lkml.org 
[lkml]   [2018]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: NFS: regression in stable kernel 4.9.78 from 4.9.75
Date
Hello!

Am Montag, 29. Januar 2018, 13:22:49 schrieb Wolfgang Walter:
> Hello,
>
> after upgrading our nfs-server from 4.9.75 to 4.9.78 group permissions stop
> working (for clients). If you need group permissions to access a file or
> directory, sometimes access is granted, but rather often denied. Often
> access to the same object is denied within seconds after access was granted
> in an earlier access. user permissions work fine.
>
> Downgrading to 4.9.75 fixes the issue.
>
> We use kerberos.
>
> Regards,

This seems to be fixed in 4.15 with commit
1995266727fa8143897e89b55f5d3c79aa828420:


commit 1995266727fa8143897e89b55f5d3c79aa828420
Author: Ben Hutchings <ben.hutchings@codethink.co.uk>
Date: Mon Jan 22 20:11:06 2018 +0000

nfsd: auth: Fix gid sorting when rootsquash enabled

Commit bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility
group_info allocators") appears to break nfsd rootsquash in a pretty
major way.

It adds a call to groups_sort() inside the loop that copies/squashes
gids, which means the valid gids are sorted along with the following
garbage. The net result is that the highest numbered valid gids are
replaced with any lower-valued garbage gids, possibly including 0.

We should sort only once, after filling in all the gids.

Fixes: bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility
...")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Acked-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>


So this should be applied to stables 4.4, 4.9 and 4.14 (and others where
bdcf0a423ea1 has been backported to).

Regards,
--
Wolfgang Walter
Studentenwerk München
Anstalt des öffentlichen Rechts

\
 
 \ /
  Last update: 2018-01-29 14:50    [W:0.057 / U:1.660 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site