shaharhoch@google.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1259020?usp=email ) Change subject: nfs4_op_restorefh: Re-evaluate request credentials in NFS4_OP_RESTOREFH ...................................................................... nfs4_op_restorefh: Re-evaluate request credentials in NFS4_OP_RESTOREFH When a client on a Root_Squash or All_Squash export switches to an unsquashed export (such as the PseudoFS root via PUTROOTFH) and restores the saved filehandle via RESTOREFH within the same COMPOUND, nfs4_op_restorefh() restores op_ctx->ctx_export and op_ctx->export_perms without re-evaluating op_ctx->creds. As a result, unsquashed uid=0 and gid=0 credentials remain active for subsequent operations in the COMPOUND, bypassing export squashing. Call nfs_req_creds(data->req) after restoring the saved export context in nfs4_op_restorefh() so caller credentials and group squashing are recomputed against the restored export permissions. Change-Id: I42951cbeb479aca95d0650521068b98037ba9ddc Signed-off-by: Shahar Hochma <shaharhoch@google.com> --- M src/Protocols/NFS/nfs4_op_restorefh.c 1 file changed, 7 insertions(+), 3 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/20/1259020/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1259020?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I42951cbeb479aca95d0650521068b98037ba9ddc Gerrit-Change-Number: 1259020 Gerrit-PatchSet: 1 Gerrit-Owner: shaharhoch@google.com