Page MenuHomeFreeBSD

mountd(8): parsecred(): Fallback to "nogroup" or GID_NOGROUP
ClosedPublic

Authored by olce on Oct 8 2024, 1:43 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Jan 19, 5:04 AM
Unknown Object (File)
Fri, Jan 17, 3:31 PM
Unknown Object (File)
Mon, Jan 13, 9:23 AM
Unknown Object (File)
Sat, Jan 4, 8:30 AM
Unknown Object (File)
Dec 18 2024, 10:18 PM
Unknown Object (File)
Nov 23 2024, 12:47 PM
Unknown Object (File)
Nov 21 2024, 8:19 PM
Unknown Object (File)
Nov 15 2024, 9:22 PM
Subscribers

Details

Summary

In the 'uid:gid:gid:...' case (for '-maproot' or '-mapall'), if no GID
is specified at all (i.e., input is of the form 'uid:', with the colon
at the end), mountd(8) would pass credentials with an empty array of
groups to the kernel.

For security reasons, we have put in place a kernel fallback a few
commits ago, which currently is the value of
NFSD_VNET(nfsrv_defaultgid). That value is by default GID_NOGROUP, and
may be set by nfsuserd(8) based on the content of '/etc/group' on the
host (or some other source, depending on 'nsswitch.conf'). As,
according to rmacklem@, lots of installations do not run nfsuserd(8), we
emulate its effect here by first trying to find the GID number
corresponding to "nogroup" and falling back to GID_NOGROUP.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

olce requested review of this revision.Oct 8 2024, 1:43 PM

Simplify by using getgrnam() instead of getgrnam_r(), as mountd() is not multi-threaded and already uses getgrnam().

Isolate the fallback logic in a separate function (nogroup()) and substitute all uses of GID_NOGROUP with it.

This revision was not accepted when it landed; it landed in state Needs Review.Dec 16 2024, 2:46 PM
This revision was automatically updated to reflect the committed changes.