From 98f68e1b88cedb8b1c395e3c5925562841fe96b4 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 14 Jul 2026 21:36:52 -0400 Subject: [PATCH] import CS git cifs-utils-7.0-5.el8_10 --- ...pcall-fix-compiler-warning-with-Wvla.patch | 46 +++ ...all-fix-regression-with-krb5-creduid.patch | 383 ++++++++++++++++++ ...fs.upcall-remove-getpwuid-dependency.patch | 251 ++++++++++++ ...ocs-update-echo_interval-description.patch | 35 ++ ...s.rst-add-missing-reference-for-sssd.patch | 49 +++ ...pdate-section-about-xattr-acl-suppor.patch | 59 +++ SPECS/cifs-utils.spec | 31 +- 7 files changed, 853 insertions(+), 1 deletion(-) create mode 100644 SOURCES/cifs.upcall-fix-compiler-warning-with-Wvla.patch create mode 100644 SOURCES/cifs.upcall-fix-regression-with-krb5-creduid.patch create mode 100644 SOURCES/cifs.upcall-remove-getpwuid-dependency.patch create mode 100644 SOURCES/docs-update-echo_interval-description.patch create mode 100644 SOURCES/mount.cifs.rst-add-missing-reference-for-sssd.patch create mode 100644 SOURCES/mount.cifs.rst-update-section-about-xattr-acl-suppor.patch diff --git a/SOURCES/cifs.upcall-fix-compiler-warning-with-Wvla.patch b/SOURCES/cifs.upcall-fix-compiler-warning-with-Wvla.patch new file mode 100644 index 0000000..5ef0dc1 --- /dev/null +++ b/SOURCES/cifs.upcall-fix-compiler-warning-with-Wvla.patch @@ -0,0 +1,46 @@ +From d2f39a20d68aa55023b63e575f06941721e644c6 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 23 Jun 2026 15:06:20 -0300 +Subject: [PATCH] cifs.upcall: fix compiler warning with -Wvla +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The length value for @path array in get_uidgid() needs to be evaluated +at compile time, so replace strlen() with sizeof() when defining +PROC_PID_PATH_MAXLEN and then fix the following warning: + + cifs.upcall.c: In function ‘get_uidgid’: + cifs.upcall.c:1400:9: warning: ISO C90 forbids array ‘path’ whose size + cannot be evaluated [-Wvla] + 1400 | char path[PROC_PID_PATH_MAXLEN] = {}, buf[256]; + | ^~~~ + +Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency") +Signed-off-by: Paulo Alcantara (Red Hat) +Reviewed-by: David Howells +Cc: Enzo Matsumiya +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +--- + cifs.upcall.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/cifs.upcall.c b/cifs.upcall.c +index 01690dfcade1..11dbc6186a74 100644 +--- a/cifs.upcall.c ++++ b/cifs.upcall.c +@@ -1375,8 +1375,8 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen) + return 0; + } + +-/* cover worst case/impossible scenarios, + 1 for NUL */ +-#define PROC_PID_PATH_MAXLEN ((int)strlen("/proc/2147483647/status") + 1) ++/* cover worst case/impossible scenarios */ ++#define PROC_PID_PATH_MAXLEN ((int)sizeof("/proc/2147483647/status")) + /* max valid UID/GID is (UINT_MAX - 1) */ + #define INVALID_UIDGID UINT_MAX + +-- +2.54.0 + diff --git a/SOURCES/cifs.upcall-fix-regression-with-krb5-creduid.patch b/SOURCES/cifs.upcall-fix-regression-with-krb5-creduid.patch new file mode 100644 index 0000000..474d101 --- /dev/null +++ b/SOURCES/cifs.upcall-fix-regression-with-krb5-creduid.patch @@ -0,0 +1,383 @@ +From e9495963e0d5c26f7d0137829d8dc625130b53cc Mon Sep 17 00:00:00 2001 +From: Enzo Matsumiya +Date: Mon, 6 Jul 2026 10:55:55 -0300 +Subject: [PATCH] cifs.upcall: fix regression with krb5 + creduid + +Commit 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency") +introduced a regression when using creduid != uid (e.g. +"mount.cifs -o sec=krb5,cruid=X"), so 'uid' local var is replaced +with procfs "Uid" value (in the example, the one from mount.cifs). + +That commit ignored the fact that: + mount UID can be different from creds