SUNRPC: Use the client user namespace when encoding creds

When encoding AUTH_UNIX creds and AUTH_GSS upcalls, use the user namespace
of the process that created the rpc client.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index c055edfec55e9542f4bb516e3b7515ef99239cd6..5dc2aef2232a3e27f5323d64731a5c1b97ecb89d 100644 (file)
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -412,7 +412,10 @@ gss_upcall_callback(struct rpc_task *task)
 
 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
 {
-       uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);
+       struct user_namespace *userns = gss_msg->auth->client->cl_cred ?
+               gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;
+
+       uid_t uid = from_kuid_munged(userns, gss_msg->uid);
        memcpy(gss_msg->databuf, &uid, sizeof(uid));
        gss_msg->msg.data = gss_msg->databuf;
        gss_msg->msg.len = sizeof(uid);
@@ -424,13 +427,15 @@ static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
                                const char *service_name,
                                const char *target_name)
 {
+       struct user_namespace *userns = gss_msg->auth->client->cl_cred ?
+               gss_msg->auth->client->cl_cred->user_ns : &init_user_ns;
        struct gss_api_mech *mech = gss_msg->auth->mech;
        char *p = gss_msg->databuf;
        size_t buflen = sizeof(gss_msg->databuf);
        int len;
 
        len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
-                       from_kuid(&init_user_ns, gss_msg->uid));
+                       from_kuid_munged(userns, gss_msg->uid));
        buflen -= len;
        p += len;
        gss_msg->msg.len = len;
@@ -706,7 +711,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
                goto err;
        }
 
-       uid = make_kuid(&init_user_ns, id);
+       uid = make_kuid(current_user_ns(), id);
        if (!uid_valid(uid)) {
                err = -EINVAL;
                goto err;

diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index d4018e5a24c52caf34b12deabb697d9ae676a613..e7df1f782b2e1f5bac4e9aba3b8b172abfe70842 100644 (file)
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -107,6 +107,8 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr)
        __be32          *p, *cred_len, *gidarr_len;
        int             i;
        struct group_info *gi = cred->cr_cred->group_info;
+       struct user_namespace *userns = clnt->cl_cred ?
+               clnt->cl_cred->user_ns : &init_user_ns;
 
        /* Credential */
 
@@ -122,14 +124,13 @@ unx_marshal(struct rpc_task *task, struct xdr_stream *xdr)
        p = xdr_reserve_space(xdr, 3 * sizeof(*p));
        if (!p)
                goto marshal_failed;
-       *p++ = cpu_to_be32(from_kuid(&init_user_ns, cred->cr_cred->fsuid));
-       *p++ = cpu_to_be32(from_kgid(&init_user_ns, cred->cr_cred->fsgid));
+       *p++ = cpu_to_be32(from_kuid_munged(userns, cred->cr_cred->fsuid));
+       *p++ = cpu_to_be32(from_kgid_munged(userns, cred->cr_cred->fsgid));
 
        gidarr_len = p++;
        if (gi)
                for (i = 0; i < UNX_NGROUPS && i < gi->ngroups; i++)
-                       *p++ = cpu_to_be32(from_kgid(&init_user_ns,
-                                                    gi->gid[i]));
+                       *p++ = cpu_to_be32(from_kgid_munged(userns, gi->gid[i]));
        *gidarr_len = cpu_to_be32(p - gidarr_len - 1);
        *cred_len = cpu_to_be32((p - cred_len - 1) << 2);
        p = xdr_reserve_space(xdr, (p - gidarr_len - 1) << 2);