sragraha@redhat.com has uploaded this change for review.

View Change

FSAL_GPFS: Use setfsuid/setfsgid for credential impersonation to preserve capabilities

Non-root NFS client operations (create, mkdir, chmod, link, rename, etc.)
fail with EPERM over NFS-Ganesha with GPFS backend, but work fine directly
on the GPFS filesystem.

`fsal_set_credentials()` uses `setresuid()` to impersonate NFS client users.
This changes the effective UID from 0 to non-zero, which causes the Linux
kernel to drop all capabilities including `CAP_SYS_ADMIN`. The GPFS ioctl
interface requires `CAP_SYS_ADMIN`, so all subsequent GPFS calls fail with
EPERM.

Introduce `gpfs_set_credentials()` / `gpfs_restore_ganesha_credentials()`
using `setfsuid()` / `setfsgid()` instead. These change only the filesystem
UID/GID without touching the effective UID, so capabilities are preserved
and the GPFS ioctl succeeds.

pjdfstest POSIX suite over NFS with GPFS backend:
- Before: 45 test scripts failing
- After: 4 residual failures (unrelated to credentials)

Fixes: IBMCEPH-13445

Change-Id: Ic0ff12a2d51032262e34d5f53fa62554e137a71c
Signed-off-by: Sreedhar Agraharam <sragraha@redhat.com>
---
M src/FSAL/FSAL_GPFS/export.c
M src/FSAL/FSAL_GPFS/file.c
M src/FSAL/FSAL_GPFS/fsal_create.c
M src/FSAL/FSAL_GPFS/fsal_fileop.c
M src/FSAL/FSAL_GPFS/fsal_internal.c
M src/FSAL/FSAL_GPFS/fsal_internal.h
M src/FSAL/FSAL_GPFS/fsal_symlinks.c
7 files changed, 96 insertions(+), 40 deletions(-)

git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/26/1255426/1

To view, visit change 1255426. To unsubscribe, or for help writing mail filters, visit settings.