SOURCES/cifs.upcall-fix-compiler-warning-with-Wvla.patch

@@ -1,46 +0,0 @@
-From d2f39a20d68aa55023b63e575f06941721e644c6 Mon Sep 17 00:00:00 2001
-From: Paulo Alcantara <pc@manguebit.org>
-Date: Tue, 23 Jun 2026 15:06:20 -0300
-Subject: [PATCH] cifs.upcall: fix compiler warning with -Wvla
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The length value for @path array in get_uidgid() needs to be evaluated
-at compile time, so replace strlen() with sizeof() when defining
-PROC_PID_PATH_MAXLEN and then fix the following warning:
-
- cifs.upcall.c: In function ‘get_uidgid’:
- cifs.upcall.c:1400:9: warning: ISO C90 forbids array ‘path’ whose size
- cannot be evaluated [-Wvla]
-  1400 |         char path[PROC_PID_PATH_MAXLEN] = {}, buf[256];
-       |         ^~~~
-
-Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
-Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
-Reviewed-by: David Howells <dhowells@redhat.com>
-Cc: Enzo Matsumiya <ematsumiya@suse.de>
-Cc: linux-cifs@vger.kernel.org
-Signed-off-by: Steve French <stfrench@microsoft.com>
----
- cifs.upcall.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/cifs.upcall.c b/cifs.upcall.c
-index 01690dfcade1..11dbc6186a74 100644
---- a/cifs.upcall.c
-+++ b/cifs.upcall.c
-@@ -1375,8 +1375,8 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen)
- 	return 0;
- }
- 
--/* cover worst case/impossible scenarios, + 1 for NUL */
--#define PROC_PID_PATH_MAXLEN	((int)strlen("/proc/2147483647/status") + 1)
-+/* cover worst case/impossible scenarios */
-+#define PROC_PID_PATH_MAXLEN	((int)sizeof("/proc/2147483647/status"))
- /* max valid UID/GID is (UINT_MAX - 1) */
- #define INVALID_UIDGID		UINT_MAX
- 
--- 
-2.54.0
-

SOURCES/cifs.upcall-fix-regression-with-krb5-creduid.patch

@@ -1,383 +0,0 @@
-From e9495963e0d5c26f7d0137829d8dc625130b53cc Mon Sep 17 00:00:00 2001
-From: Enzo Matsumiya <ematsumiya@suse.de>
-Date: Mon, 6 Jul 2026 10:55:55 -0300
-Subject: [PATCH] cifs.upcall: fix regression with krb5 + creduid
-
-Commit 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
-introduced a regression when using creduid != uid (e.g.
-"mount.cifs -o sec=krb5,cruid=X"), so 'uid' local var is replaced
-with procfs "Uid" value (in the example, the one from mount.cifs).
-
-That commit ignored the fact that:
-  mount UID can be different from creds UID, and that calling-app
-  process (post-mount) can be different from both
-
-This patch "reverts" 972c5b5ff95e ("cifs.upcall: remove getpwuid()
-dependency"); transform the "emergency"-added function get_uidgid()
-into map_uidgid(), now only used to do NS UID/GID mapping.
-
-Also add getpwuid() back, but this time called while still on host
-namespace, so any possible custom NSS module is ran as allowed by
-sysadmin.
-
-Any scenario involving unmapped UIDs or GIDs is unsupported; this
-means that any UID:GID in a child user namespace _must_ map back to
-a valid and existing host UID:GID.
-
-Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
-Reported-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
-Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
-Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
-Signed-off-by: Steve French <stfrench@microsoft.com>
----
- cifs.upcall.c | 279 ++++++++++++++++++++++++++++++++------------------
- 1 file changed, 177 insertions(+), 102 deletions(-)
-
-Index: cifs-utils-7.0/cifs.upcall.c
-===================================================================
---- cifs-utils-7.0.orig/cifs.upcall.c
-+++ cifs-utils-7.0/cifs.upcall.c
-@@ -52,6 +52,7 @@
- #include <arpa/inet.h>
- #include <ctype.h>
- #include <grp.h>
-+#include <pwd.h>
- #include <stdbool.h>
- #include <errno.h>
- #include <sched.h>
-@@ -1264,118 +1265,170 @@ static int ip_to_fqdn(const char *addrst
- 	return 0;
- }
- 
--/* cover worst case/impossible scenarios */
--#define PROC_PID_PATH_MAXLEN	((int)sizeof("/proc/2147483647/status"))
--/* max valid UID/GID is (UINT_MAX - 1) */
--#define INVALID_UIDGID		UINT_MAX
-+#define ID_MAP_PATH_MAX ((int)sizeof("/proc/2147483647/uid_map"))
- 
--/*
-- * get_uidgid - Get @pid's (real) UID and/or GID.
