d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add two sysctl(8) to enable/disable NFSv4 server to check when setting

Browse Source 
user nobody and/or setting group nogroup as owner of a file or directory.
Usually at the client side, if there is an username that is not in the
client's passwd database, some clients will send 'nobody@<your.dns.domain>'
in the wire and the NFSv4 server will treat it as an ERROR.
However, if you have a valid user nobody in your passwd database,
the NFSv4 server will treat it as a NFSERR_BADOWNER as its believes the
client doesn't has the username mapped.

Submitted by:	Loic Blot <loic.blot@unix-experience.fr>
Reviewed by:	rmacklem
Approved by:	rmacklem
MFC after:	2 weeks
This commit is contained in:
Marcelo Araujo 2014-10-16 02:24:19 +00:00
parent ca6505b818
commit 3dd6b7ff3d
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sys/fs/nfsserver/nfs_nfsdsubs.c
View File

@ -66,6 +66,16 @@ SYSCTL_INT(_vfs_nfsd, OID_AUTO, disable_checkutf8, CTLFLAG_RW,
&disable_checkutf8, 0,
"Disable the NFSv4 check for a UTF8 compliant name");
static int enable_nobodycheck = 1;
SYSCTL_INT(_vfs_nfsd, OID_AUTO, enable_nobodycheck, CTLFLAG_RW,
&enable_nobodycheck, 0,
"Enable the NFSv4 check when setting user nobody as owner");
static int enable_nogroupcheck = 1;
SYSCTL_INT(_vfs_nfsd, OID_AUTO, enable_nogroupcheck, CTLFLAG_RW,
&enable_nogroupcheck, 0,
"Enable the NFSv4 check when setting group nogroup as owner");
static char nfsrv_hexdigit(char, int *);
/*
@ -1543,8 +1553,10 @@ nfsrv_checkuidgid(struct nfsrv_descript *nd, struct nfsvattr *nvap)
*/
if (NFSVNO_NOTSETUID(nvap) && NFSVNO_NOTSETGID(nvap))
goto out;
if ((NFSVNO_ISSETUID(nvap) && nvap->na_uid == nfsrv_defaultuid)
|| (NFSVNO_ISSETGID(nvap) && nvap->na_gid == nfsrv_defaultgid)) {
if ((NFSVNO_ISSETUID(nvap) && nvap->na_uid == nfsrv_defaultuid &&
enable_nobodycheck == 1)
|| (NFSVNO_ISSETGID(nvap) && nvap->na_gid == nfsrv_defaultgid &&
enable_nogroupcheck == 1)) {
error = NFSERR_BADOWNER;
goto out;
}