summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.de>2011-10-25 10:25:49 +1100
committerTrond Myklebust <Trond.Myklebust@netapp.com>2011-10-25 11:20:58 +0200
commitdc6f55e9f8dac4b6479be67c5c9128ad37bb491f (patch)
tree1c2de6c93f84f7a93c35fc73d8ffec52f98ad117
parent940aab490215424a269f93d2eba2794fc8b3e269 (diff)
downloadop-kernel-dev-dc6f55e9f8dac4b6479be67c5c9128ad37bb491f.zip
op-kernel-dev-dc6f55e9f8dac4b6479be67c5c9128ad37bb491f.tar.gz
NFS/sunrpc: don't use a credential with extra groups.
The sunrpc layer keeps a cache of recently used credentials and 'unx_match' is used to find the credential which matches the current process. However unx_match allows a match when the cached credential has extra groups at the end of uc_gids list which are not in the process group list. So if a process with a list of (say) 4 group accesses a file and gains access because of the last group in the list, then another process with the same uid and gid, and a gid list being the first tree of the gids of the original process tries to access the file, it will be granted access even though it shouldn't as the wrong rpc credential will be used. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@vger.kernel.org
-rw-r--r--net/sunrpc/auth_unix.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 4cb70dc..e50502d 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -129,6 +129,9 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
for (i = 0; i < groups ; i++)
if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
return 0;
+ if (groups < NFS_NGROUPS &&
+ cred->uc_gids[groups] != NOGROUP)
+ return 0;
return 1;
}
OpenPOWER on IntegriCloud