lkml.org 
[lkml]   [2013]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH review 52/85] sunrpc: Properly encode kuids and kgids in auth.unix.gid rpc pipe upcalls.
"J. Bruce Fields" <bfields@fieldses.org> writes:

> On Wed, Feb 13, 2013 at 09:51:41AM -0800, Eric W. Biederman wrote:
>> From: "Eric W. Biederman" <ebiederm@xmission.com>
>>
>> When a new rpc connection is established with an in-kernel server, the
>> traffic passes through svc_process_common, and svc_set_client and down
>> into svcauth_unix_set_client if it is of type RPC_AUTH_NULL or
>> RPC_AUTH_UNIX.
>>
>> svcauth_unix_set_client then looks at the uid of the credential we
>> have assigned to the incomming client and if we don't have the groups
>> already cached makes an upcall to get a list of groups that the client
>> can use.
>>
>> The upcall encodes send a rpc message to user space encoding the uid
>> of the user whose groups we want to know. Encode the kuid of the user
>> in the initial user namespace as nfs mounts can only happen today in
>> the initial user namespace.
>
> OK, I didn't know that.
>
> (Though I'm unclear how it should matter to the server what user
> namespace the client is in?)

Perhaps I have the description a little scrambled. The short version
is that to start I only support the initial network namespace.

If I haven't succeeded it is my intent to initially limit the servers
to the initial user namespace as well. I should see if I can figure
that out.

>> When a reply to an upcall comes in convert interpret the uid and gid values
>> from the rpc pipe as uids and gids in the initial user namespace and convert
>> them into kuids and kgids before processing them further.
>>
>> When reading proc files listing the uid to gid list cache convert the
>> kuids and kgids from into uids and gids the initial user namespace. As we are
>> displaying server internal details it makes sense to display these values
>> from the servers perspective.
>
> All of these caches are already per-network-namespace. Ideally wouldn't
> we also like to associate a user namespace with each cache somehow?

Ideally yes. I read through the caches enough to figure out where there
user space interfaces were, and to make certain we had conversions
to/from kuids and kgids.

I haven't looked at what user namespace makes sense for these
caches. For this cache my first guess is that net->user_ns
is what we want as it will be shared by all users in network namespace I
presume.

Eric


\
 
 \ /
  Last update: 2013-02-13 23:02    [W:0.114 / U:0.996 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site