sragraha@redhat.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255426?usp=email ) Change subject: FSAL_GPFS: Use setfsuid/setfsgid for credential impersonation to preserve capabilities ...................................................................... FSAL_GPFS: Use setfsuid/setfsgid for credential impersonation to preserve capabilities Non-root NFS client operations (create, mkdir, chmod, link, rename, etc.) fail with EPERM over NFS-Ganesha with GPFS backend, but work fine directly on the GPFS filesystem. `fsal_set_credentials()` uses `setresuid()` to impersonate NFS client users. This changes the effective UID from 0 to non-zero, which causes the Linux kernel to drop all capabilities including `CAP_SYS_ADMIN`. The GPFS ioctl interface requires `CAP_SYS_ADMIN`, so all subsequent GPFS calls fail with EPERM. Introduce `gpfs_set_credentials()` / `gpfs_restore_ganesha_credentials()` using `setfsuid()` / `setfsgid()` instead. These change only the filesystem UID/GID without touching the effective UID, so capabilities are preserved and the GPFS ioctl succeeds. pjdfstest POSIX suite over NFS with GPFS backend: - Before: 45 test scripts failing - After: 4 residual failures (unrelated to credentials) Fixes: IBMCEPH-13445 Change-Id: Ic0ff12a2d51032262e34d5f53fa62554e137a71c Signed-off-by: Sreedhar Agraharam <sragraha@redhat.com> --- M src/FSAL/FSAL_GPFS/export.c M src/FSAL/FSAL_GPFS/file.c M src/FSAL/FSAL_GPFS/fsal_create.c M src/FSAL/FSAL_GPFS/fsal_fileop.c M src/FSAL/FSAL_GPFS/fsal_internal.c M src/FSAL/FSAL_GPFS/fsal_internal.h M src/FSAL/FSAL_GPFS/fsal_symlinks.c 7 files changed, 96 insertions(+), 40 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/26/1255426/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1255426?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Ic0ff12a2d51032262e34d5f53fa62554e137a71c Gerrit-Change-Number: 1255426 Gerrit-PatchSet: 1 Gerrit-Owner: sragraha@redhat.com