UID, and that calling-app + process (post-mount) can be different from both + +This patch "reverts" 972c5b5ff95e ("cifs.upcall: remove getpwuid() +dependency"); transform the "emergency"-added function get_uidgid() +into map_uidgid(), now only used to do NS UID/GID mapping. + +Also add getpwuid() back, but this time called while still on host +namespace, so any possible custom NSS module is ran as allowed by +sysadmin. + +Any scenario involving unmapped UIDs or GIDs is unsupported; this +means that any UID:GID in a child user namespace _must_ map back to +a valid and existing host UID:GID. + +Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency") +Reported-by: Paulo Alcantara (Red Hat) +Signed-off-by: Enzo Matsumiya +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +--- + cifs.upcall.c | 279 ++++++++++++++++++++++++++++++++------------------ + 1 file changed, 177 insertions(+), 102 deletions(-) + +Index: cifs-utils-7.0/cifs.upcall.c +=================================================================== +--- cifs-utils-7.0.orig/cifs.upcall.c ++++ cifs-utils-7.0/cifs.upcall.c +@@ -52,6 +52,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1264,118 +1265,170 @@ static int ip_to_fqdn(const char *addrst + return 0; + } + +-/* cover worst case/impossible scenarios */ +-#define PROC_PID_PATH_MAXLEN ((int)sizeof("/proc/2147483647/status")) +-/* max valid UID/GID is (UINT_MAX - 1) */ +-#define INVALID_UIDGID UINT_MAX ++#define ID_MAP_PATH_MAX ((int)sizeof("/proc/2147483647/uid_map")) + +-/* +- * get_uidgid - Get @pid's (real) UID and/or GID. +- * @pid: process to get UID/GID from +- * @uidp: pointer to store @pid's UID (can be NULL) +- * @gidp: pointer to store @pid's GID (can be NULL) +- * +- * Extract "Uid:" and "Gid:" fields from /proc/@pid/status. +- * Do so based on whether @uidp or @gidp are NULL. +- * +- * This function assumes we're on the same namespace as @pid. +- * +- * Return: 0 on success, -1 otherwise (errno set). +- * +- * On errors, *@uidp and *@gidp are set to INVALID_UIDGID. +- */ +-static int get_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp) ++static int map_id(pid_t pid, const char *map, unsigned int *idp) + { +- char path[PROC_PID_PATH_MAXLEN] = {}, buf[256]; ++ unsigned long long ns_start, host_start, range; ++ char map_path[ID_MAP_PATH_MAX]; ++ int map_path_size = sizeof(map_path); ++ unsigned int id; + FILE *fp = NULL; +- int ret; ++ int ret = 1; + +- errno = 0; +- if (pid < 0 || (!uidp && !gidp)) { +- errno = EINVAL; +- return -1; +- } +- +- if (uidp) +- *uidp = INVALID_UIDGID; +- +- if (gidp) +- *gidp = INVALID_UIDGID; ++ errno = EINVAL; ++ if (pid < 0 || !map || !idp || *idp == UINT_MAX) ++ goto out; + +- ret = snprintf(path, PROC_PID_PATH_MAXLEN, "/proc/%d/status", pid); +- if (ret < 0 || ret >= PROC_PID_PATH_MAXLEN) { +- if (!errno) ++ ret = snprintf(map_path, map_path_size, "/proc/%d/%s", pid, map); ++ if (ret < 0 || ret >= map_path_size) { ++ if (ret >= map_path_size) + errno = ENAMETOOLONG; +- return -1; ++ ret = 1; ++ goto out; + } + +- fp = fopen(path, "r"); +- if (!fp) { +- ret = -1; ++ ret = 1; ++ fp = fopen(map_path, "r"); ++ if (!fp) + goto out; +- } + +- /* Parse /proc/pid/status fields */ +- errno = 0; +- ret = -1; +- while (fgets(buf, 256, fp)) { +- unsigned long long val; ++ /* ++ * The map files have the same format: ++ * ++ * ... ( = (*@idp - ) + ++ * ++ * - IDs: [0, UINT_MAX - 1] ++ * - range: [1, UINT_MAX], where range == UINT_MAX requires both ID ranges to start at 0, ++ * which then means this is an init host NS mapping (and that's ok) ++ * ++ * The formula itself would be enough to "validate" a matching NS ID, but we don't want to ++ * keep parsing a malformed map file, no matter how unlikely/impossible it is to happen. ++ * Same reason values are parsed as 'unsigned long long', so we can check for bogus data. ++ */ ++ id = UINT_MAX; ++ errno = ENODATA; ++ while (fscanf(fp, "%llu %llu %llu", &ns_start, &host_start, &range) == 3) { ++ if (ns_start >= UINT_MAX || host_start >= UINT_MAX || ++ range > UINT_MAX || range == 0) { ++ errno = EINVAL; ++ ret = 1; ++ break; ++ } + +- errno = ENODATA; +- if ((!uidp || strncmp(buf, "Uid:", 4)) && (!gidp || strncmp(buf, "Gid:", 4))) +- continue; ++ if (range == UINT_MAX && (ns_start != 0 || host_start != 0)) { ++ errno = EINVAL; ++ ret = 1; ++ break; ++ } + +- errno = 0; ++ if (host_start + range > UINT_MAX || ns_start + range > UINT_MAX) { ++ errno = EINVAL; ++ ret = 1; ++ break; ++ } + + /* +- * Example line format (same for both Uid/Gid): +- * "Uid:\t%u\t%u\%u\%u" ++ * Check if host ID fits this line. ++ * Our desired NS ID may be in any line of the file. + * +- * Where the numbers represents: +- * ++ * Note: new{uid,gid}map tools (that creates the map files) don't allow multiple ++ * maps (NS IDs) to the same host ID. + * +- * We're only interested in the value. ++ * If we get a match here, we'll save it, but we continue parsing the file. ++ * If we happen to find a duplicate, it's possible this is a rogue file trying to ++ * bypass these checks. + * +- * (field names "Uid:"/"Gid:" parsed above, skip it) ++ * In such cases, discard the match and return EOPNOTSUPP, as returning a ++ * successful match could lead to disastrous results. + */ +- ret = sscanf(&buf[0] + 4, "%llu", &val); +- if (ret != 1) { +- ret = -1; +- if (errno) ++ if (*idp >= host_start && *idp < host_start + range) { ++ /* This means we found a duplicate */ ++ if (!ret) { ++ ret = 1; ++ errno = EOPNOTSUPP; ++ syslog(LOG_ERR, "%s has multiple mapped IDs for %u (unsupported)", ++ map, *idp); + break; +- continue; +- } +- +- ret = -1; +- if (val >= UINT_MAX) { +- errno = EINVAL; +- break; +- } +- +- if (uidp && !strncmp(buf, "Uid:", 4)) +- *uidp = (uid_t)val; +- else +- *gidp = (gid_t)val; ++ } + +- if ((!uidp || *uidp != INVALID_UIDGID) && (!gidp || *gidp != INVALID_UIDGID)) { +- errno = 0; ++ id = (*idp - host_start) + ns_start; + ret = 0; +- break; ++ errno = 0; + } + } ++ ++ /* This means errno was reset by fscanf() without finding anything */ ++ if (ret && errno == 0) ++ errno = ENODATA; + out: +- if (fp) ++ if (fp) { ++ int err = errno; ++ + fclose(fp); ++ /* Ignore fclose() errors */ ++ errno = err; ++ } + +- if (ret) { +- syslog(LOG_DEBUG, "%s(pid=%d): %s", __func__, pid, strerror(errno)); +- if (uidp) +- *uidp = INVALID_UIDGID; ++ if (!ret) { ++ *idp = id; ++ errno = 0; ++ } else { ++ syslog(LOG_DEBUG, "%s(pid=%d, map=%s, id=%u): %s", __func__, pid, map, *idp, ++ strerror(errno)); ++ } ++ ++ return ret; ++} ++ ++/* ++ * map_uidgid() - Map (real) UID/GID from init host NS to user NS. ++ * @pid: host NS PID ++ * @uidp: (in) host UID, (out) NS UID ++ * @gidp: (in) host GID, (out) NS GID ++ * ++ * Parse /proc/@pid/{uid,gid}_map files to get NS UID/GID values. ++ * Since @pid is expected to be a host NS PID, this must be called before switching namespaces. ++ * ++ * Note: we can't use /proc/self here because we haven't switched NS yet, so {uid,gid}_map files ++ * would contain host NS values. ++ * ++ * Return: 0 on success, 1 otherwise (errno set). ++ */ ++static int map_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp) ++{ ++ uid_t orig_uid; ++ gid_t orig_gid; ++ int ret = 1; ++ ++ errno = EINVAL; ++ if (!uidp || !gidp) ++ goto out; ++ ++ orig_uid = *uidp; ++ orig_gid = *gidp; + +- if (gidp) +- *gidp = INVALID_UIDGID; ++ ret = map_id(pid, "uid_map", uidp); ++ if (ret) { ++ if (errno == ENODATA) ++ syslog(LOG_ERR, "UID %u not mapped in this namespace (unsupported)", ++ orig_uid); ++ goto out; + } + ++ ret = map_id(pid, "gid_map", gidp); ++ if (ret && errno == ENODATA) ++ syslog(LOG_ERR, "GID %u not mapped in this namespace (unsupported)", ++ orig_gid); ++out: ++ if (ret && errno != ENODATA) ++ syslog(LOG_ERR, "%s: %s", __func__, strerror(errno)); ++ else if (!ret) ++ syslog(LOG_DEBUG, "host %u:%u -> NS %u:%u", orig_uid, orig_gid, *uidp, *gidp); ++ + return ret; + } + +@@ -1421,6 +1474,7 @@ int main(const int argc, char *const arg + const char *oid; + uid_t uid; + gid_t gid; ++ struct passwd *pw; + char *keytab_name = NULL; + char *env_cachename = NULL; + krb5_ccache ccache = NULL; +@@ -1561,39 +1615,60 @@ int main(const int argc, char *const arg + } + + /* +- * Change to the process's namespace. This means that things will work +- * acceptably in containers, because we'll be looking at the correct +- * filesystem and have the correct network configuration. ++ * 'uid' always points to a host UID, so we must get the corresponding host GID. ++ * It's safe to call getpwuid() here because we're still on host NS, i.e. caller ++ * application has no control over custom NSS modules. ++ * ++ * FIXME: if UID is from another NS, or a subuid, this will fail on mount. + */ +- rc = switch_to_process_ns(arg->pid); +- if (rc == -1) { +- syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno)); ++ errno = 0; ++ pw = getpwuid(uid); ++ if (!pw) { ++ syslog(LOG_ERR, "failed to retrieve GID from UID %u: %s", uid, ++ strerror(errno ? errno : ENOENT)); + rc = 1; + goto out; + } + +- if (trim_capabilities(env_probe)) +- goto out; ++ gid = pw->pw_gid; + + /* + * We can't reasonably do this for root. When mounting a DFS share, + * for instance we can end up with creds being overridden, but the env + * variable left intact. ++ * ++ * Always check this before NS UID mapping. + */ + if (uid == 0) + env_probe = false; + + /* +- * FIXME: this only works if we haven't switched PID namespaces. +- * If we did, /proc/arg->pid/ might not exist, or worse, point to something else. ++ * Map host 'uid' and 'gid' to the target user NS. ++ * ++ * Any scenario that involves unmapped UIDs or primary GIDs is not supported -- we ++ * don't have, and can't find, all the info that would be necessary to find a ++ * UID/GID within all the possible NS combinations. + */ +- rc = get_uidgid(arg->pid, &uid, &gid); +- if (rc) { +- syslog(LOG_ERR, "get_uidgid (NS): %s", strerror(errno)); ++ if (!in_same_user_ns(arg->pid, getpid())) { ++ rc = map_uidgid(arg->pid, &uid, &gid); ++ if (rc) ++ goto out; ++ } ++ /* ++ * Change to the process's namespace. This means that things will work ++ * acceptably in containers, because we'll be looking at the correct ++ * filesystem and have the correct network configuration. ++ */ ++ rc = switch_to_process_ns(arg->pid); ++ if (rc == -1) { ++ syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno)); + rc = 1; + goto out; + } + ++ if (trim_capabilities(env_probe)) ++ goto out; ++ + rc = setgid(gid); + if (rc) { + syslog(LOG_ERR, "setgid: %s", strerror(errno)); diff --git a/SOURCES/cifs.upcall-remove-getpwuid-dependency.patch b/SOURCES/cifs.upcall-remove-getpwuid-dependency.patch new file mode 100644 index 0000000..6003d03 --- /dev/null +++ b/SOURCES/cifs.upcall-remove-getpwuid-dependency.patch @@ -0,0 +1,251 @@ +From 972c5b5ff95e3e812bc8daa72d0383654ab0dba7 Mon Sep 17 00:00:00 2001 +From: Enzo Matsumiya +Date: Mon, 15 Jun 2026 14:25:22 -0300 +Subject: [PATCH] cifs.upcall: remove getpwuid() dependency + +This patch removes getpwuid() and resort to getting UID/GID from + /proc/pid/status + +Changes: +- add get_uidgid() helper +- drop supplementary groups (i.e. move setgroups(0, NULL)) before even + decoding spnego key -- those are never needed in any case + +Signed-off-by: Enzo Matsumiya +Reported-by: Shaomin Chen +Acked-by: Paulo Alcantara (Red Hat) +Acked-by: Pavel Shilovskiy +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +--- + cifs.upcall.c | 180 ++++++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 145 insertions(+), 35 deletions(-) + +diff --git a/cifs.upcall.c b/cifs.upcall.c +index 52c03280dbe0..ae3294dd61f0 100644 +--- a/cifs.upcall.c ++++ b/cifs.upcall.c +@@ -51,7 +51,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -1265,6 +1264,121 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen) + return 0; + } + ++/* cover worst case/impossible scenarios, + 1 for NUL */ ++#define PROC_PID_PATH_MAXLEN ((int)strlen("/proc/2147483647/status") + 1) ++/* max valid UID/GID is (UINT_MAX - 1) */ ++#define INVALID_UIDGID UINT_MAX ++ ++/* ++ * get_uidgid - Get @pid's (real) UID and/or GID. ++ * @pid: process to get UID/GID from ++ * @uidp: pointer to store @pid's UID (can be NULL) ++ * @gidp: pointer to store @pid's GID (can be NULL) ++ * ++ * Extract "Uid:" and "Gid:" fields from /proc/@pid/status. ++ * Do so based on whether @uidp or @gidp are NULL. ++ * ++ * This function assumes we're on the same namespace as @pid. ++ * ++ * Return: 0 on success, -1 otherwise (errno set). ++ * ++ * On errors, *@uidp and *@gidp are set to INVALID_UIDGID. ++ */ ++static int get_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp) ++{ ++ char path[PROC_PID_PATH_MAXLEN] = {}, buf[256]; ++ FILE *fp = NULL; ++ int ret; ++ ++ errno = 0; ++ if (pid < 0 || (!uidp && !gidp)) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ if (uidp) ++ *uidp = INVALID_UIDGID; ++ ++ if (gidp) ++ *gidp = INVALID_UIDGID; ++ ++ ret = snprintf(path, PROC_PID_PATH_MAXLEN, "/proc/%d/status", pid); ++ if (ret < 0 || ret >= PROC_PID_PATH_MAXLEN) { ++ if (!errno) ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ ++ fp = fopen(path, "r"); ++ if (!fp) { ++ ret = -1; ++ goto out; ++ } ++ ++ /* Parse /proc/pid/status fields */ ++ errno = 0; ++ ret = -1; ++ while (fgets(buf, 256, fp)) { ++ unsigned long long val; ++ ++ errno = ENODATA; ++ if ((!uidp || strncmp(buf, "Uid:", 4)) && (!gidp || strncmp(buf, "Gid:", 4))) ++ continue; ++ ++ errno = 0; ++ ++ /* ++ * Example line format (same for both Uid/Gid): ++ * "Uid:\t%u\t%u\%u\%u" ++ * ++ * Where the numbers represents: ++ * ++ * ++ * We're only interested in the value. ++ * ++ * (field names "Uid:"/"Gid:" parsed above, skip it) ++ */ ++ ret = sscanf(&buf[0] + 4, "%llu", &val); ++ if (ret != 1) { ++ ret = -1; ++ if (errno) ++ break; ++ continue; ++ } ++ ++ ret = -1; ++ if (val >= UINT_MAX) { ++ errno = EINVAL; ++ break; ++ } ++ ++ if (uidp && !strncmp(buf, "Uid:", 4)) ++ *uidp = (uid_t)val; ++ else ++ *gidp = (gid_t)val; ++ ++ if ((!uidp || *uidp != INVALID_UIDGID) && (!gidp || *gidp != INVALID_UIDGID)) { ++ errno = 0; ++ ret = 0; ++ break; ++ } ++ } ++out: ++ if (fp) ++ fclose(fp); ++ ++ if (ret) { ++ syslog(LOG_DEBUG, "%s(pid=%d): %s", __func__, pid, strerror(errno)); ++ if (uidp) ++ *uidp = INVALID_UIDGID; ++ ++ if (gidp) ++ *gidp = INVALID_UIDGID; ++ } ++ ++ return ret; ++} ++ + /* walk a string and lowercase it in-place */ + static void + lowercase_string(char *c) +@@ -1306,10 +1420,10 @@ int main(const int argc, char *const argv[]) + struct decoded_args *arg = NULL; + const char *oid; + uid_t uid; ++ gid_t gid; + char *keytab_name = NULL; + char *env_cachename = NULL; + krb5_ccache ccache = NULL; +- struct passwd *pw; + unsigned expire_time = DNS_RESOLVER_DEFAULT_TIMEOUT; + const char *key_descr = NULL; + +@@ -1396,6 +1510,17 @@ int main(const int argc, char *const argv[]) + * Otherwise, it's a spnego key request + */ + ++ /* ++ * We don't need supplementary groups, ever. ++ * Drop them ASAP. ++ */ ++ rc = setgroups(0, NULL); ++ if (rc == -1) { ++ syslog(LOG_ERR, "setgroups: %s", strerror(errno)); ++ rc = 1; ++ goto out; ++ } ++ + rc = decode_key_description(buf, &arg); + free(buf); + if (rc) { +@@ -1450,38 +1575,6 @@ int main(const int argc, char *const argv[]) + if (trim_capabilities(env_probe)) + goto out; + +- /* +- * The kernel doesn't pass down the gid, so we resort here to scraping +- * one out of the passwd nss db. Note that this might not reflect the +- * actual gid of the process that initiated the upcall. While we could +- * scrape that out of /proc, relying on that is a bit more risky. +- */ +- pw = getpwuid(uid); +- if (!pw) { +- syslog(LOG_ERR, "Unable to find pw entry for uid %d: %s\n", +- uid, strerror(errno)); +- rc = 1; +- goto out; +- } +- +- /* +- * The kernel should send down a zero-length grouplist already, but +- * just to be on the safe side... +- */ +- rc = setgroups(0, NULL); +- if (rc == -1) { +- syslog(LOG_ERR, "setgroups: %s", strerror(errno)); +- rc = 1; +- goto out; +- } +- +- rc = setgid(pw->pw_gid); +- if (rc == -1) { +- syslog(LOG_ERR, "setgid: %s", strerror(errno)); +- rc = 1; +- goto out; +- } +- + /* + * We can't reasonably do this for root. When mounting a DFS share, + * for instance we can end up with creds being overridden, but the env +@@ -1490,6 +1583,24 @@ int main(const int argc, char *const argv[]) + if (uid == 0) + env_probe = false; + ++ /* ++ * FIXME: this only works if we haven't switched PID namespaces. ++ * If we did, /proc/arg->pid/ might not exist, or worse, point to something else. ++ */ ++ rc = get_uidgid(arg->pid, &uid, &gid); ++ if (rc) { ++ syslog(LOG_ERR, "get_uidgid (NS): %s", strerror(errno)); ++ rc = 1; ++ goto out; ++ } ++ ++ rc = setgid(gid); ++ if (rc) { ++ syslog(LOG_ERR, "setgid: %s", strerror(errno)); ++ rc = 1; ++ goto out; ++ } ++ + /* + * Must do this before setuid, as we need elevated capabilities to + * look at the environ file. diff --git a/SOURCES/docs-update-echo_interval-description.patch b/SOURCES/docs-update-echo_interval-description.patch new file mode 100644 index 0000000..7343130 --- /dev/null +++ b/SOURCES/docs-update-echo_interval-description.patch @@ -0,0 +1,35 @@ +From 4d87803f386764ed0b5949ccf70fc684b744b83a Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 25 Nov 2025 17:58:29 -0300 +Subject: [PATCH] docs: update echo_interval description + +It is '3 * echo_interval' since upstream commit f2caf901c1b7 ("cifs: +Fix a race condition with cifs_echo_request"). + +Reported-by: Alexandros Panagiotou +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: Steve French +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +--- + mount.cifs.rst | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mount.cifs.rst b/mount.cifs.rst +index 9eee7d5afc06..52fe492a5d37 100644 +--- a/mount.cifs.rst ++++ b/mount.cifs.rst +@@ -484,8 +484,8 @@ echo_interval=n + sets the interval at which echo requests are sent to the server on an + idling connection. This setting also affects the time required for a + connection to an unresponsive server to timeout. Here n is the echo +- interval in seconds. The reconnection happens at twice the value of the +- echo_interval set for an unresponsive server. ++ interval in seconds. The reconnection happens at three times the ++ value of the