-- * @pid: process to get UID/GID from
-- * @uidp: pointer to store @pid's UID (can be NULL)
-- * @gidp: pointer to store @pid's GID (can be NULL)
-- *
-- * Extract "Uid:" and "Gid:" fields from /proc/@pid/status.
-- * Do so based on whether @uidp or @gidp are NULL.
-- *
-- * This function assumes we're on the same namespace as @pid.
-- *
-- * Return: 0 on success, -1 otherwise (errno set).
-- *
-- * On errors, *@uidp and *@gidp are set to INVALID_UIDGID.
-- */
--static int get_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp)
-+static int map_id(pid_t pid, const char *map, unsigned int *idp)
- {
--	char path[PROC_PID_PATH_MAXLEN] = {}, buf[256];
-+	unsigned long long ns_start, host_start, range;
-+	char map_path[ID_MAP_PATH_MAX];
-+	int map_path_size = sizeof(map_path);
-+	unsigned int id;
- 	FILE *fp = NULL;
--	int ret;
-+	int ret = 1;
- 
--	errno = 0;
--	if (pid < 0 || (!uidp && !gidp)) {
--		errno = EINVAL;
--		return -1;
--	}
--
--	if (uidp)
--		*uidp = INVALID_UIDGID;
--
--	if (gidp)
--		*gidp = INVALID_UIDGID;
-+	errno = EINVAL;
-+	if (pid < 0 || !map || !idp || *idp == UINT_MAX)
-+		goto out;
- 
--	ret = snprintf(path, PROC_PID_PATH_MAXLEN, "/proc/%d/status", pid);
--	if (ret < 0 || ret >= PROC_PID_PATH_MAXLEN) {
--		if (!errno)
-+	ret = snprintf(map_path, map_path_size, "/proc/%d/%s", pid, map);
-+	if (ret < 0 || ret >= map_path_size) {
-+		if (ret >= map_path_size)
- 			errno = ENAMETOOLONG;
--		return -1;
-+		ret = 1;
-+		goto out;
- 	}
- 
--	fp = fopen(path, "r");
--	if (!fp) {
--		ret = -1;
-+	ret = 1;
-+	fp = fopen(map_path, "r");
-+	if (!fp)
- 		goto out;
--	}
- 
--	/* Parse /proc/pid/status fields */
--	errno = 0;
--	ret = -1;
--	while (fgets(buf, 256, fp)) {
--		unsigned long long val;
-+	/*
-+	 * The map files have the same format:
-+	 *   <NS ID start> <host ID start> <range>
-+	 *   ... (<multiple entries are supported) ...
-+	 *
-+	 * Formula and validation:
-+	 *   <final NS ID> = (*@idp - <host ID start>) + <NS ID start>
-+	 *
-+	 * - IDs: [0, UINT_MAX - 1]
-+	 * - range: [1, UINT_MAX], where range == UINT_MAX requires both ID ranges to start at 0,
-+	 *   which then means this is an init host NS mapping (and that's ok)
-+	 *
-+	 * The formula itself would be enough to "validate" a matching NS ID, but we don't want to
-+	 * keep parsing a malformed map file, no matter how unlikely/impossible it is to happen.
-+	 * Same reason values are parsed as 'unsigned long long', so we can check for bogus data.
