|
| 1 | +From 80c4d726a5c5eeab9b9cfb47692ceec25f444d3b Mon Sep 17 00:00:00 2001 |
| 2 | +From: Ritvik Budhiraja <rbudhiraja@microsoft.com> |
| 3 | +Date: Tue, 19 Nov 2024 06:07:58 +0000 |
| 4 | +Subject: [PATCH] CIFS.upcall to accomodate new namespace mount opt |
| 5 | + |
| 6 | +NOTE: This patch is dependent on one of the previously sent patches: |
| 7 | +[PATCH] CIFS: New mount option for cifs.upcall namespace resolution |
| 8 | +which introduces a new mount option called upcall_target, to |
| 9 | +customise the upcall behaviour. |
| 10 | + |
| 11 | +Building upon the above patch, the following patch adds functionality |
| 12 | +to handle upcall_target as a mount option in cifs.upcall. It can have 2 values - |
| 13 | +mount, app. |
| 14 | +Having this new mount option allows the mount command to specify where the |
| 15 | +upcall should happen: 'mount' for resolving the upcall to the host |
| 16 | +namespace, and 'app' for resolving the upcall to the ns of the calling |
| 17 | +thread. This will enable both the scenarios where the Kerberos credentials |
| 18 | +can be found on the application namespace or the host namespace to which |
| 19 | +just the mount operation is "delegated". |
| 20 | +This aids use cases like Kubernetes where the mount |
| 21 | +happens on behalf of the application in another container altogether. |
| 22 | + |
| 23 | +Signed-off-by: Ritvik Budhiraja <rbudhiraja@microsoft.com> |
| 24 | +Signed-off-by: Steve French <stfrench@microsoft.com> |
| 25 | +--- |
| 26 | + cifs.upcall.c | 55 +++++++++++++++++++++++++++++++++++++++++++-------- |
| 27 | + 1 file changed, 47 insertions(+), 8 deletions(-) |
| 28 | + |
| 29 | +diff --git a/cifs.upcall.c b/cifs.upcall.c |
| 30 | +index ad04301..1885273 100644 |
| 31 | +--- a/cifs.upcall.c |
| 32 | ++++ b/cifs.upcall.c |
| 33 | +@@ -801,6 +801,13 @@ struct decoded_args { |
| 34 | + #define MAX_USERNAME_SIZE 256 |
| 35 | + char username[MAX_USERNAME_SIZE + 1]; |
| 36 | + |
| 37 | ++#define MAX_UPCALL_STRING_LEN 6 /* "mount\0" */ |
| 38 | ++ enum upcall_target_enum { |
| 39 | ++ UPTARGET_UNSPECIFIED, /* not specified, defaults to app */ |
| 40 | ++ UPTARGET_MOUNT, /* upcall to the mount namespace */ |
| 41 | ++ UPTARGET_APP, /* upcall to the application namespace which did the mount */ |
| 42 | ++ } upcall_target; |
| 43 | ++ |
| 44 | + uid_t uid; |
| 45 | + uid_t creduid; |
| 46 | + pid_t pid; |
| 47 | +@@ -817,6 +824,7 @@ struct decoded_args { |
| 48 | + #define DKD_HAVE_PID 0x20 |
| 49 | + #define DKD_HAVE_CREDUID 0x40 |
| 50 | + #define DKD_HAVE_USERNAME 0x80 |
| 51 | ++#define DKD_HAVE_UPCALL_TARGET 0x100 |
| 52 | + #define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC) |
| 53 | + int have; |
| 54 | + }; |
| 55 | +@@ -827,6 +835,7 @@ __decode_key_description(const char *desc, struct decoded_args *arg) |
| 56 | + size_t len; |
| 57 | + char *pos; |
| 58 | + const char *tkn = desc; |
| 59 | ++ arg->upcall_target = UPTARGET_UNSPECIFIED; |
| 60 | + |
| 61 | + do { |