echo_interval set for an unresponsive server. + If this option is not given then the default value of 60 seconds is used. + The minimum tunable value is 1 second and maximum can go up to 600 seconds. + +-- +2.53.0 + diff --git a/SOURCES/mount.cifs.rst-add-missing-reference-for-sssd.patch b/SOURCES/mount.cifs.rst-add-missing-reference-for-sssd.patch new file mode 100644 index 0000000..f5dbe18 --- /dev/null +++ b/SOURCES/mount.cifs.rst-add-missing-reference-for-sssd.patch @@ -0,0 +1,49 @@ +From e7ec0032898d855be144c0cdc9d9e3f78ae01bf2 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Sun, 10 Mar 2024 22:24:24 -0300 +Subject: [PATCH 1/2] mount.cifs.rst: add missing reference for sssd + +Reference sssd in mount.cifs(8) as it can be used instead of winbind +via cifs.idmap utility. It's also enabled by default in most systems. + +Signed-off-by: Paulo Alcantara (Red Hat) +--- + mount.cifs.rst | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/mount.cifs.rst b/mount.cifs.rst +index 3becf200e038..64127b23cf17 100644 +--- a/mount.cifs.rst ++++ b/mount.cifs.rst +@@ -773,10 +773,10 @@ specified in the following Microsoft TechNet document: + In order to map SIDs to/from UIDs and GIDs, the following is required: + + - a kernel upcall to the ``cifs.idmap`` utility set up via request-key.conf(5) +-- winbind support configured via nsswitch.conf(5) and smb.conf(5) ++- winbind or sssd support configured via nsswitch.conf(5) + +-Please refer to the respective manpages of cifs.idmap(8) and +-winbindd(8) for more information. ++Please refer to the respective manpages of cifs.idmap(8), winbindd(8) ++and sssd(8) for more information. + + Security descriptors for a file object can be retrieved and set + directly using extended attribute named ``system.cifs_acl``. The +@@ -792,10 +792,10 @@ Some of the things to consider while using this mount option: + - The mapping between a CIFS/NTFS ACL and POSIX file permission bits + is imperfect and some ACL information may be lost in the + translation. +-- If either upcall to cifs.idmap is not setup correctly or winbind is +- not configured and running, ID mapping will fail. In that case uid +- and gid will default to either to those values of the share or to +- the values of uid and/or gid mount options if specified. ++- If either upcall to cifs.idmap is not setup correctly or winbind or ++ sssd is not configured and running, ID mapping will fail. In that ++ case uid and gid will default to either to those values of the share ++ or to the values of uid and/or gid mount options if specified. + + ********************************** + ACCESSING FILES WITH BACKUP INTENT +-- +2.44.0 + diff --git a/SOURCES/mount.cifs.rst-update-section-about-xattr-acl-suppor.patch b/SOURCES/mount.cifs.rst-update-section-about-xattr-acl-suppor.patch new file mode 100644 index 0000000..8cb506c --- /dev/null +++ b/SOURCES/mount.cifs.rst-update-section-about-xattr-acl-suppor.patch @@ -0,0 +1,59 @@ +From 4718e09e4b15b957bf9d729793bc3de7caad8134 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Sun, 10 Mar 2024 22:24:25 -0300 +Subject: [PATCH 2/2] mount.cifs.rst: update section about xattr/acl support + +Update section about required xattr/acl support for UID/GID mapping. + +Signed-off-by: Paulo Alcantara (Red Hat) +--- + mount.cifs.rst | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/mount.cifs.rst b/mount.cifs.rst +index 64127b23cf17..d82a13c932b3 100644 +--- a/mount.cifs.rst ++++ b/mount.cifs.rst +@@ -321,11 +321,12 @@ soft + noacl + Do not allow POSIX ACL operations even if server would support them. + +- The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to Samba +- servers version 