From: "Aurélien Aptel" <aaptel@suse.com>
To: Alexander Koch <mail@alexanderkoch.net>, linux-cifs@vger.kernel.org
Subject: Re: cifs.upcall broken with cifs-utils 6.13
Date: Tue, 20 Apr 2021 18:41:00 +0200 [thread overview]
Message-ID: <87h7k0zz6r.fsf@suse.com> (raw)
In-Reply-To: <a01d5d22-5990-c00d-bc2a-582d2585ea69@alexanderkoch.net>
Hi Alexander,
Alexander Koch <mail@alexanderkoch.net> writes:
> The recent release of cifs-utils 6.13, more precisely e461afd8cf (which,
> to my understanding, is a fix for CVE-2021-20208) makes attempts of
> mounting CIFS shares with krb5 fail for me:
>
> Can anyone tell me if this is a packaging/configuration issue (Arch in
> my case) or a bug?
It's unfortunately a regression in the CVE fix. We are trying to come up
with a proper fix.
In the meantime, as a workaround:
* you can build cifs-utils --with-libcap=yes (libcap instead of libcapng). This will skip
capability dropping in cifs.upcall.c.
* Alternatively you can comment out the call to trim_capabilities() in
cifs.upcall.c.
Cheers,
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, DE
GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 247165 (AG München)
next prev parent reply other threads:[~2021-04-20 16:41 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-20 16:05 cifs.upcall broken with cifs-utils 6.13 Alexander Koch
2021-04-20 16:41 ` Aurélien Aptel [this message]
2021-04-20 17:02 ` Alexander Koch
2021-08-06 7:09 ` Alexander Koch
2021-08-06 9:02 ` Pavel Shilovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h7k0zz6r.fsf@suse.com \
--to=aaptel@suse.com \
--cc=linux-cifs@vger.kernel.org \
--cc=mail@alexanderkoch.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.