Skip to content

Commit

Permalink
Fix ACL checks for NFS kernel server
Browse files Browse the repository at this point in the history
For Linux NFS kernel server ops, fsuid and fsgid in
cred are populated with ids that operation is
being performed as, but euid and egid remain 0.

In Linux when setresuid(2) and setresgid(2) are
called, the fsuid and fsgid are set to the euid
and egid respectively.

This PR changes ZFS ACL checks to evaluate
fsuid / fsgid rather than euid / egid to avoid
accidentally granting elevated permissions to
NFS clients.

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
  • Loading branch information
anodos325 authored and Ryan Moeller committed Mar 15, 2022
1 parent 2feba9a commit 93a3516
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions module/os/linux/spl/spl-cred.c
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ groupmember(gid_t gid, const cred_t *cr)
uid_t
crgetuid(const cred_t *cr)
{
return (KUID_TO_SUID(cr->euid));
return (KUID_TO_SUID(cr->fsuid));
}

/* Return the real user id */
Expand Down Expand Up @@ -156,7 +156,7 @@ crgetfsuid(const cred_t *cr)
gid_t
crgetgid(const cred_t *cr)
{
return (KGID_TO_SGID(cr->egid));
return (KGID_TO_SGID(cr->fsgid));
}

/* Return the real group id */
Expand Down

0 comments on commit 93a3516

Please sign in to comment.