lkml.org 
[lkml]   [2007]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patches in this message
    /
    From
    Date
    Subject[PATCH 020 of 20] knfsd: nfsd: enforce per-flavor id squashing

    From: J. Bruce Fields <bfields@citi.umich.edu>

    Allow root squashing to vary per-pseudoflavor, so that you can (for
    example) allow root access only when sufficiently strong security is in
    use.

    Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
    Signed-off-by: Neil Brown <neilb@suse.de>

    ### Diffstat output
    ./fs/nfsd/auth.c | 18 ++++++++++++++++--
    ./include/linux/nfsd/export.h | 3 ++-
    2 files changed, 18 insertions(+), 3 deletions(-)

    diff .prev/fs/nfsd/auth.c ./fs/nfsd/auth.c
    --- .prev/fs/nfsd/auth.c 2007-07-10 12:18:33.000000000 +1000
    +++ ./fs/nfsd/auth.c 2007-07-10 12:19:40.000000000 +1000
    @@ -12,17 +12,31 @@

    #define CAP_NFSD_MASK (CAP_FS_MASK|CAP_TO_MASK(CAP_SYS_RESOURCE))

    +static int nfsexp_flags(struct svc_rqst *rqstp, struct svc_export *exp)
    +{
    + struct exp_flavor_info *f;
    + struct exp_flavor_info *end = exp->ex_flavors + exp->ex_nflavors;
    +
    + for (f = exp->ex_flavors; f < end; f++) {
    + if (f->pseudoflavor == rqstp->rq_flavor)
    + return f->flags;
    + }
    + return exp->ex_flags;
    +
    +}
    +
    int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
    {
    struct svc_cred cred = rqstp->rq_cred;
    int i;
    + int flags = nfsexp_flags(rqstp, exp);
    int ret;

    - if (exp->ex_flags & NFSEXP_ALLSQUASH) {
    + if (flags & NFSEXP_ALLSQUASH) {
    cred.cr_uid = exp->ex_anon_uid;
    cred.cr_gid = exp->ex_anon_gid;
    cred.cr_group_info = groups_alloc(0);
    - } else if (exp->ex_flags & NFSEXP_ROOTSQUASH) {
    + } else if (flags & NFSEXP_ROOTSQUASH) {
    struct group_info *gi;
    if (!cred.cr_uid)
    cred.cr_uid = exp->ex_anon_uid;
    diff .prev/include/linux/nfsd/export.h ./include/linux/nfsd/export.h
    --- .prev/include/linux/nfsd/export.h 2007-07-10 12:18:33.000000000 +1000
    +++ ./include/linux/nfsd/export.h 2007-07-10 12:19:40.000000000 +1000
    @@ -43,7 +43,8 @@
    #define NFSEXP_ALLFLAGS 0xFE3F

    /* The flags that may vary depending on security flavor: */
    -#define NFSEXP_SECINFO_FLAGS NFSEXP_READONLY
    +#define NFSEXP_SECINFO_FLAGS (NFSEXP_READONLY | NFSEXP_ROOTSQUASH \
    + | NFSEXP_ALLSQUASH)

    #ifdef __KERNEL__

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2007-07-10 04:33    [W:0.025 / U:157.376 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site