| Message ID | 20240823181423.20458-8-snitzer@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | nfs/nfsd: add support for localio | expand |
On Fri, Aug 23, 2024 at 02:14:05PM -0400, Mike Snitzer wrote: > From: Weston Andros Adamson <dros@primarydata.com> > > Add new funtion rpcauth_map_clnt_to_svc_cred_local which maps a > generic cred to a svc_cred suitable for use in nfsd. > > This is needed by the localio code to map nfs client creds to nfs > server credentials. > > Following from net/sunrpc/auth_unix.c:unx_marshal() it is clear that > ->fsuid and ->fsgid must be used (rather than ->uid and ->gid). In > addition, these uid and gid must be translated with from_kuid_munged() > so local client uses correct uid and gid when acting as local server. > > Suggested-by: NeilBrown <neilb@suse.de> # to approximate unx_marshal() > Signed-off-by: Weston Andros Adamson <dros@primarydata.com> > Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> > Co-developed-by: Mike Snitzer <snitzer@kernel.org> > Signed-off-by: Mike Snitzer <snitzer@kernel.org> > --- > include/linux/sunrpc/auth.h | 4 ++++ > net/sunrpc/auth.c | 22 ++++++++++++++++++++++ > 2 files changed, 26 insertions(+) > > diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h > index 61e58327b1aa..4cfb68f511db 100644 > --- a/include/linux/sunrpc/auth.h > +++ b/include/linux/sunrpc/auth.h > @@ -11,6 +11,7 @@ > #define _LINUX_SUNRPC_AUTH_H > > #include <linux/sunrpc/sched.h> > +#include <linux/sunrpc/svcauth.h> > #include <linux/sunrpc/msg_prot.h> > #include <linux/sunrpc/xdr.h> > > @@ -184,6 +185,9 @@ int rpcauth_uptodatecred(struct rpc_task *); > int rpcauth_init_credcache(struct rpc_auth *); > void rpcauth_destroy_credcache(struct rpc_auth *); > void rpcauth_clear_credcache(struct rpc_cred_cache *); > +void rpcauth_map_clnt_to_svc_cred_local(struct rpc_clnt *clnt, > + const struct cred *, > + struct svc_cred *); > char * rpcauth_stringify_acceptor(struct rpc_cred *); > > static inline > diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c > index 04534ea537c8..3b6d91b36589 100644 > --- a/net/sunrpc/auth.c > +++ b/net/sunrpc/auth.c > @@ -17,6 +17,7 @@ > #include <linux/sunrpc/clnt.h> > #include <linux/sunrpc/gss_api.h> > #include <linux/spinlock.h> > +#include <linux/user_namespace.h> > > #include <trace/events/sunrpc.h> > > @@ -308,6 +309,27 @@ rpcauth_init_credcache(struct rpc_auth *auth) > } > EXPORT_SYMBOL_GPL(rpcauth_init_credcache); > rpcauth_map_clnt_to_svc_cred_local() needs a kdoc comment. Since it is called only from fs/nfsd/localio.c -- should this API ^^^^ reside in net/sunrpc/svcauth.c instead of net/sunrpc/auth.c ? > +void > +rpcauth_map_clnt_to_svc_cred_local(struct rpc_clnt *clnt, > + const struct cred *cred, > + struct svc_cred *svc) > +{ > + struct user_namespace *userns = clnt->cl_cred ? > + clnt->cl_cred->user_ns : &init_user_ns; > + > + memset(svc, 0, sizeof(struct svc_cred)); > + > + svc->cr_uid = KUIDT_INIT(from_kuid_munged(userns, cred->fsuid)); > + svc->cr_gid = KGIDT_INIT(from_kgid_munged(userns, cred->fsgid)); > + svc->cr_flavor = clnt->cl_auth->au_flavor; > + if (cred->group_info) > + svc->cr_group_info = get_group_info(cred->group_info); > + /* These aren't relevant for local (network is bypassed) */ > + svc->cr_principal = NULL; > + svc->cr_gss_mech = NULL; > +} > +EXPORT_SYMBOL_GPL(rpcauth_map_clnt_to_svc_cred_local); > + > char * > rpcauth_stringify_acceptor(struct rpc_cred *cred) > { > -- > 2.44.0 >
On Sun, Aug 25, 2024 at 11:17:00AM -0400, Chuck Lever wrote: > On Fri, Aug 23, 2024 at 02:14:05PM -0400, Mike Snitzer wrote: > > From: Weston Andros Adamson <dros@primarydata.com> > > > > Add new funtion rpcauth_map_clnt_to_svc_cred_local which maps a > > generic cred to a svc_cred suitable for use in nfsd. > > > > This is needed by the localio code to map nfs client creds to nfs > > server credentials. > > > > Following from net/sunrpc/auth_unix.c:unx_marshal() it is clear that > > ->fsuid and ->fsgid must be used (rather than ->uid and ->gid). In > > addition, these uid and gid must be translated with from_kuid_munged() > > so