| 62 | + pos = index(tkn, ';'); |
| 63 | +@@ -925,6 +934,31 @@ __decode_key_description(const char *desc, struct decoded_args *arg) |
| 64 | + } |
| 65 | + arg->have |= DKD_HAVE_VERSION; |
| 66 | + syslog(LOG_DEBUG, "ver=%d", arg->ver); |
| 67 | ++ } else if (strncmp(tkn, "upcall_target=", 14) == 0) { |
| 68 | ++ if (pos == NULL) |
| 69 | ++ len = strlen(tkn); |
| 70 | ++ else |
| 71 | ++ len = pos - tkn; |
| 72 | ++ |
| 73 | ++ len -= 14; |
| 74 | ++ if (len > MAX_UPCALL_STRING_LEN) { |
| 75 | ++ syslog(LOG_ERR, "upcall_target= value too long for buffer"); |
| 76 | ++ return 1; |
| 77 | ++ } |
| 78 | ++ if (strncmp(tkn + 14, "mount", 5) == 0) { |
| 79 | ++ arg->upcall_target = UPTARGET_MOUNT; |
| 80 | ++ syslog(LOG_DEBUG, "upcall_target=mount"); |
| 81 | ++ } else if (strncmp(tkn + 14, "app", 3) == 0) { |
| 82 | ++ arg->upcall_target = UPTARGET_APP; |
| 83 | ++ syslog(LOG_DEBUG, "upcall_target=app"); |
| 84 | ++ } else { |
| 85 | ++ // Should never happen |
| 86 | ++ syslog(LOG_ERR, "Invalid upcall_target value: %s, defaulting to app", |
| 87 | ++ tkn + 14); |
| 88 | ++ arg->upcall_target = UPTARGET_APP; |
| 89 | ++ syslog(LOG_DEBUG, "upcall_target=app"); |
| 90 | ++ } |
| 91 | ++ arg->have |= DKD_HAVE_UPCALL_TARGET; |
| 92 | + } |
| 93 | + if (pos == NULL) |
| 94 | + break; |
| 95 | +@@ -1289,15 +1323,20 @@ int main(const int argc, char *const argv[]) |
| 96 | + * acceptably in containers, because we'll be looking at the correct |
| 97 | + * filesystem and have the correct network configuration. |
| 98 | + */ |
| 99 | +- rc = switch_to_process_ns(arg->pid); |
| 100 | +- if (rc == -1) { |
| 101 | +- syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno)); |
| 102 | +- rc = 1; |
| 103 | +- goto out; |
| 104 | ++ if (arg->upcall_target == UPTARGET_APP || arg->upcall_target == UPTARGET_UNSPECIFIED) { |
| 105 | ++ syslog(LOG_INFO, "upcall_target=app, switching namespaces to application thread"); |
| 106 | ++ rc = switch_to_process_ns(arg->pid); |
| 107 | ++ if (rc == -1) { |
| 108 | ++ syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno)); |
| 109 | ++ rc = 1; |
| 110 | ++ goto out; |
| 111 | ++ } |
| 112 | ++ if (trim_capabilities(env_probe)) |
| 113 | ++ goto out; |
| 114 | ++ } else { |
| 115 | ++ syslog(LOG_INFO, "upcall_target=mount, not switching namespaces to application thread"); |
| 116 | + } |
| 117 | + |
| 118 | +- if (trim_capabilities(env_probe)) |
| 119 | +- goto out; |
| 120 | + |
| 121 | + /* |
| 122 | + * The kernel doesn't pass down the gid, so we resort here to scraping |
| 123 | +@@ -1344,7 +1383,7 @@ int main(const int argc, char *const argv[]) |
| 124 | + * look at the environ file. |
| 125 | + */ |
| 126 | + env_cachename = |
| 127 | +- get_cachename_from_process_env(env_probe ? arg->pid : 0); |
| 128 | ++ get_cachename_from_process_env((env_probe && (arg->upcall_target == UPTARGET_APP)) ? arg->pid : 0); |
| 129 | + |
| 130 | + rc = setuid(uid); |
| 131 | + if (rc == -1) { |
| 132 | +-- |
| 133 | +2.34.1 |
| 134 | + |
0 commit comments