the documentation says "turn off when sec=sys" and the implementation
does "turn off when sec=sys or sec=none" then I agree that something
needs to be fixed.  I would suggest that the documentation should be
fixed.

>From the perspective of id mapping, sec=none is similar to sec=sys.

NeilBrown


> 
> Signed-off-by: Pali Rohár <pali@...nel.org>
> Cc: stable@...r.kernel.org
> ---
>  fs/nfsd/nfs4idmap.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
> index 7a806ac13e31..641293711f53 100644
> --- a/fs/nfsd/nfs4idmap.c
> +++ b/fs/nfsd/nfs4idmap.c
> @@ -620,7 +620,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
>  static __be32
>  do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u32 *id)
>  {
> -	if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
> +	if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor == RPC_AUTH_UNIX)
>  		if (numeric_name_to_id(rqstp, type, name, namelen, id))
>  			return 0;
>  		/*
> @@ -633,7 +633,7 @@ do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u
>  static __be32 encode_name_from_id(struct xdr_stream *xdr,
>  				  struct svc_rqst *rqstp, int type, u32 id)
>  {
> -	if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
> +	if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor == RPC_AUTH_UNIX)
>  		return encode_ascii_id(xdr, id);
>  	return idmap_id_to_name(xdr, rqstp, type, id);
>  }
> -- 
> 2.20.1
> 
>