From owner-freebsd-fs@FreeBSD.ORG Tue Oct 14 10:46:27 2014 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E5A7F1E8 for ; Tue, 14 Oct 2014 10:46:27 +0000 (UTC) Received: from mail-wi0-x22a.google.com (mail-wi0-x22a.google.com [IPv6:2a00:1450:400c:c05::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 735D099F for ; Tue, 14 Oct 2014 10:46:27 +0000 (UTC) Received: by mail-wi0-f170.google.com with SMTP id hi2so11304361wib.5 for ; Tue, 14 Oct 2014 03:46:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; bh=DcCIu03I0j9R4RIPg5Hf50Sp6XHUZW4JleEUlde+08o=; b=pUiV+mXjdd+jOl40pA3vZZvrSgwARzOGZ1R/A2btiOzcEWsxe7oHolqKoO95cr+7Rs 33vkDVtlnVycDBWbIUPVIvBq8QIB74uKe/m/DH5/m53j4COz3sFU7JoA0AWiSfruynxE V818lefRtMja5kqjl+eF39yqwLr4ORNuTWAeMP0NOtizyIF5YaYGsvZqk5KsFl1KAghI kuZpA6lf5m0gHcFU7VRxZSzaA32RtUXfe8U6PQBupvafpAlo0xiRGvP8c5dO30Si14i9 TOeCAodK9a35Z4GdoUCoGOXIDIYZ3PdTJq2yeAsLbixwby61SpY4I8zwN1VaShRVkwfw vFqg== MIME-Version: 1.0 X-Received: by 10.180.88.162 with SMTP id bh2mr4550997wib.77.1413283585514; Tue, 14 Oct 2014 03:46:25 -0700 (PDT) Received: by 10.216.159.193 with HTTP; Tue, 14 Oct 2014 03:46:25 -0700 (PDT) Reply-To: araujo@FreeBSD.org In-Reply-To: References: Date: Tue, 14 Oct 2014 18:46:25 +0800 Message-ID: Subject: Re: [PATCH] disable nfsd (NFSv4) nobody/nogroup check From: Marcelo Araujo To: =?UTF-8?Q?Lo=C3=AFc_Blot?= Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: "freebsd-fs@freebsd.org" X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Oct 2014 10:46:28 -0000 Hello Blot, The patch looks reasonable. As per the email thread, seems a good approach to overcome this issue, at least for now. If Rick has no objection and no free time, I can commit the patch during this week. Best Regards, 2014-10-14 18:34 GMT+08:00 Lo=C3=AFc Blot : > Hi, > since a recent problem (see thread NFSv4 nobody issue), i think we need = a > sysctl variable to disable nobody and nogroup check into the kernel > (default enabled) > This variable is useful in some situations, like TFTP over NFS, jails > over NFS (some files like /var/db/locate.database need nobody user). > > I added vfs.nfsd.disable_nobodycheck and vfs.nfsd.disable_nogroupcheck t= o > modify NFSv4 nobody/nogroup check. > > Thanks to Rick to tell me where the problem was. > > Can you review the patch, and add it to kernel to avoid previous > mentionned issue. > > Here is my patch: > > --- sys/fs/nfsserver/nfs_nfsdsubs.c.orig 2014-10-14 12:03:50.16331150= 6 > +0200 > +++ sys/fs/nfsserver/nfs_nfsdsubs.c 2014-10-14 12:06:29.793304755 +02= 00 > @@ -62,9 +62,18 @@ > SYSCTL_DECL(_vfs_nfsd); > > static int disable_checkutf8 =3D 0; > +static int disable_nobodycheck =3D 0; > +static int disable_nogroupcheck =3D 0; > SYSCTL_INT(_vfs_nfsd, OID_AUTO, disable_checkutf8, CTLFLAG_RW, > &disable_checkutf8, 0, > "Disable the NFSv4 check for a UTF8 compliant name"); > +SYSCTL_INT(_vfs_nfsd, OID_AUTO, disable_nobodycheck, CTLFLAG_RW, > + &disable_nobodycheck, 0, > + "Disable the NFSv4 check when setting user nobody as owner"); > +SYSCTL_INT(_vfs_nfsd, OID_AUTO, disable_nogroupcheck, CTLFLAG_RW, > + &disable_nogroupcheck, 0, > + "Disable the NFSv4 check when setting group nogroup as owner"); > + > > static char nfsrv_hexdigit(char, int *); > > @@ -1543,8 +1552,8 @@ > */ > if (NFSVNO_NOTSETUID(nvap) && NFSVNO_NOTSETGID(nvap)) > goto out; > - if ((NFSVNO_ISSETUID(nvap) && nvap->na_uid =3D=3D nfsrv_defaultuid) > - || (NFSVNO_ISSETGID(nvap) && nvap->na_gid =3D=3D nfsrv_defaultg= id)) { > + if ((NFSVNO_ISSETUID(nvap) && nvap->na_uid =3D=3D nfsrv_defaultuid = && > disable_nobodycheck =3D=3D 0) > + || (NFSVNO_ISSETGID(nvap) && nvap->na_gid =3D=3D nfsrv_defaultg= id && > disable_nogroupcheck =3D=3D 0)) { > error =3D NFSERR_BADOWNER; > goto out; > } > Regards, > > Lo=C3=AFc Blot, > UNIX Systems, Network and Security Engineer > http://www.unix-experience.fr > _______________________________________________ > freebsd-fs@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-fs > To unsubscribe, send any mail to "freebsd-fs-unsubscribe@freebsd.org" --=20 --=20 Marcelo Araujo (__)araujo@FreeBSD.org \\\'',)http://www.FreeBSD.org \/ \ ^ Power To Server. .\. /_)