New configuration parameter to specify a superuser #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
satgs
commented
Feb 23, 2017
src/cache_inode/cache_inode_access.c
Outdated
| note = " (Ok for root user)"; | ||
| goto out; | ||
| } | ||
| } else if (creds->caller_uid == 0) { | ||
| note = " (Ok for root user)"; |
There was a problem hiding this comment.
I will change the message to "Ok for super user". MapR super_user callback will check for uid == 0 and special uid, if any specified in conf file.
Some filesystems have another superuser who is not root. One superuser can be added per export block. Configuration parameter : SuperUser_Uid. Value : uid of the superuser. Change-Id: Ie25b59b218b85b96b66fd5cbd413b4a9fb362761 Signed-off-by: Satya G S <g.satyaprakash@gmail.com>
svorobiev
pushed a commit
that referenced
this pull request
Jul 29, 2020
The caller of state_lock() is expected to take the lock on its own. This should fix the sporadical failure seen in this patchset: https://review.gerrithub.io/#/c/385433/ ==3884==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110003fbf68 at pc 0x00000077cd18 bp 0x7fffc9cbf150 sp 0x7fffc9cbf148 READ of size 8 at 0x6110003fbf68 thread T34 Detaching after fork from child process 3944. #0 0x77cd17 in copy_conflict /export/nfs-ganesha/src/SAL/state_lock.c:2239:26 #1 0x77fa9c in state_lock /export/nfs-ganesha/src/SAL/state_lock.c:2444:5 #2 0x733404 in _9p_lock /export/nfs-ganesha/src/Protocols/9P/9p_lock.c:168:18 #3 0x71c904 in _9p_process_buffer /export/nfs-ganesha/src/Protocols/9P/9p_interpreter.c:180:7 #4 0x5fb386 in _9p_rdma_process_request /export/nfs-ganesha/src/MainNFSD/9p_rdma_callbacks.c:158:8 #5 0x5c928f in _9p_execute /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1509:3 #6 0x5aa899 in worker_run /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1604:4 #7 0x88c1c4 in fridgethr_start_routine /export/nfs-ganesha/src/support/fridgethr.c:550:3 #8 0x7ffff79b16c9 in start_thread (/lib64/libpthread.so.0+0x76c9) #9 0x7ffff4ed7f7e in __GI___clone (/lib64/libc.so.6+0x107f7e) 0x6110003fbf68 is located 104 bytes inside of 200-byte region [0x6110003fbf00,0x6110003fbfc8) freed by thread T26 here: #0 0x4e2ae0 in __interceptor_cfree.localalias.1 (/export/nfs-ganesha/build/MainNFSD/ganesha.nfsd+0x4e2ae0) #1 0x7731e4 in gsh_free /export/nfs-ganesha/src/include/abstract_mem.h:271:2 #2 0x7731b6 in lock_entry_dec_ref /export/nfs-ganesha/src/SAL/state_lock.c:714:3 #3 0x77b06a in remove_from_locklist /export/nfs-ganesha/src/SAL/state_lock.c:774:2 #4 0x78d39a in free_list /export/nfs-ganesha/src/SAL/state_lock.c:967:3 #5 0x7848c4 in subtract_lock_from_list /export/nfs-ganesha/src/SAL/state_lock.c:1140:3 #6 0x7833ac in state_unlock /export/nfs-ganesha/src/SAL/state_lock.c:2716:11 #7 0x7334fe in _9p_lock /export/nfs-ganesha/src/Protocols/9P/9p_lock.c:187:7 #8 0x71c904 in _9p_process_buffer /export/nfs-ganesha/src/Protocols/9P/9p_interpreter.c:180:7 #9 0x5fb386 in _9p_rdma_process_request /export/nfs-ganesha/src/MainNFSD/9p_rdma_callbacks.c:158:8 #10 0x5c928f in _9p_execute /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1509:3 #11 0x5aa899 in worker_run /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1604:4 #12 0x88c1c4 in fridgethr_start_routine /export/nfs-ganesha/src/support/fridgethr.c:550:3 #13 0x7ffff79b16c9 in start_thread (/lib64/libpthread.so.0+0x76c9) previously allocated by thread T16 here: #0 0x4e2c98 in __interceptor_malloc (/export/nfs-ganesha/build/MainNFSD/ganesha.nfsd+0x4e2c98) #1 0x77443f in gsh_malloc__ /export/nfs-ganesha/src/include/abstract_mem.h:78:12 #2 0x780f13 in create_state_lock_entry /export/nfs-ganesha/src/SAL/state_lock.c:579:14 #3 0x77ffcf in state_lock /export/nfs-ganesha/src/SAL/state_lock.c:2562:16 #4 0x733404 in _9p_lock /export/nfs-ganesha/src/Protocols/9P/9p_lock.c:168:18 #5 0x71c904 in _9p_process_buffer /export/nfs-ganesha/src/Protocols/9P/9p_interpreter.c:180:7 #6 0x5fb386 in _9p_rdma_process_request /export/nfs-ganesha/src/MainNFSD/9p_rdma_callbacks.c:158:8 #7 0x5c928f in _9p_execute /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1509:3 #8 0x5aa899 in worker_run /export/nfs-ganesha/src/MainNFSD/nfs_worker_thread.c:1604:4 #9 0x88c1c4 in fridgethr_start_routine /export/nfs-ganesha/src/support/fridgethr.c:550:3 #10 0x7ffff79b16c9 in start_thread (/lib64/libpthread.so.0+0x76c9) Thanks goes to Malahal for the analysis of the problem Change-Id: Ie82eb4a5ecf5da3fd3a8d1cd9dbdb99b54842745 Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
svorobiev
pushed a commit
that referenced
this pull request
Jul 29, 2020
csa_sec_parms_val was declared in its own scope but was used much
later, we need to declare it outside of the helper and pass the
address there.
