Reallow AUTH_NULL on v4 mounts.
Subsystems (2)
PATCH 1/1 Reallow AUTH_NULL on v4 mounts.
From: "J. Bruce Fields" <[email protected]>
Kinglong Mee noted that the loop in seicnfo_addflavor (which sets the security flavors allowed on the v4 pseudoroot) was adding flavors 1 and 0 twice; this is because flav_map ends with these entries:
{ "unix", AUTH_UNIX },
{ "sys", AUTH_SYS },
{ "null", AUTH_NULL },
{ "none", AUTH_NONE },
where AUTH_UNIX == AUTH_SYS == 1 and AUTH_NULL == AUTH_NONE == 1. We need to allow two names for each of those two security flavors for historical reasons.
The patch correctly fixed this by fixing the check for a duplicate flavor number in secinfo_addflavor(). However it also went one step further and rejected the flavor number 0. This is unnecessary and causes the kernel to fail any NFSv4 mounts using AUTH_NULL.
The fact that we've apparently gone a few years without anyone noticing this suggests AUTH_NULL isn't used very much! Still, this should be fixed....
--- utils/mountd/v4root.c | 3 --- 1 file changed, 3 deletions(-)
utils/mountd/v4root.c +0 -3
@@ -69,9 +69,6 @@ set_pseudofs_security(struct exportent *pseudo, int flags)for (flav = flav_map; flav < flav_map + flav_map_size; flav++) {struct sec_entry *new; -if (!flav->fnum) -continue ; - i =secinfo_addflavor (flav, pseudo); new = &pseudo->e_secinfo[i];
Signature · 1 line
2.17.1
Quoted 8 lines · On Jun 14, 2018, at 9:52 AM, [email protected] wrote:
=20
From: "J. Bruce Fields" <[email protected]>
=20
Kinglong Mee noted that the loop inseicnfo_addflavor(which sets the security flavors allowed on the v4 pseudoroot) was adding flavors 1 =
and
Quoted 8 lines
0 twice; this is because
flav_mapends with these entries:
=20
{ "unix",AUTH_UNIX},
{ "sys",AUTH_SYS},
{ "null",AUTH_NULL},
{ "none",AUTH_NONE},
=20
whereAUTH_UNIX=3D=3DAUTH_SYS=3D=3D 1 andAUTH_NULL=3D=3D =
AUTH_NONE =3D=3D 1.
Hi Bruce, patch description may be incorrect: NULL and NONE should be 0.
Quoted 10 lines
We
need to allow two names for each of those two security flavors for historical reasons.
=20
The patch correctly fixed this by fixing the check for a duplicate flavor number insecinfo_addflavor(). However it also went one step further and rejected the flavor number 0. This is unnecessary and causes the kernel to fail any NFSv4 mounts usingAUTH_NULL. =20
The fact that we've apparently gone a few years without anyone =
noticing
utils/mountd/v4root.c set_pseudofs_security(struct exportent *pseudo, int =
Quoted 15 lines
this suggests
AUTH_NULLisn't used very much! Still, this should be fixed....
=20Fixes e69eaaf93626Cc Kinglong Mee <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>---
utils/mountd/v4root.c| 3 ---1 file changed, 3 deletions(-)=20
utils/mountd/v4root.c +0
-0@@ -69,9 +69,6 @@ set_pseudofs_security(struct exportent *pseudo, int =
flags)
utils/mountd/v4root.c set_pseudofs_security(struct exportent *pseudo, int = · line 69
Quoted 1 line
utils/mountd/v4root.c +0
-0for (flav =3D flav_map; flav < flav_map + flav_map_size; flav++) =
{
Quoted 7 lines
utils/mountd/v4root.c +0
-0struct sec_entry *new;=20
utils/mountd/v4root.c +0
-3-if (!flav->fnum) -continue ; -i =3D secinfo_addflavor(flav, pseudo); new =3D &pseudo->e_secinfo[i];
Quoted 6 lines
=20
--=20
2.17.1
=20
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" =
in
Quoted 2 lines
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Chuck Lever
Quoted 10 lines · Chuck Lever
Quoted 10 lines · On Jun 14, 2018, at 9:52 AM, [email protected] wrote:
From: "J. Bruce Fields" <[email protected]>
Kinglong Mee noted that the loop in
seicnfo_addflavor(which sets the security flavors allowed on the v4 pseudoroot) was adding flavors 1 and 0 twice; this is becauseflav_mapends with these entries:
Quoted 8 lines
Quoted 6 lines
{ "unix",
AUTH_UNIX},
{ "sys",AUTH_SYS},
{ "null",AUTH_NULL},
{ "none",AUTH_NONE},where
AUTH_UNIX==AUTH_SYS== 1 andAUTH_NULL==AUTH_NONE== 1.Hi Bruce, patch description may be incorrect: NULL and NONE should be 0.
Yes, thanks! Steve, let me know if you want me to resend or correct the typo yourself.--b.
Quoted 47 lines
Quoted 42 lines
We
need to allow two names for each of those two security flavors for historical reasons.The patch correctly fixed this by fixing the check for a duplicate flavor number in
secinfo_addflavor(). However it also went one step further and rejected the flavor number 0. This is unnecessary and causes the kernel to fail any NFSv4 mounts usingAUTH_NULL.The fact that we've apparently gone a few years without anyone noticing this suggests
AUTH_NULLisn't used very much! Still, this should be fixed....Fixes e69eaaf93626Cc Kinglong Mee <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>---
utils/mountd/v4root.c| 3 ---1 file changed, 3 deletions(-)utils/mountd/v4root.c +0
-3@@ -69,9 +69,6 @@ set_pseudofs_security(struct exportent *pseudo, int flags)for (flav = flav_map; flav < flav_map + flav_map_size; flav++) {struct sec_entry *new; -if (!flav->fnum) -continue ; - i =secinfo_addflavor (flav, pseudo); new = &pseudo->e_secinfo[i];Signature · 6 lines
2.17.1 -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html--
Chuck Lever