Commit 6fab8779 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

nfsd: Properly compare and initialize kuids and kgids 



Use uid_eq(uid, GLOBAL_ROOT_UID) instead of !uid.
Use gid_eq(gid, GLOBAL_ROOT_GID) instead of !gid.
Use uid_eq(uid, INVALID_UID) instead of uid == -1
Use gid_eq(uid, INVALID_GID) instead of gid == -1
Use uid = GLOBAL_ROOT_UID instead of uid = 0;
Use gid = GLOBAL_ROOT_GID instead of gid = 0;
Use !uid_eq(uid1, uid2) instead of uid1 != uid2.
Use !gid_eq(gid1, gid2) instead of gid1 != gid2.
Use uid_eq(uid1, uid2) instead of uid1 == uid2.

Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
parent 4c1e1b34

fs/nfsd/auth.c

+5 −5
Original line number Diff line number Diff line
@@ -47,9 +47,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp) 
		if (!gi)

			goto oom;

	} else if (flags & NFSEXP_ROOTSQUASH) {

		if (!new->fsuid)

		if (uid_eq(new->fsuid, GLOBAL_ROOT_UID))

			new->fsuid = exp->ex_anon_uid;

		if (!new->fsgid)

		if (gid_eq(new->fsgid, GLOBAL_ROOT_GID))

			new->fsgid = exp->ex_anon_gid;



		gi = groups_alloc(rqgi->ngroups);
@@ -66,9 +66,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp) 
		gi = get_group_info(rqgi);

	}



	if (new->fsuid == (uid_t) -1)

	if (uid_eq(new->fsuid, INVALID_UID))

		new->fsuid = exp->ex_anon_uid;

	if (new->fsgid == (gid_t) -1)

	if (gid_eq(new->fsgid, INVALID_GID))

		new->fsgid = exp->ex_anon_gid;



	ret = set_groups(new, gi);
@@ -76,7 +76,7 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp) 
	if (ret < 0)

		goto error;



	if (new->fsuid)

	if (!uid_eq(new->fsuid, GLOBAL_ROOT_UID))

		new->cap_effective = cap_drop_nfsd_set(new->cap_effective);

	else

		new->cap_effective = cap_raise_nfsd_set(new->cap_effective,

fs/nfsd/nfs4recover.c

+2 −2
Original line number Diff line number Diff line
@@ -73,8 +73,8 @@ nfs4_save_creds(const struct cred **original_creds) 
	if (!new)

		return -ENOMEM;



	new->fsuid = 0;

	new->fsgid = 0;

	new->fsuid = GLOBAL_ROOT_UID;

	new->fsgid = GLOBAL_ROOT_GID;

	*original_creds = override_creds(new);

	put_cred(new);

	return 0;

fs/nfsd/nfs4state.c

+3 −3
Original line number Diff line number Diff line
@@ -1202,7 +1202,7 @@ static bool groups_equal(struct group_info *g1, struct group_info *g2) 
	if (g1->ngroups != g2->ngroups)

		return false;

	for (i=0; i<g1->ngroups; i++)

		if (GROUP_AT(g1, i) != GROUP_AT(g2, i))

		if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))

			return false;

	return true;

}
@@ -1227,8 +1227,8 @@ static bool 
same_creds(struct svc_cred *cr1, struct svc_cred *cr2)

{

	if ((is_gss_cred(cr1) != is_gss_cred(cr2))

		|| (cr1->cr_uid != cr2->cr_uid)

		|| (cr1->cr_gid != cr2->cr_gid)

		|| (!uid_eq(cr1->cr_uid, cr2->cr_uid))

		|| (!gid_eq(cr1->cr_gid, cr2->cr_gid))

		|| !groups_equal(cr1->cr_group_info, cr2->cr_group_info))

		return false;

	if (cr1->cr_principal == cr2->cr_principal)

fs/nfsd/vfs.c

+4 −4
Original line number Diff line number Diff line
@@ -401,8 +401,8 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, 


	/* Revoke setuid/setgid on chown */

	if (!S_ISDIR(inode->i_mode) &&

	    (((iap->ia_valid & ATTR_UID) && iap->ia_uid != inode->i_uid) ||

	     ((iap->ia_valid & ATTR_GID) && iap->ia_gid != inode->i_gid))) {

	    (((iap->ia_valid & ATTR_UID) && !uid_eq(iap->ia_uid, inode->i_uid)) ||

	     ((iap->ia_valid & ATTR_GID) && !gid_eq(iap->ia_gid, inode->i_gid)))) {

		iap->ia_valid |= ATTR_KILL_PRIV;

		if (iap->ia_valid & ATTR_MODE) {

			/* we're setting mode too, just clear the s*id bits */
@@ -1205,7 +1205,7 @@ nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp, 
	 * send along the gid on create when it tries to implement

	 * setgid directories via NFS:

	 */

	if (current_fsuid() != 0)

	if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))

		iap->ia_valid &= ~(ATTR_UID|ATTR_GID);

	if (iap->ia_valid)

		return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
@@ -2150,7 +2150,7 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp, 
	 * with NFSv3.

	 */

	if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&

	    inode->i_uid == current_fsuid())

	    uid_eq(inode->i_uid, current_fsuid()))

		return 0;



	/* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */

CRA Git | Maintained and supported by SUSTech CRA and CCSE