Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8BIT
From:   Felipe Gasper <felipe@felipegasper.com>
Mime-Version: 1.0 (1.0)
Subject: Re: Supplementary GIDs?
Date:   Tue, 26 Jul 2022 06:40:30 -0400
Message-Id: <3FBF9EC7-D337-4C0E-AF30-A6F1548ABC7C@felipegasper.com>
References: <165881171619.4359.3075025793434550604@noble.neil.brown.name>
Cc:     linux-nfs@vger.kernel.org
In-Reply-To: <165881171619.4359.3075025793434550604@noble.neil.brown.name>
To:     NeilBrown <neilb@suse.de>
Precedence: bulk


> On Jul 26, 2022, at 01:02, NeilBrown <neilb@suse.de> wrote:
> 
> ﻿On Sun, 24 Jul 2022, Felipe Gasper wrote:
>> Hello,
>> 
>>    I’m seeing two different behaviours between kernel NFS server versions in AlmaLinux 8 and Ubuntu 20. The following Perl demonstrates the issue:
>> 
>> --------
>> perl -MFile::Temp -Mautodie -Mstrict -e'my $fh = File::Temp::tempfile( DIR => "/the/nfs/mount" ); my $mailgid = getgrnam "mail"; my ($uid, $gid) = (getpwnam "bin")[2,3]; chown $uid, $gid, $fh; $) = "$gid $mailgid"; $> = $uid; chown -1, $mailgid, $fh'
>> --------
>> 
>>    What this does, as root, is:
>> 
>> 1) Creates a file under /mnt, then deletes it, leaving the Linux file descriptor open.
>> 
>> 2) chowns the file to bin:bin.
>> 
>> 3) Sets the process’s EUID & GUID to bin & bin/mail.
>> 
>> 4) Does fchown( fd, -1, mailgid ).
>> 
>>    When the server is AlmaLinux 8, the above works. When the server is Ubuntu 20, it fails with EPERM. (The client is AlmaLinux 8 in both cases.) Both are configured identically.
>> 
>>    Does anyone know of anything that changed fairly recently in the kernel’s NFS server that might affect this? I’ve done a packet capture and confirmed that in both cases there’s an NFS SETATTR sent in an RPC 2.4 packet whose UID & GIDs match the process.
>> 
> 
> Is mountd on Ubuntu running with "--manage-gids"??  And is mountd on
> AlmaLinux running without that flag?
> 
> That would explain the difference.

Hi Neil,

That is precisely the difference—thank you!

cheers,
-Felipe