==7480==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fffea684340 at pc 0x7fffecec1e9c bp 0x7fffea683510 sp 0x7fffea683500
READ of size 4 at 0x7fffea684340 thread T5
#0 0x7fffecec1e9b in xdr_uint32_t /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:221
#1 0x7fffecec1ef7 in xdr_u_int32_t /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:236
#2 0x7fffecec9d88 in xdr_callback_sec_parms4 /src/nfs-ganesha/src/include/nfsv41.h:6750
#3 0x7fffecec3c3c in xdr_array_encode /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:848
#4 0x7fffecec3ef3 in xdr_array /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:891
#5 0x7fffececaa56 in xdr_CREATE_SESSION4args /src/nfs-ganesha/src/include/nfsv41.h:7049
#6 0x7fffecece544 in xdr_nfs_argop4 /src/nfs-ganesha/src/include/nfsv41.h:8233
#7 0x7fffecec3c3c in xdr_array_encode /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:848
#8 0x7fffecec3ef3 in xdr_array /src/nfs-ganesha/src/libntirpc/ntirpc/rpc/xdr_inline.h:891
#9 0x7fffececfef4 in xdr_COMPOUND4args /src/nfs-ganesha/src/include/nfsv41.h:8732
#10 0x7fffeced6f8c in pxy_compoundv4_call /src/nfs-ganesha/src/FSAL/FSAL_PROXY/handle.c:764
#11 0x7fffeced834a in pxy_compoundv4_execute /src/nfs-ganesha/src/FSAL/FSAL_PROXY/handle.c:857
#12 0x7fffeceda878 in pxy_setsessionid /src/nfs-ganesha/src/FSAL/FSAL_PROXY/handle.c:966
#13 0x7fffecedc7eb in pxy_clientid_renewer /src/nfs-ganesha/src/FSAL/FSAL_PROXY/handle.c:1147
#14 0x7ffff5572593 in start_thread /usr/src/debug/glibc-2.27-78-g2b47bb9cba/nptl/pthread_create.c:463
#15 0x7ffff4e84e6e in clone (/lib64/libc.so.6+0xf9e6e)
Address 0x7fffea684340 is located in stack of thread T5 at offset 288 in frame
#0 0x7fffeced9cbc in pxy_setsessionid /src/nfs-ganesha/src/FSAL/FSAL_PROXY/handle.c:936
This frame has 7 object(s):
[32, 36) 'seqid'
[96, 100) 'fore_ca_rdma_ird_val_sink'
[160, 164) 'back_ca_rdma_ird_val_sink'
[224, 232) 'cid'
[288, 336) 'csa_sec_parms_val' <== Memory access at offset 288 is inside this variable
[384, 960) 'arg'
[992, 1632) 'res'
Change-Id: I597abb06747898418c907e33b57b1f0ac1f904f7
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
svorobiev
pushed a commit
that referenced
this pull request
Jul 29, 2020
There was no lookup done at all in pxy_lookup_path for /, leading
to this segfault:
#0 0x00000000006fd072 in mdcache_new_entry (export=0x617000000b00, sub_handle=0x6020000000f0, attrs_in=0x7fffffffd6a0, attrs_out=0x0,
new_directory=false, entry=0x7fffffffd620, state=0x0, reason=MDC_REASON_DEFAULT)
at /home/asmadeus/code/nfs-ganesha/src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_helpers.c:572
#1 0x00000000006ecca8 in mdcache_lookup_path (exp_hdl=0x617000000b00, path=0x602000000e90 "/", handle=0x7fffffffd840, attrs_out=0x0)
at /home/asmadeus/code/nfs-ganesha/src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_handle.c:1551
#2 0x000000000066bfe6 in init_export_root (export=0x615000000348) at /home/asmadeus/code/nfs-ganesha/src/support/exports.c:2254
#3 0x000000000066b055 in init_export_cb (exp=0x615000000348, state=0x7fffffffdb50) at /home/asmadeus/code/nfs-ganesha/src/support/exports.c:2117
#4 0x0000000000696453 in foreach_gsh_export (cb=0x66b031 <init_export_cb>, wrlock=true, state=0x7fffffffdb50)
at /home/asmadeus/code/nfs-ganesha/src/support/export_mgr.c:777
#5 0x000000000066b11b in exports_pkginit () at /home/asmadeus/code/nfs-ganesha/src/support/exports.c:2136
#6 0x000000000047902c in nfs_Init (p_start_info=0xa5dbc0 <my_nfs_start_info>) at /home/asmadeus/code/nfs-ganesha/src/MainNFSD/nfs_init.c:639
#7 0x000000000047ac94 in nfs_start (p_start_info=0xa5dbc0 <my_nfs_start_info>) at /home/asmadeus/code/nfs-ganesha/src/MainNFSD/nfs_init.c:923
#8 0x000000000041f97e in main (argc=8, argv=0x7fffffffe588) at /home/asmadeus/code/nfs-ganesha/src/MainNFSD/nfs_main.c:517
Get the root fh instead.
