From: Paulo Alcantara <pc@manguebit.org>
To: Enzo Matsumiya <ematsumiya@suse.de>, linux-cifs@vger.kernel.org
Cc: smfrench@gmail.com, ronniesahlberg@gmail.com,
sprasad@microsoft.com, tom@talpey.com, bharathsm@microsoft.com,
henrique.carvalho@suse.com, Enzo Matsumiya <ematsumiya@suse.de>
Subject: Re: [PATCH 1/3] cifs.upcall: fix regression with krb5 + creduid
Date: Mon, 29 Jun 2026 18:05:32 -0300 [thread overview]
Message-ID: <16d7db05ac86fa6c7820c0f4996a3fcf@manguebit.org> (raw)
In-Reply-To: <20260629202145.97856-1-ematsumiya@suse.de>
Enzo Matsumiya <ematsumiya@suse.de> writes:
> With 'mount.cifs -o sec=krb5,cruid=XXX' (where XXX > 0), get_uidgid()
> maps XXX to 0, as mount.cifs is running as root.
>
> This makes kerberos lookup for credentials for UID 0, which, if not
> existent, will fail with -ENOKEY.
>
> To fix this, simply ignore UID/GID mapping (get_uidgid() call) when
> arg->uid == 0, as cifs.upcall is already running as root anyway, and
> then kerberos will use 'uid' (which might be 0 or cruid) for lookup.
>
> Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
> Reported-by: Paulo Alcantara <pc@manguebit.org>
> Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
> ---
> cifs.upcall.c | 30 +++++++++++++++++++++---------
> 1 file changed, 21 insertions(+), 9 deletions(-)
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
prev parent reply other threads:[~2026-06-29 21:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-29 20:21 [PATCH 1/3] cifs.upcall: fix regression with krb5 + creduid Enzo Matsumiya
2026-06-29 20:21 ` [PATCH 2/3] cifs.upcall: namespace-aware key authority Enzo Matsumiya
2026-06-29 20:21 ` [PATCH 3/3] cifs.upcall: add support for different PID namespaces Enzo Matsumiya
2026-06-29 21:05 ` Paulo Alcantara [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16d7db05ac86fa6c7820c0f4996a3fcf@manguebit.org \
--to=pc@manguebit.org \
--cc=bharathsm@microsoft.com \
--cc=ematsumiya@suse.de \
--cc=henrique.carvalho@suse.com \
--cc=linux-cifs@vger.kernel.org \
--cc=ronniesahlberg@gmail.com \
--cc=smfrench@gmail.com \
--cc=sprasad@microsoft.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox