Public bug reported: In some cases, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments.
Consider the following scenario: A CIFS/SMB file share is mounted on a host node using Kerberos authentication. During the session setup phase, the Linux kernel's cifs.ko module makes an upcall to user space to retrieve the Kerberos service ticket from the credential cache. In typical (non-container) environments, this process works correctly, but in containerized environments, the upcall may be directed to a different namespace than intended, leading to issues. For example: a) The file share is mounted on the host node at /mnt/testshare1, meaning the Kerberos credential cache is stored in the host's namespace. b) A Docker container is created, and the file share path /mnt/testshare1 is exported to the container at /sharedpath. c) When the service ticket expires and the SMB connection is lost, before the ticket is refreshed in the credential cache, an application inside the container performs a file operation. This triggers the kernel to attempt a session reconnect. d) During the session setup, a Kerberos ticket is needed, so the kernel invokes the cifs.upcall binary using the request_key function. However, cifs.upcall switches to the namespace of the caller (i.e., the container), causing it to attempt to read the credential cache from the container's namespace. But since the original mount happened in the host namespace, the credential cache is located on the host, not in the container. This results in the upcall failing to access the correct credential cache or accessinng credential cache which doesn't belong to correct user. It fixed here: https://git.samba.org/?p=cifs-utils.git;a=commit;h=89b679228cc1be9739d54203d28289b03352c174 Documentation: https://git.samba.org/?p=cifs- utils.git;a=commit;h=cf63240489431e98033e599a7c9437b59494a2e4 ** Affects: cifs-utils (Ubuntu) Importance: Undecided Status: New ** Attachment added: "Repro or simulation steps" https://bugs.launchpad.net/bugs/2099914/+attachment/5860177/+files/simulate_bug.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099914 Title: cifs.upcall program in cifs-utils package incorrectly makes an upcall to different namespace in case of container environments To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099914/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