-+	 */
-+	id = UINT_MAX;
-+	errno = ENODATA;
-+	while (fscanf(fp, "%llu %llu %llu", &ns_start, &host_start, &range) == 3) {
-+		if (ns_start >= UINT_MAX || host_start >= UINT_MAX ||
-+		    range > UINT_MAX || range == 0) {
-+			errno = EINVAL;
-+			ret = 1;
-+			break;
-+		}
- 
--		errno = ENODATA;
--		if ((!uidp || strncmp(buf, "Uid:", 4)) && (!gidp || strncmp(buf, "Gid:", 4)))
--			continue;
-+		if (range == UINT_MAX && (ns_start != 0 || host_start != 0)) {
-+			errno = EINVAL;
-+			ret = 1;
-+			break;
-+		}
- 
--		errno = 0;
-+		if (host_start + range > UINT_MAX || ns_start + range > UINT_MAX) {
-+			errno = EINVAL;
-+			ret = 1;
-+			break;
-+		}
- 
- 		/*
--		 * Example line format (same for both Uid/Gid):
--		 * "Uid:\t%u\t%u\%u\%u"
-+		 * Check if host ID fits this line.
-+		 * Our desired NS ID may be in any line of the file.
- 		 *
--		 * Where the numbers represents:
--		 * <real> <effective> <saved> <fsuid>
-+		 * Note: new{uid,gid}map tools (that creates the map files) don't allow multiple
-+		 * maps (NS IDs) to the same host ID.
- 		 *
--		 * We're only interested in the <real> value.
-+		 * If we get a match here, we'll save it, but we continue parsing the file.
-+		 * If we happen to find a duplicate, it's possible this is a rogue file trying to
-+		 * bypass these checks.
- 		 *
--		 * (field names "Uid:"/"Gid:" parsed above, skip it)
-+		 * In such cases, discard the match and return EOPNOTSUPP, as returning a
-+		 * successful match could lead to disastrous results.
- 		 */
--		ret = sscanf(&buf[0] + 4, "%llu", &val);
--		if (ret != 1) {
--			ret = -1;
--			if (errno)
-+		if (*idp >= host_start && *idp < host_start + range) {
-+			/* This means we found a duplicate */
-+			if (!ret) {
-+				ret = 1;
-+				errno = EOPNOTSUPP;
-+				syslog(LOG_ERR, "%s has multiple mapped IDs for %u (unsupported)",
-+				       map, *idp);
- 				break;
--			continue;
--		}
--
--		ret = -1;
--		if (val >= UINT_MAX) {
--			errno = EINVAL;
--			break;
--		}
--
--		if (uidp && !strncmp(buf, "Uid:", 4))
--			*uidp = (uid_t)val;
--		else
--			*gidp = (gid_t)val;
-+			}
- 
--		if ((!uidp || *uidp != INVALID_UIDGID) && (!gidp || *gidp != INVALID_UIDGID)) {
--			errno = 0;
-+			id = (*idp - host_start) + ns_start;
- 			ret = 0;
--			break;
-+			errno = 0;
- 		}
- 	}
-+
-+	/* This means errno was reset by fscanf() without finding anything */
-+	if (ret && errno == 0)
-+		errno = ENODATA;
- out:
--	if (fp)
-+	if (fp) {
-+		int err = errno;
-+
- 		fclose(fp);
-+		/* Ignore fclose() errors */
-+		errno = err;
-+	}
- 
--	if (ret) {
--		syslog(LOG_DEBUG, "%s(pid=%d): %s", __func__, pid, strerror(errno));
--		if (uidp)
--			*uidp = INVALID_UIDGID;
-+	if (!ret) {
-+		*idp = id;
-+		errno = 0;
-+	} else {
-+		syslog(LOG_DEBUG, "%s(pid=%d, map=%s, id=%u): %s", __func__, pid, map, *idp,
-+		       strerror(errno));
-+	}
-+
-+	return ret;
-+}
-+
-+/*
-+ * map_uidgid() - Map (real) UID/GID from init host NS to user NS.
-+ * @pid: host NS PID
-+ * @uidp: (in) host UID, (out) NS UID
-+ * @gidp: (in) host GID, (out) NS GID
-+ *
-+ * Parse /proc/@pid/{uid,gid}_map files to get NS UID/GID values.
-+ * Since @pid is expected to be a host NS PID, this must be called before switching namespaces.
-+ *
-+ * Note: we can't use /proc/self here because we haven't switched NS yet, so {uid,gid}_map files
-+ * would contain host NS values.
-+ *
-+ * Return: 0 on success, 1 otherwise (errno set).