Change-Id: I40ee862c97e327be21a99aeaf8dbebfb15053136
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
svorobiev
pushed a commit
that referenced
this pull request
Jul 29, 2020
Add enable_UDP option to core params, default = true.
When enable_UDP = false, don't create UDP listener sockets for
various protocols -- i.e. NFS, NLM, RQUOTA -- and don't attempt to
register them in the portmapper (rpcbind).
Plus:
+ fix an uninitialized variable error in nfs_libmain() when compiling
-DCMAKE_BUILD_TYPE=Debug
+ better (friendlier) logging in fsal_common_is_referral()
+ fix misleading/incorrect log msg in fsal_set_credentials
By default this change is effectively a no-op when running as root.
To run as non-root:
+ build with -DUSE_9P=OFF
+ Add "Enable_UDP = false;" to NFS_Core_Param block
+ add a non-root user, e.g. ganesha. See the nfs-ganesha.spec(.cmake.in)
as an example.
+ run as non-root user, e.g. u/g ganesha:ganesha. E.g.
`runuser -u ganesha -g ganesha -- /usr/bin/ganesha.nfsd
-L /var/log/ganesha/ganesha.log -p /var/run/ganesha/ganesha.pid ...`
Note #0: running as non-root doesn't work with at least FSAL_VFS and
FSAL_GLUSTER, and probably the other FSALs as well. Attempts to mount
an export fail. The smoking gun seems to be in fsal_common_is_referral(),
which is passed 0 (zero) in the attrs->valid_mask and attrs->supported,
(these values are non-zero when running as root) and the call to
obj_hdl->obj_ops->getattrs() returns an error.
Note #1: we should fix the nfs-ganesha.spec.in.cmake to enable/disable 9P.
Note #2: can't register with DBUS when running as non-root.
Signed-off-by: Kaleb S. KEITHLEY <kkeithle@redhat.com>
Change-Id: I80468fb179e08cd3b6c28463dcea1a31d05bba68
udaynpusa
pushed a commit
that referenced
this pull request
Mar 3, 2025
Currently, Ganesha uses backtrace during crashes, which may not provide sufficient useful information: 07/02/2024 19:09:18: epoch 65c3d55b: xueqian-hu: nfs-ganesha-39008[main] gsh_backtrace: NFS STARTUP: MAJ: stack backtrace follows: /lib64/libganesha_nfsd.so.5.6(+0x83ba1)[0x7f64d9172ba1] /lib64/libganesha_nfsd.so.5.6(+0x5d618)[0x7f64d914c618] /lib64/libpthread.so.0(+0xf630)[0x7f64d7d1a630] /lib64/libpthread.so.0(pthread_join+0xa7)[0x7f64d7d14017] /lib64/libganesha_nfsd.so.5.6(nfs_start+0x323)[0x7f64d914eff3] ganesha.nfsd(main+0xbef)[0x4025cf] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f64d753d555] ganesha.nfsd[0x402663] This patch introduces an option to use libunwind, which can display function information: 08/02/2024 20:06:04: epoch 65c53429: xueqian-hu: nfs-ganesha-99814[main] gsh_libunwind: NFS STARTUP: MAJ: BACKTRACE: 08/02/2024 20:06:04 : epoch 65c53429 : xueqian-hu : nfs-ganesha-99814[main] gsh_libunwind :NFS STARTUP :MAJ :BACKTRACE: #0 gsh_libunwind + 0x29 [ip=0x7f90b1a10859] [sp=0x7ffd49d53c00] #1 crash_handler + 0x8 [ip=0x7f90b19e9fd8] [sp=0x7ffd49d54670] #2 _L_unlock_13 + 0x34 [ip=0x7f90b039d630] [sp=0x7ffd49d54680] #3 pthread_join + 0xa7 [ip=0x7f90b0397017] [sp=0x7ffd49d55380] #4 nfs_start + 0x323 [ip=0x7f90b19ec9b3] [sp=0x7ffd49d553e0] #5 main + 0xbef [ip=0x4025df] [sp=0x7ffd49d55480] Change-Id: I194853e25ec0c89c7f552dc4872c37a420ea8d4a Signed-off-by: Xueqian Hu <xh140312@outlook.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Some filesystems have another superuser who is not root.
One superuser can be added per export block.
Configuration parameter : SuperUser_Uid.
Value : uid of the superuser.
Change-Id: Ie25b59b218b85b96b66fd5cbd413b4a9fb362761
Signed-off-by: Satya G S g.satyaprakash@gmail.com