shaharhoch@google.com has uploaded this change for review.
nfs4_op_restorefh: Re-evaluate request credentials in NFS4_OP_RESTOREFH
When a client on a Root_Squash or All_Squash export switches to an
unsquashed export (such as the PseudoFS root via PUTROOTFH) and restores
the saved filehandle via RESTOREFH within the same COMPOUND,
nfs4_op_restorefh() restores op_ctx->ctx_export and op_ctx->export_perms
without re-evaluating op_ctx->creds. As a result, unsquashed uid=0 and
gid=0 credentials remain active for subsequent operations in the
COMPOUND, bypassing export squashing.
Call nfs_req_creds(data->req) after restoring the saved export context
in nfs4_op_restorefh() so caller credentials and group squashing are
recomputed against the restored export permissions.
Change-Id: I42951cbeb479aca95d0650521068b98037ba9ddc
Signed-off-by: Shahar Hochma <shaharhoch@google.com>
---
M src/Protocols/NFS/nfs4_op_restorefh.c
1 file changed, 7 insertions(+), 3 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/20/1259020/1
To view, visit change 1259020. To unsubscribe, or for help writing mail filters, visit settings.