-+ */
-+static int map_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp)
-+{
-+	uid_t orig_uid;
-+	gid_t orig_gid;
-+	int ret = 1;
-+
-+	errno = EINVAL;
-+	if (!uidp || !gidp)
-+		goto out;
-+
-+	orig_uid = *uidp;
-+	orig_gid = *gidp;
- 
--		if (gidp)
--			*gidp = INVALID_UIDGID;
-+	ret = map_id(pid, "uid_map", uidp);
-+	if (ret) {
-+		if (errno == ENODATA)
-+			syslog(LOG_ERR, "UID %u not mapped in this namespace (unsupported)",
-+			       orig_uid);
-+		goto out;
- 	}
- 
-+	ret = map_id(pid, "gid_map", gidp);
-+	if (ret && errno == ENODATA)
-+		syslog(LOG_ERR, "GID %u not mapped in this namespace (unsupported)",
-+		       orig_gid);
-+out:
-+	if (ret && errno != ENODATA)
-+		syslog(LOG_ERR, "%s: %s", __func__, strerror(errno));
-+	else if (!ret)
-+		syslog(LOG_DEBUG, "host %u:%u -> NS %u:%u", orig_uid, orig_gid, *uidp, *gidp);
-+
- 	return ret;
- }
- 
-@@ -1421,6 +1474,7 @@ int main(const int argc, char *const arg
- 	const char *oid;
- 	uid_t uid;
- 	gid_t gid;
-+	struct passwd *pw;
- 	char *keytab_name = NULL;
- 	char *env_cachename = NULL;
- 	krb5_ccache ccache = NULL;
-@@ -1561,39 +1615,60 @@ int main(const int argc, char *const arg
- 	}
- 
- 	/*
--	 * Change to the process's namespace. This means that things will work
--	 * acceptably in containers, because we'll be looking at the correct
--	 * filesystem and have the correct network configuration.
-+	 * 'uid' always points to a host UID, so we must get the corresponding host GID.
-+	 * It's safe to call getpwuid() here because we're still on host NS, i.e. caller
-+	 * application has no control over custom NSS modules.
-+	 *
-+	 * FIXME: if UID is from another NS, or a subuid, this will fail on mount.
- 	 */
--	rc = switch_to_process_ns(arg->pid);
--	if (rc == -1) {
--		syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno));
-+	errno = 0;
-+	pw = getpwuid(uid);
-+	if (!pw) {
-+		syslog(LOG_ERR, "failed to retrieve GID from UID %u: %s", uid,
-+		       strerror(errno ? errno : ENOENT));
- 		rc = 1;
- 		goto out;
- 	}
- 
--	if (trim_capabilities(env_probe))
--		goto out;
-+	gid = pw->pw_gid;
- 
- 	/*
- 	 * We can't reasonably do this for root. When mounting a DFS share,
- 	 * for instance we can end up with creds being overridden, but the env
- 	 * variable left intact.
-+	 *
-+	 * Always check this before NS UID mapping.
- 	 */
- 	if (uid == 0)
- 		env_probe = false;
- 
- 	/*
--	 * FIXME: this only works if we haven't switched PID namespaces.
--	 * If we did, /proc/arg->pid/ might not exist, or worse, point to something else.
-+	 * Map host 'uid' and 'gid' to the target user NS.
-+	 *
-+	 * Any scenario that involves unmapped UIDs or primary GIDs is not supported -- we
-+	 * don't have, and can't find, all the info that would be necessary to find a
-+	 * UID/GID within all the possible NS combinations.
- 	 */
--	rc = get_uidgid(arg->pid, &uid, &gid);
--	if (rc) {
--		syslog(LOG_ERR, "get_uidgid (NS): %s", strerror(errno));
-+	if (!in_same_user_ns(arg->pid, getpid())) {
-+		rc = map_uidgid(arg->pid, &uid, &gid);
-+		if (rc)
-+			goto out;
-+	}
-+	/*
-+	 * Change to the process's namespace. This means that things will work
-+	 * acceptably in containers, because we'll be looking at the correct
-+	 * filesystem and have the correct network configuration.