3.0.10 and later. Setting POSIX ACLs requires enabling +- both ``CIFS_XATTR`` and then ``CIFS_POSIX`` support in the CIFS +- configuration options when building the cifs module. POSIX ACL support +- can be disabled on a per mount basis by specifying ``noacl`` on mount. ++ The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to ++ Samba servers version 3.0.10 and later. Setting POSIX ACLs requires ++ enabling both ``CONFIG_CIFS_XATTR`` and then ``CONFIG_CIFS_POSIX`` ++ support in the CIFS configuration options when building the cifs ++ module. POSIX ACL support can be disabled on a per mount basis by ++ specifying ``noacl`` on mount. + + cifsacl + This option is used to map CIFS/NTFS ACLs to/from Linux permission +@@ -762,8 +763,19 @@ bits, and POSIX ACL as user authentication model. This is the most + common authentication model for CIFS servers and is the one used by + Windows. + +-Support for this requires both CIFS_XATTR and CIFS_ACL support in the +-CIFS configuration options when building the cifs module. ++Support for this requires cifs kernel module built with both ++``CONFIG_CIFS_XATTR`` and ``CONFIG_CIFS_ACL`` options enabled. Since ++Linux 5.3, ``CONFIG_CIFS_ACL`` option no longer exists as CIFS/NTFS ++ACL support is always built into cifs kernel module. ++ ++Most distribution kernels will already have those options enabled by ++default, but you can still check if they are enabled with:: ++ ++ cat /lib/modules/$(uname -r)/build/.config ++ ++Alternatively, if kernel is configured with ``CONFIG_IKCONFIG_PROC``:: ++ ++ zcat /proc/config.gz + + A CIFS/NTFS ACL is mapped to file permission bits using an algorithm + specified in the following Microsoft TechNet document: +-- +2.44.0 + diff --git a/SPECS/cifs-utils.spec b/SPECS/cifs-utils.spec index 1b75181..89268d4 100644 --- a/SPECS/cifs-utils.spec +++ b/SPECS/cifs-utils.spec @@ -3,7 +3,7 @@ Name: cifs-utils Version: 7.0 -Release: 1%{pre_release}%{?dist} +Release: 5%{pre_release}%{?dist} Summary: Utilities for mounting and managing CIFS mounts Group: System Environment/Daemons @@ -19,6 +19,12 @@ Requires(preun): /usr/sbin/alternatives Source0: https://download.samba.org/pub/linux-cifs/cifs-utils/%{name}-%{version}.tar.bz2 Patch1: 0001-Use-explicit-usr-bin-python3.patch +Patch2: mount.cifs.rst-add-missing-reference-for-sssd.patch +Patch3: mount.cifs.rst-update-section-about-xattr-acl-suppor.patch +Patch4: docs-update-echo_interval-description.patch +Patch5: cifs.upcall-remove-getpwuid-dependency.patch +Patch6: cifs.upcall-fix-compiler-warning-with-Wvla.patch +Patch7: cifs.upcall-fix-regression-with-krb5-creduid.patch %description The SMB/CIFS protocol is a standard file sharing protocol widely deployed @@ -54,6 +60,12 @@ provide these credentials to the kernel automatically at login. %prep %setup -q -n %{name}-%{version}%{pre_release} %patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 %build autoreconf -i @@ -113,6 +125,23 @@ fi %{_mandir}/man8/pam_cifscreds.8.gz %changelog +* Tue Jul 7 2026 Paulo Alcantara - 7.0-5 +- resolves: RHEL-192933 - fix krb5 mount regression + +* Thu Jun 25 2026 Paulo Alcantara - 7.0-4 +- cifs.upcall: remove getpwuid dependency +- cifs.upcall: fix compiler warning with -Wvla +- Resolves: RHEL-185759 - Fix CVE-2026-12505 + +* Thu Feb 19 2026 Paulo Alcantara - 7.0-3 +- docs: update echo_interval description +- Resolves: RHEL-80397 + +* Thu Jun 13 2024 Paulo Alcantara - 7.0-2 +- mount.cifs.rst: add missing reference for sssd +- mount.cifs.rst: update section about xattr/acl support +- Resolves: RHEL-41059 + * Mon Jan 30 2023 Pavel Filipenský - 7.0-1 - Update to cifs-utils-7.0 - Resolves: rhbz#2163373