local client uses correct uid and gid when acting as local server. > > > > Suggested-by: NeilBrown <neilb@suse.de> # to approximate unx_marshal() > > Signed-off-by: Weston Andros Adamson <dros@primarydata.com> > > Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> > > Co-developed-by: Mike Snitzer <snitzer@kernel.org> > > Signed-off-by: Mike Snitzer <snitzer@kernel.org> > > --- > > include/linux/sunrpc/auth.h | 4 ++++ > > net/sunrpc/auth.c | 22 ++++++++++++++++++++++ > > 2 files changed, 26 insertions(+) > > > > diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h > > index 61e58327b1aa..4cfb68f511db 100644 > > --- a/include/linux/sunrpc/auth.h > > +++ b/include/linux/sunrpc/auth.h > > @@ -11,6 +11,7 @@ > > #define _LINUX_SUNRPC_AUTH_H > > > > #include <linux/sunrpc/sched.h> > > +#include <linux/sunrpc/svcauth.h> > > #include <linux/sunrpc/msg_prot.h> > > #include <linux/sunrpc/xdr.h> > > > > @@ -184,6 +185,9 @@ int rpcauth_uptodatecred(struct rpc_task *); > > int rpcauth_init_credcache(struct rpc_auth *); > > void rpcauth_destroy_credcache(struct rpc_auth *); > > void rpcauth_clear_credcache(struct rpc_cred_cache *); > > +void rpcauth_map_clnt_to_svc_cred_local(struct rpc_clnt *clnt, > > + const struct cred *, > > + struct svc_cred *); > > char * rpcauth_stringify_acceptor(struct rpc_cred *); > > > > static inline > > diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c > > index 04534ea537c8..3b6d91b36589 100644 > > --- a/net/sunrpc/auth.c > > +++ b/net/sunrpc/auth.c > > @@ -17,6 +17,7 @@ > > #include <linux/sunrpc/clnt.h> > > #include <linux/sunrpc/gss_api.h> > > #include <linux/spinlock.h> > > +#include <linux/user_namespace.h> > > > > #include <trace/events/sunrpc.h> > > > > @@ -308,6 +309,27 @@ rpcauth_init_credcache(struct rpc_auth *auth) > > } > > EXPORT_SYMBOL_GPL(rpcauth_init_credcache); > > > > rpcauth_map_clnt_to_svc_cred_local() needs a kdoc comment. > > Since it is called only from fs/nfsd/localio.c -- should this API > ^^^^ > reside in net/sunrpc/svcauth.c instead of net/sunrpc/auth.c ? > Yes, that makes sense. I also renamed it to svcauth_map_clnt_to_svc_cred_local Thanks.
diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h index 61e58327b1aa..4cfb68f511db 100644 --- a/include/linux/sunrpc/auth.h +++ b/include/linux/sunrpc/auth.h @@ -11,6 +11,7 @@ #define _LINUX_SUNRPC_AUTH_H #include <linux/sunrpc/sched.h> +#include <linux/sunrpc/svcauth.h> #include <linux/sunrpc/msg_prot.h> #include <linux/sunrpc/xdr.h> @@ -184,6 +185,9 @@ int rpcauth_uptodatecred(struct rpc_task *); int rpcauth_init_credcache(struct rpc_auth *); void rpcauth_destroy_credcache(struct rpc_auth *); void rpcauth_clear_credcache(struct rpc_cred_cache *); +void rpcauth_map_clnt_to_svc_cred_local(struct rpc_clnt *clnt, + const struct cred *, + struct svc_cred *); char * rpcauth_stringify_acceptor(struct rpc_cred *); static inline diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c index 04534ea537c8..3b6d91b36589 100644 --- a/net/sunrpc/auth.c +++ b/net/sunrpc/auth.c @@ -17,6 +17,7 @@ #include <linux/sunrpc/clnt.h> #include <linux/sunrpc/gss_api.h> #include <linux/spinlock.h> +#include <linux/user_namespace.h> #include <trace/events/sunrpc.h> @@ -308,6 +309,27 @@ rpcauth_init_credcache(struct rpc_auth *auth) } EXPORT_SYMBOL_GPL(rpcauth_init_credcache); +void +rpcauth_map_clnt_to_svc_cred_local(struct rpc_clnt *clnt, + const struct cred *cred, + struct svc_cred *svc) +{ + struct user_namespace *userns = clnt->cl_cred ? + clnt->cl_cred->user_ns : &init_user_ns; + + memset(svc, 0, sizeof(struct svc_cred)); + + svc->cr_uid = KUIDT_INIT(from_kuid_munged(userns, cred->fsuid)); + svc->cr_gid = KGIDT_INIT(from_kgid_munged(userns, cred->fsgid)); + svc->cr_flavor = clnt->cl_auth->au_flavor; + if (cred->group_info) + svc->cr_group_info = get_group_info(cred->group_info); + /* These aren't relevant for local (network is bypassed) */ + svc->cr_principal = NULL; + svc->cr_gss_mech = NULL; +} +EXPORT_SYMBOL_GPL(rpcauth_map_clnt_to_svc_cred_local); + char * rpcauth_stringify_acceptor(struct rpc_cred *cred) {