-+	 */
-+	rc = switch_to_process_ns(arg->pid);
-+	if (rc == -1) {
-+		syslog(LOG_ERR, "unable to switch to process namespace: %s", strerror(errno));
- 		rc = 1;
- 		goto out;
- 	}
- 
-+	if (trim_capabilities(env_probe))
-+		goto out;
-+
- 	rc = setgid(gid);
- 	if (rc) {
- 		syslog(LOG_ERR, "setgid: %s", strerror(errno));

SOURCES/cifs.upcall-remove-getpwuid-dependency.patch

@@ -1,251 +0,0 @@
-From 972c5b5ff95e3e812bc8daa72d0383654ab0dba7 Mon Sep 17 00:00:00 2001
-From: Enzo Matsumiya <ematsumiya@suse.de>
-Date: Mon, 15 Jun 2026 14:25:22 -0300
-Subject: [PATCH] cifs.upcall: remove getpwuid() dependency
-
-This patch removes getpwuid() and resort to getting UID/GID from
-   /proc/pid/status
-
-Changes:
-- add get_uidgid() helper
-- drop supplementary groups (i.e. move setgroups(0, NULL)) before even
-  decoding spnego key -- those are never needed in any case
-
-Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
-Reported-by: Shaomin Chen <eeesssooo020@gmail.com>
-Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
-Acked-by: Pavel Shilovskiy <pshilovskiy@microsoft.com>
-Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
----
- cifs.upcall.c | 180 ++++++++++++++++++++++++++++++++++++++++----------
- 1 file changed, 145 insertions(+), 35 deletions(-)
-
-diff --git a/cifs.upcall.c b/cifs.upcall.c
-index 52c03280dbe0..ae3294dd61f0 100644
---- a/cifs.upcall.c
-+++ b/cifs.upcall.c
-@@ -51,7 +51,6 @@
- #include <netdb.h>
- #include <arpa/inet.h>
- #include <ctype.h>
--#include <pwd.h>
- #include <grp.h>
- #include <stdbool.h>
- #include <errno.h>
-@@ -1265,6 +1264,121 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen)
- 	return 0;
- }
- 
-+/* cover worst case/impossible scenarios, + 1 for NUL */
-+#define PROC_PID_PATH_MAXLEN	((int)strlen("/proc/2147483647/status") + 1)
-+/* max valid UID/GID is (UINT_MAX - 1) */
-+#define INVALID_UIDGID		UINT_MAX
-+
-+/*
-+ * get_uidgid - Get @pid's (real) UID and/or GID.
-+ * @pid: process to get UID/GID from
-+ * @uidp: pointer to store @pid's UID (can be NULL)
-+ * @gidp: pointer to store @pid's GID (can be NULL)
-+ *
-+ * Extract "Uid:" and "Gid:" fields from /proc/@pid/status.
-+ * Do so based on whether @uidp or @gidp are NULL.
-+ *
-+ * This function assumes we're on the same namespace as @pid.
-+ *
-+ * Return: 0 on success, -1 otherwise (errno set).
-+ *
-+ * On errors, *@uidp and *@gidp are set to INVALID_UIDGID.
-+ */
-+static int get_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp)
-+{
-+	char path[PROC_PID_PATH_MAXLEN] = {}, buf[256];
-+	FILE *fp = NULL;
-+	int ret;
-+
-+	errno = 0;
-+	if (pid < 0 || (!uidp && !gidp)) {
-+		errno = EINVAL;
-+		return -1;
-+	}
-+
-+	if (uidp)
-+		*uidp = INVALID_UIDGID;
-+
-+	if (gidp)
-+		*gidp = INVALID_UIDGID;
-+
-+	ret = snprintf(path, PROC_PID_PATH_MAXLEN, "/proc/%d/status", pid);
-+	if (ret < 0 || ret >= PROC_PID_PATH_MAXLEN) {
-+		if (!errno)
-+			errno = ENAMETOOLONG;
-+		return -1;
-+	}
-+
-+	fp = fopen(path, "r");
-+	if (!fp) {
-+		ret = -1;
-+		goto out;
-+	}
-+
-+	/* Parse /proc/pid/status fields */
-+	errno = 0;
-+	ret = -1;
-+	while (fgets(buf, 256, fp)) {
-+		unsigned long long val;
-+
-+		errno = ENODATA;
-+		if ((!uidp || strncmp(buf, "Uid:", 4)) && (!gidp || strncmp(buf, "Gid:", 4)))
-+			continue;
-+
-+		errno = 0;
-+
-+		/*
-+		 * Example line format (same for both Uid/Gid):
-+		 * "Uid:\t%u\t%u\%u\%u"
-+		 *
-+		 * Where the numbers represents:
-+		 * <real> <effective> <saved> <fsuid>
-+		 *
-+		 * We're only interested in the <real> value.
