[PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

[PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

[Ameer Hamza]

When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
failure, e.g. while winbind or sssd is briefly unreachable), it
answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
installs that as a valid positive entry, and svcauth_unix_set_client()
then replaces the credential's group list with the empty one on
every request, RPCSEC_GSS included via svcauth_gss_set_client().
One failed lookup strips that uid of all supplementary groups on
every export for up to mountd's configured TTL (30 minutes by
default), long after the NSS backend has recovered.

mountd cannot send an empty list for a successful lookup, since
getgrouplist(3) always includes at least the user's primary group,
so a zero-group reply can only mean the lookup failed. Record it as
a negative entry: unix_gid_find() then returns -ENOENT and
svcauth_unix_set_client() keeps the groups the RPC credential
already carries. This is the fallback that
commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
gid list when using AUTH_UNIX authentication") promised when no
answer is available, and the same state try_to_negate_entry()
already creates when no listener holds the channel open.

Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid list when using AUTH_UNIX authentication")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
---
Reproducer (any server with rpc.mountd --manage-gids; 'alice' is a
member of group 'proj' *supplementary*, /srv/proj is root:proj 0750):

    runuser -u alice -- cat /mnt/proj/data          # ok
    # the reply mountd sends when getpwuid()/getgrouplist() fail:
    echo "$(id -u alice) $(( $(date +%s) + 600 )) 0" \
        > /proc/net/rpc/auth.unix.gid/channel
    runuser -u alice -- cat /mnt/proj/data          # EACCES until
                                                    # refresh/flush/expiry

Applies unmodified (fuzz 0) to every maintained stable tree, 5.10.y
through 7.1.y. Tested on a live 6.12-based server over NFSv3 and
v4.0-v4.2, with sec=sys and sec=krb5.

 net/sunrpc/svcauth_unix.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index aebd97e7f66c7..2f592ba54a366 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -540,6 +540,13 @@ static int unix_gid_parse(struct cache_detail *cd,
 	if (ugp) {
 		struct cache_head *ch;
 		ug.h.flags = 0;
+		/*
+		 * mountd sends at least the user's primary group on
+		 * success, so an empty list can only mean the lookup
+		 * failed. Keep the credential's own groups instead.
+		 */
+		if (gids == 0)
+			set_bit(CACHE_NEGATIVE, &ug.h.flags);
 		ug.h.expiry_time = expiry;
 		ch = sunrpc_cache_update(cd,
 					 &ug.h, &ugp->h,

base-commit: 46db3c8a1be96a354758b44b1d4fbb4b70d09a20
-- 
2.53.0

Re: [PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

[Chuck Lever]

On Fri, Aug 14, 2026, at 1:25 PM, Ameer Hamza wrote:
> When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
> failure, e.g. while winbind or sssd is briefly unreachable), it
> answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
> installs that as a valid positive entry, and svcauth_unix_set_client()
> then replaces the credential's group list with the empty one on
> every request, RPCSEC_GSS included via svcauth_gss_set_client().
> One failed lookup strips that uid of all supplementary groups on
> every export for up to mountd's configured TTL (30 minutes by
> default), long after the NSS backend has recovered.
>
> mountd cannot send an empty list for a successful lookup, since
> getgrouplist(3) always includes at least the user's primary group,
> so a zero-group reply can only mean the lookup failed. Record it as
> a negative entry: unix_gid_find() then returns -ENOENT and
> svcauth_unix_set_client() keeps the groups the RPC credential
> already carries. This is the fallback that
> commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
> gid list when using AUTH_UNIX authentication") promised when no
> answer is available, and the same state try_to_negate_entry()
> already creates when no listener holds the channel open.
>
> Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid 
> list when using AUTH_UNIX authentication")
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>

Looks like the same bug exists for the new mountd netlink
mechanism. Since that instance of the bug arrived in a
different commit, that fix needs to be a separate patch
with its own Fixes: tag.

Can you make this a two-patch series?


-- 
Chuck Lever

Re: [PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

[Ameer Hamza]

On Fri, Aug 14, 2026 at 04:02:23PM -0400, Chuck Lever wrote:
> 
> 
> On Fri, Aug 14, 2026, at 1:25 PM, Ameer Hamza wrote:
> > When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
> > failure, e.g. while winbind or sssd is briefly unreachable), it
> > answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
> > installs that as a valid positive entry, and svcauth_unix_set_client()
> > then replaces the credential's group list with the empty one on
> > every request, RPCSEC_GSS included via svcauth_gss_set_client().
> > One failed lookup strips that uid of all supplementary groups on
> > every export for up to mountd's configured TTL (30 minutes by
> > default), long after the NSS backend has recovered.
> >
> > mountd cannot send an empty list for a successful lookup, since
> > getgrouplist(3) always includes at least the user's primary group,
> > so a zero-group reply can only mean the lookup failed. Record it as
> > a negative entry: unix_gid_find() then returns -ENOENT and
> > svcauth_unix_set_client() keeps the groups the RPC credential
> > already carries. This is the fallback that
> > commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
> > gid list when using AUTH_UNIX authentication") promised when no
> > answer is available, and the same state try_to_negate_entry()
> > already creates when no listener holds the channel open.
> >
> > Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid 
> > list when using AUTH_UNIX authentication")
> > Assisted-by: Claude:claude-fable-5
> > Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
> 
> Looks like the same bug exists for the new mountd netlink
> mechanism. Since that instance of the bug arrived in a
> different commit, that fix needs to be a separate patch
> with its own Fixes: tag.
> 
> Can you make this a two-patch series?
> 
> 
> -- 
> Chuck Lever

Sure, will send v2 with the netlink fix as a separate patch. Thanks for taking a look.