Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "Felipe Gasper" <felipe@felipegasper.com>
Cc:     linux-nfs@vger.kernel.org
Subject: Re: Supplementary GIDs?
In-reply-to: <4A964428-65EA-49D4-B7B4-35D22D89D418@felipegasper.com>
References: <4A964428-65EA-49D4-B7B4-35D22D89D418@felipegasper.com>
Date:   Tue, 26 Jul 2022 15:01:56 +1000
Message-id: <165881171619.4359.3075025793434550604@noble.neil.brown.name>
Precedence: bulk

On Sun, 24 Jul 2022, Felipe Gasper wrote:
> Hello,
>=20
> 	I=E2=80=99m seeing two different behaviours between kernel NFS server vers=
ions in AlmaLinux 8 and Ubuntu 20. The following Perl demonstrates the issue:
>=20
> --------
> perl -MFile::Temp -Mautodie -Mstrict -e'my $fh =3D File::Temp::tempfile( DI=
R =3D> "/the/nfs/mount" ); my $mailgid =3D getgrnam "mail"; my ($uid, $gid) =
=3D (getpwnam "bin")[2,3]; chown $uid, $gid, $fh; $) =3D "$gid $mailgid"; $> =
=3D $uid; chown -1, $mailgid, $fh'
> --------
>=20
> 	What this does, as root, is:
>=20
> 1) Creates a file under /mnt, then deletes it, leaving the Linux file descr=
iptor open.
>=20
> 2) chowns the file to bin:bin.
>=20
> 3) Sets the process=E2=80=99s EUID & GUID to bin & bin/mail.
>=20
> 4) Does fchown( fd, -1, mailgid ).
>=20
> 	When the server is AlmaLinux 8, the above works. When the server is Ubuntu=
 20, it fails with EPERM. (The client is AlmaLinux 8 in both cases.) Both are=
 configured identically.
>=20
> 	Does anyone know of anything that changed fairly recently in the kernel=E2=
=80=99s NFS server that might affect this? I=E2=80=99ve done a packet capture=
 and confirmed that in both cases there=E2=80=99s an NFS SETATTR sent in an R=
PC 2.4 packet whose UID & GIDs match the process.
>=20

Is mountd on Ubuntu running with "--manage-gids"??  And is mountd on
AlmaLinux running without that flag?

That would explain the difference.

NeilBrown