-+		 *
-+		 * (field names "Uid:"/"Gid:" parsed above, skip it)
-+		 */
-+		ret = sscanf(&buf[0] + 4, "%llu", &val);
-+		if (ret != 1) {
-+			ret = -1;
-+			if (errno)
-+				break;
-+			continue;
-+		}
-+
-+		ret = -1;
-+		if (val >= UINT_MAX) {
-+			errno = EINVAL;
-+			break;
-+		}
-+
-+		if (uidp && !strncmp(buf, "Uid:", 4))
-+			*uidp = (uid_t)val;
-+		else
-+			*gidp = (gid_t)val;
-+
-+		if ((!uidp || *uidp != INVALID_UIDGID) && (!gidp || *gidp != INVALID_UIDGID)) {
-+			errno = 0;
-+			ret = 0;
-+			break;
-+		}
-+	}
-+out:
-+	if (fp)
-+		fclose(fp);
-+
-+	if (ret) {
-+		syslog(LOG_DEBUG, "%s(pid=%d): %s", __func__, pid, strerror(errno));
-+		if (uidp)
-+			*uidp = INVALID_UIDGID;
-+
-+		if (gidp)
-+			*gidp = INVALID_UIDGID;
-+	}
-+
-+	return ret;
-+}
-+
- /* walk a string and lowercase it in-place */
- static void
- lowercase_string(char *c)
-@@ -1306,10 +1420,10 @@ int main(const int argc, char *const argv[])
- 	struct decoded_args *arg = NULL;
- 	const char *oid;
- 	uid_t uid;
-+	gid_t gid;
- 	char *keytab_name = NULL;
- 	char *env_cachename = NULL;
- 	krb5_ccache ccache = NULL;
--	struct passwd *pw;
- 	unsigned expire_time = DNS_RESOLVER_DEFAULT_TIMEOUT;
- 	const char *key_descr = NULL;
- 
-@@ -1396,6 +1510,17 @@ int main(const int argc, char *const argv[])
- 	 * Otherwise, it's a spnego key request
- 	 */
- 
-+	/*
-+	 * We don't need supplementary groups, ever.
-+	 * Drop them ASAP.
-+	 */
-+	rc = setgroups(0, NULL);
-+	if (rc == -1) {
-+		syslog(LOG_ERR, "setgroups: %s", strerror(errno));
-+		rc = 1;
-+		goto out;
-+	}
-+
- 	rc = decode_key_description(buf, &arg);
- 	free(buf);
- 	if (rc) {
-@@ -1450,38 +1575,6 @@ int main(const int argc, char *const argv[])
- 	if (trim_capabilities(env_probe))
- 		goto out;
- 
--	/*
--	 * The kernel doesn't pass down the gid, so we resort here to scraping
--	 * one out of the passwd nss db. Note that this might not reflect the
--	 * actual gid of the process that initiated the upcall. While we could
--	 * scrape that out of /proc, relying on that is a bit more risky.
--	 */
--	pw = getpwuid(uid);
--	if (!pw) {
--		syslog(LOG_ERR, "Unable to find pw entry for uid %d: %s\n",
--			uid, strerror(errno));
--		rc = 1;
--		goto out;
--	}
--
--	/*
--	 * The kernel should send down a zero-length grouplist already, but
--	 * just to be on the safe side...
--	 */
--	rc = setgroups(0, NULL);
--	if (rc == -1) {
--		syslog(LOG_ERR, "setgroups: %s", strerror(errno));
--		rc = 1;
--		goto out;
--	}
--
--	rc = setgid(pw->pw_gid);
--	if (rc == -1) {
--		syslog(LOG_ERR, "setgid: %s", strerror(errno));
--		rc = 1;
--		goto out;
--	}
--
- 	/*
- 	 * We can't reasonably do this for root. When mounting a DFS share,
- 	 * for instance we can end up with creds being overridden, but the env
-@@ -1490,6 +1583,24 @@ int main(const int argc, char *const argv[])
- 	if (uid == 0)
- 		env_probe = false;
- 
-+	/*
-+	 * FIXME: this only works if we haven't switched PID namespaces.
-+	 * If we did, /proc/arg->pid/ might not exist, or worse, point to something else.
