auth.c 2.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de> */
  3. #include <linux/sched.h>
  4. #include "nfsd.h"
  5. #include "auth.h"
  6. int nfsexp_flags(struct svc_rqst *rqstp, struct svc_export *exp)
  7. {
  8. struct exp_flavor_info *f;
  9. struct exp_flavor_info *end = exp->ex_flavors + exp->ex_nflavors;
  10. for (f = exp->ex_flavors; f < end; f++) {
  11. if (f->pseudoflavor == rqstp->rq_cred.cr_flavor)
  12. return f->flags;
  13. }
  14. return exp->ex_flags;
  15. }
  16. int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
  17. {
  18. struct group_info *rqgi;
  19. struct group_info *gi;
  20. struct cred *new;
  21. int i;
  22. int flags = nfsexp_flags(rqstp, exp);
  23. validate_process_creds();
  24. /* discard any old override before preparing the new set */
  25. revert_creds(get_cred(current_real_cred()));
  26. new = prepare_creds();
  27. if (!new)
  28. return -ENOMEM;
  29. new->fsuid = rqstp->rq_cred.cr_uid;
  30. new->fsgid = rqstp->rq_cred.cr_gid;
  31. rqgi = rqstp->rq_cred.cr_group_info;
  32. if (flags & NFSEXP_ALLSQUASH) {
  33. new->fsuid = exp->ex_anon_uid;
  34. new->fsgid = exp->ex_anon_gid;
  35. gi = groups_alloc(0);
  36. if (!gi)
  37. goto oom;
  38. } else if (flags & NFSEXP_ROOTSQUASH) {
  39. if (uid_eq(new->fsuid, GLOBAL_ROOT_UID))
  40. new->fsuid = exp->ex_anon_uid;
  41. if (gid_eq(new->fsgid, GLOBAL_ROOT_GID))
  42. new->fsgid = exp->ex_anon_gid;
  43. gi = groups_alloc(rqgi->ngroups);
  44. if (!gi)
  45. goto oom;
  46. for (i = 0; i < rqgi->ngroups; i++) {
  47. if (gid_eq(GLOBAL_ROOT_GID, rqgi->gid[i]))
  48. gi->gid[i] = exp->ex_anon_gid;
  49. else
  50. gi->gid[i] = rqgi->gid[i];
  51. }
  52. /* Each thread allocates its own gi, no race */
  53. groups_sort(gi);
  54. } else {
  55. gi = get_group_info(rqgi);
  56. }
  57. if (uid_eq(new->fsuid, INVALID_UID))
  58. new->fsuid = exp->ex_anon_uid;
  59. if (gid_eq(new->fsgid, INVALID_GID))
  60. new->fsgid = exp->ex_anon_gid;
  61. set_groups(new, gi);
  62. put_group_info(gi);
  63. if (!uid_eq(new->fsuid, GLOBAL_ROOT_UID))
  64. new->cap_effective = cap_drop_nfsd_set(new->cap_effective);
  65. else
  66. new->cap_effective = cap_raise_nfsd_set(new->cap_effective,
  67. new->cap_permitted);
  68. validate_process_creds();
  69. put_cred(override_creds(new));
  70. put_cred(new);
  71. validate_process_creds();
  72. return 0;
  73. oom:
  74. abort_creds(new);
  75. return -ENOMEM;
  76. }