Could you please test the attached patch and confirm it fixes the problems you're seeing?
-- Olivier Certner
>From ab37cd80635b52f59fbce53f942cddd79002f233 Mon Sep 17 00:00:00 2001
From: Olivier Certner <o...@freebsd.org>
Date: Sun, 3 Nov 2024 11:26:37 +0100
Subject: [PATCH] nfs: Fallback to GID_NOGROUP on no groups
We cannot unconditionally access nfsd's VNET variables in
'sys/kern/vfs_export.c' nor 'sys/fs/nfsserver/nfs_nfsdsubs.c', as they
may not have been compiled in depending on build options.
So, forget about the extra mile of using the configured default group
and use the hardcoded GID_NOGROUP (which differs only on systems running
nfsuserd(8) and with a non-default UID for their "nogroup" group).
Fixes: cfbe7a62dc62 ("nfs, rpc: Ensure kernel credentials have at least one group")
---
sys/fs/nfs/nfs_commonport.c | 3 +--
sys/fs/nfs/nfs_commonsubs.c | 2 +-
sys/kern/vfs_export.c | 9 +++------
3 files changed, 5 insertions(+), 9 deletions(-)
diff --git a/sys/fs/nfs/nfs_commonport.c b/sys/fs/nfs/nfs_commonport.c
index 11f31d1a0e9f..0c94f4e7dc52 100644
--- a/sys/fs/nfs/nfs_commonport.c
+++ b/sys/fs/nfs/nfs_commonport.c
@@ -73,11 +73,10 @@ uint32_t nfs_srvmaxio = NFS_SRVMAXIO;
NFSD_VNET_DEFINE(struct nfsstatsv1 *, nfsstatsv1_p);
NFSD_VNET_DECLARE(struct nfssockreq, nfsrv_nfsuserdsock);
NFSD_VNET_DECLARE(nfsuserd_state, nfsrv_nfsuserd);
-NFSD_VNET_DECLARE(gid_t, nfsrv_defaultgid);
int nfs_pnfsio(task_fn_t *, void *);
static int nfs_realign_test;
static int nfs_realign_count;
@@ -258,11 +257,11 @@ newnfs_copycred(struct nfscred *nfscr, struct ucred *cr)
KASSERT(nfscr->nfsc_ngroups >= 0,
("newnfs_copycred: negative nfsc_ngroups"));
cr->cr_uid = nfscr->nfsc_uid;
crsetgroups_fallback(cr, nfscr->nfsc_ngroups, nfscr->nfsc_groups,
- NFSD_VNET(nfsrv_defaultgid));
+ GID_NOGROUP);
}
/*
* Map args from nfsmsleep() to msleep().
*/
diff --git a/sys/fs/nfs/nfs_commonsubs.c b/sys/fs/nfs/nfs_commonsubs.c
index ce4b0052714e..81c558d768ea 100644
--- a/sys/fs/nfs/nfs_commonsubs.c
+++ b/sys/fs/nfs/nfs_commonsubs.c
@@ -4050,11 +4050,11 @@ nfssvc_idname(struct nfsd_idargs *nidp)
* but using the group list provided.
*/
cr = crget();
cr->cr_uid = cr->cr_ruid = cr->cr_svuid = nidp->nid_uid;
crsetgroups_fallback(cr, nidp->nid_ngroup, grps,
- NFSD_VNET(nfsrv_defaultgid));
+ GID_NOGROUP);
cr->cr_rgid = cr->cr_svgid = cr->cr_gid;
cr->cr_prison = curthread->td_ucred->cr_prison;
prison_hold(cr->cr_prison);
#ifdef MAC
mac_cred_associate_nfsd(cr);
diff --git a/sys/kern/vfs_export.c b/sys/kern/vfs_export.c
index c0337b1fe858..a314bda164de 100644
--- a/sys/kern/vfs_export.c
+++ b/sys/kern/vfs_export.c
@@ -38,10 +38,11 @@
#include "opt_inet.h"
#include "opt_inet6.h"
#include <sys/param.h>
#include <sys/systm.h>
+#include <sys/conf.h>
#include <sys/dirent.h>
#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/malloc.h>
@@ -59,14 +60,10 @@
#include <net/radix.h>
#include <rpc/types.h>
#include <rpc/auth.h>
-#include <fs/nfs/nfsport.h>
-
-NFSD_VNET_DECLARE(gid_t, nfsrv_defaultgid);
-
static MALLOC_DEFINE(M_NETADDR, "export_host", "Export host address structure");
#if defined(INET) || defined(INET6)
static struct radix_node_head *vfs_create_addrlist_af(
struct radix_node_head **prnh, int off);
@@ -136,11 +133,11 @@ vfs_hang_addrlist(struct mount *mp, struct netexport *nep,
np = &nep->ne_defexported;
np->netc_exflags = argp->ex_flags;
np->netc_anon = crget();
np->netc_anon->cr_uid = argp->ex_uid;
crsetgroups_fallback(np->netc_anon, argp->ex_ngroups,
- argp->ex_groups, NFSD_VNET(nfsrv_defaultgid));
+ argp->ex_groups, GID_NOGROUP);
np->netc_anon->cr_prison = &prison0;
prison_hold(np->netc_anon->cr_prison);
np->netc_numsecflavors = argp->ex_numsecflavors;
bcopy(argp->ex_secflavors, np->netc_secflavors,
sizeof(np->netc_secflavors));
@@ -215,11 +212,11 @@ vfs_hang_addrlist(struct mount *mp, struct netexport *nep,
}
np->netc_exflags = argp->ex_flags;
np->netc_anon = crget();
np->netc_anon->cr_uid = argp->ex_uid;
crsetgroups_fallback(np->netc_anon, argp->ex_ngroups, argp->ex_groups,
- NFSD_VNET(nfsrv_defaultgid));
+ GID_NOGROUP);
np->netc_anon->cr_prison = &prison0;
prison_hold(np->netc_anon->cr_prison);
np->netc_numsecflavors = argp->ex_numsecflavors;
bcopy(argp->ex_secflavors, np->netc_secflavors,
sizeof(np->netc_secflavors));
signature.asc
Description: This is a digitally signed message part.
