2018-07-18 12:48:46

by Steve Dickson

Subject: [PATCH] rpc.gssd: truncates 32-bit UIDs/GIDs to 16 bits architectures.

utils/gssd_proc.c uses SYS_setresuid and SYS_setresgid in
change_identity when it should use SYS_setresuid32 and
SYS_setresgid32 instead. This causes it to truncate
UIDs/GIDs > 65536.

Fixes: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1779962
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1595927

Tested-by: James Ettle <[email protected]>
Tested-by: Sree <[email protected]>
Signed-off-by: Steve Dickson <[email protected]>
---
utils/gssd/gssd_proc.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
index 8767e26..7a57c4e 100644
--- a/utils/gssd/gssd_proc.c
+++ b/utils/gssd/gssd_proc.c
@@ -434,6 +434,7 @@ static int
change_identity(uid_t uid)
{
struct passwd *pw;
+ int res;

/* drop list of supplimentary groups first */
if (syscall(SYS_setgroups, 0, 0) != 0) {
@@ -459,14 +460,23 @@ change_identity(uid_t uid)
* send a signal to all other threads to synchronize the uid in all
* other threads. To bypass this, we have to call syscall() directly.
*/
- if (syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
+#ifdef __NR_setresuid32
+ res = syscall(SYS_setresgid32, pw->pw_gid, pw->pw_gid, pw->pw_gid);
+#else
+ res = syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid);
+#endif
+ if (res != 0) {
printerr(0, "WARNING: failed to set gid to %u!\n", pw->pw_gid);
return errno;
}

- if (syscall(SYS_setresuid, uid, uid, uid) != 0) {
- printerr(0, "WARNING: Failed to setuid for user with uid %u\n",
- uid);
+#ifdef __NR_setresuid32
+ res = syscall(SYS_setresuid32, uid, uid, uid);
+#else
+ res = syscall(SYS_setresuid, uid, uid, uid);
+#endif
+ if (res != 0) {
+ printerr(0, "WARNING: Failed to setuid for user with uid %u\n", uid);
return errno;
}

--
2.17.1

2018-07-18 13:10:47

by Christoph Hellwig

Subject: Re: [PATCH] rpc.gssd: truncates 32-bit UIDs/GIDs to 16 bits architectures.

> - if (syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
> +#ifdef __NR_setresuid32
> + res = syscall(SYS_setresgid32, pw->pw_gid, pw->pw_gid, pw->pw_gid);
> +#else
> + res = syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid);
> +#endif

I think you want to simply call setresuid/setresgid from glibcs, which
will do the right thing instead of doing hand crafted syscalls.

2018-07-18 15:04:31

by Steve Dickson

Subject: Re: [PATCH] rpc.gssd: truncates 32-bit UIDs/GIDs to 16 bits architectures.

On 07/18/2018 08:33 AM, Christoph Hellwig wrote:
>> - if (syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
>> +#ifdef __NR_setresuid32
>> + res = syscall(SYS_setresgid32, pw->pw_gid, pw->pw_gid, pw->pw_gid);
>> +#else
>> + res = syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid);
>> +#endif
>
> I think you want to simply call setresuid/setresgid from glibcs, which
> will do the right thing instead of doing hand crafted syscalls.
Here is the comment above these calls

/* Switch the UIDs and GIDs. */
/* For the threaded version we have to set uid,gid per thread instead
* of per process. glibc setresuid() when called from a thread, it'll
* send a signal to all other threads to synchronize the uid in all
* other threads. To bypass this, we have to call syscall() directly.
*/

steved.

2018-07-18 16:06:10

by Steve Dickson

Subject: Re: [PATCH] rpc.gssd: truncates 32-bit UIDs/GIDs to 16 bits architectures.

On 07/18/2018 08:11 AM, Steve Dickson wrote:
> utils/gssd_proc.c uses SYS_setresuid and SYS_setresgid in
> change_identity when it should use SYS_setresuid32 and
> SYS_setresgid32 instead. This causes it to truncate
> UIDs/GIDs > 65536.
>
> Fixes: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1779962
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1595927
>
> Tested-by: James Ettle <[email protected]>
> Tested-by: Sree <[email protected]>
> Signed-off-by: Steve Dickson <[email protected]>
Committed...

steved.
> ---
> utils/gssd/gssd_proc.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
> index 8767e26..7a57c4e 100644
> --- a/utils/gssd/gssd_proc.c
> +++ b/utils/gssd/gssd_proc.c
> @@ -434,6 +434,7 @@ static int
> change_identity(uid_t uid)
> {
> struct passwd *pw;
> + int res;
>
> /* drop list of supplimentary groups first */
> if (syscall(SYS_setgroups, 0, 0) != 0) {
> @@ -459,14 +460,23 @@ change_identity(uid_t uid)
> * send a signal to all other threads to synchronize the uid in all
> * other threads. To bypass this, we have to call syscall() directly.
> */
> - if (syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
> +#ifdef __NR_setresuid32
> + res = syscall(SYS_setresgid32, pw->pw_gid, pw->pw_gid, pw->pw_gid);
> +#else
> + res = syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid);
> +#endif
> + if (res != 0) {
> printerr(0, "WARNING: failed to set gid to %u!\n", pw->pw_gid);
> return errno;
> }
>
> - if (syscall(SYS_setresuid, uid, uid, uid) != 0) {
> - printerr(0, "WARNING: Failed to setuid for user with uid %u\n",
> - uid);
> +#ifdef __NR_setresuid32
> + res = syscall(SYS_setresuid32, uid, uid, uid);
> +#else
> + res = syscall(SYS_setresuid, uid, uid, uid);
> +#endif
> + if (res != 0) {
> + printerr(0, "WARNING: Failed to setuid for user with uid %u\n", uid);
> return errno;
> }
>
>