mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-01-01 10:43:43 +00:00
SUNRPC: Use the client user namespace when encoding creds
When encoding AUTH_UNIX creds and AUTH_GSS upcalls, use the user namespace of the process that created the rpc client. Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
parent
1a58e8a0e5
commit
283ebe3ec4
@ -412,7 +412,10 @@ gss_upcall_callback(struct rpc_task *task)
|
||||
|
||||
static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
|
||||
{
|
||||
uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);
|
||||
struct user_namespace *userns = gss_msg->auth->client->cl_cred ?
|
||||
gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;
|
||||
|
||||
uid_t uid = from_kuid_munged(userns, gss_msg->uid);
|
||||
memcpy(gss_msg->databuf, &uid, sizeof(uid));
|
||||
gss_msg->msg.data = gss_msg->databuf;
|
||||
gss_msg->msg.len = sizeof(uid);
|
||||
@ -424,13 +427,15 @@ static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
|
||||
const char *service_name,
|
||||
const char *target_name)
|
||||
{
|
||||
struct user_namespace *userns = gss_msg->auth->client->cl_cred ?
|
||||
gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;
|
||||
struct gss_api_mech *mech = gss_msg->auth->mech;
|
||||
char *p = gss_msg->databuf;
|
||||
size_t buflen = sizeof(gss_msg->databuf);
|
||||
int len;
|
||||
|
||||
len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
|
||||
from_kuid(&init_user_ns, gss_msg->uid));
|
||||
from_kuid_munged(userns, gss_msg->uid));
|
||||
buflen -= len;
|
||||
p += len;
|
||||
gss_msg->msg.len = len;
|
||||
@ -706,7 +711,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
|
||||
goto err;
|
||||
}
|
||||
|
||||
uid = make_kuid(&init_user_ns, id);
|
||||
uid = make_kuid(current_user_ns(), id);
|
||||
if (!uid_valid(uid)) {
|
||||
err = -EINVAL;
|
||||
goto err;
|
||||
|
@ -107,6 +107,8 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr)
|
||||
__be32 *p, *cred_len, *gidarr_len;
|
||||
int i;
|
||||
struct group_info *gi = cred->cr_cred->group_info;
|
||||
struct user_namespace *userns = clnt->cl_cred ?
|
||||
clnt->cl_cred->user_ns : &init_user_ns;
|
||||
|
||||
/* Credential */
|
||||
|
||||
@ -122,14 +124,13 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr)
|
||||
p = xdr_reserve_space(xdr, 3 * sizeof(*p));
|
||||
if (!p)
|
||||
goto marshal_failed;
|
||||
*p++ = cpu_to_be32(from_kuid(&init_user_ns, cred->cr_cred->fsuid));
|
||||
*p++ = cpu_to_be32(from_kgid(&init_user_ns, cred->cr_cred->fsgid));
|
||||
*p++ = cpu_to_be32(from_kuid_munged(userns, cred->cr_cred->fsuid));
|
||||
*p++ = cpu_to_be32(from_kgid_munged(userns, cred->cr_cred->fsgid));
|
||||
|
||||
gidarr_len = p++;
|
||||
if (gi)
|
||||
for (i = 0; i < UNX_NGROUPS && i < gi->ngroups; i++)
|
||||
*p++ = cpu_to_be32(from_kgid(&init_user_ns,
|
||||
gi->gid[i]));
|
||||
*p++ = cpu_to_be32(from_kgid_munged(userns, gi->gid[i]));
|
||||
*gidarr_len = cpu_to_be32(p - gidarr_len - 1);
|
||||
*cred_len = cpu_to_be32((p - cred_len - 1) << 2);
|
||||
p = xdr_reserve_space(xdr, (p - gidarr_len - 1) << 2);
|
||||
|
Loading…
Reference in New Issue
Block a user