-+	 */
-+	rc = get_uidgid(arg->pid, &uid, &gid);
-+	if (rc) {
-+		syslog(LOG_ERR, "get_uidgid (NS): %s", strerror(errno));
-+		rc = 1;
-+		goto out;
-+	}
-+
-+	rc = setgid(gid);
-+	if (rc) {
-+		syslog(LOG_ERR, "setgid: %s", strerror(errno));
-+		rc = 1;
-+		goto out;
-+	}
-+
- 	/*
- 	 * Must do this before setuid, as we need elevated capabilities to
- 	 * look at the environ file.

SOURCES/docs-update-echo_interval-description.patch

@@ -1,35 +0,0 @@
-From 4d87803f386764ed0b5949ccf70fc684b744b83a Mon Sep 17 00:00:00 2001
-From: Paulo Alcantara <pc@manguebit.org>
-Date: Tue, 25 Nov 2025 17:58:29 -0300
-Subject: [PATCH] docs: update echo_interval description
-
-It is '3 * echo_interval' since upstream commit f2caf901c1b7 ("cifs:
-Fix a race condition with cifs_echo_request").
-
-Reported-by: Alexandros Panagiotou <apanagio@redhat.com>
-Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
-Cc: Steve French <smfrench@gmail.com>
-Cc: linux-cifs@vger.kernel.org
-Signed-off-by: Steve French <stfrench@microsoft.com>
----
- mount.cifs.rst | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mount.cifs.rst b/mount.cifs.rst
-index 9eee7d5afc06..52fe492a5d37 100644
---- a/mount.cifs.rst
-+++ b/mount.cifs.rst
-@@ -484,8 +484,8 @@ echo_interval=n
-   sets the interval at which echo requests are sent to the server on an
-   idling connection. This setting also affects the time required for a
-   connection to an unresponsive server to timeout. Here n is the echo
--  interval in seconds. The reconnection happens at twice the value of the
--  echo_interval set for an unresponsive server.
-+  interval in seconds. The reconnection happens at three times the
-+  value of the echo_interval set for an unresponsive server.
-   If this option is not given then the default value of 60 seconds is used.
-   The minimum tunable value is 1 second and maximum can go up to 600 seconds.
- 
--- 
-2.53.0
-

SOURCES/mount.cifs.rst-add-missing-reference-for-sssd.patch

@@ -1,49 +0,0 @@
-From e7ec0032898d855be144c0cdc9d9e3f78ae01bf2 Mon Sep 17 00:00:00 2001
-From: Paulo Alcantara <pc@manguebit.com>
-Date: Sun, 10 Mar 2024 22:24:24 -0300
-Subject: [PATCH 1/2] mount.cifs.rst: add missing reference for sssd
-
-Reference sssd in mount.cifs(8) as it can be used instead of winbind
-via cifs.idmap utility.  It's also enabled by default in most systems.
-
-Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
----
- mount.cifs.rst | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/mount.cifs.rst b/mount.cifs.rst
-index 3becf200e038..64127b23cf17 100644
---- a/mount.cifs.rst
-+++ b/mount.cifs.rst
-@@ -773,10 +773,10 @@ specified in the following Microsoft TechNet document:
- In order to map SIDs to/from UIDs and GIDs, the following is required:
- 
- - a kernel upcall to the ``cifs.idmap`` utility set up via request-key.conf(5)
--- winbind support configured via nsswitch.conf(5) and smb.conf(5)
-+- winbind or sssd support configured via nsswitch.conf(5)
- 
--Please refer to the respective manpages of cifs.idmap(8) and
--winbindd(8) for more information.
-+Please refer to the respective manpages of cifs.idmap(8), winbindd(8)
-+and sssd(8) for more information.
- 
- Security descriptors for a file object can be retrieved and set
- directly using extended attribute named ``system.cifs_acl``. The
-@@ -792,10 +792,10 @@ Some of the things to consider while using this mount option:
- - The mapping between a CIFS/NTFS ACL and POSIX file permission bits
-   is imperfect and some ACL information may be lost in the
-   translation.
--- If either upcall to cifs.idmap is not setup correctly or winbind is
--  not configured and running, ID mapping will fail. In that case uid
--  and gid will default to either to those values of the share or to
--  the values of uid and/or gid mount options if specified.
-+- If either upcall to cifs.idmap is not setup correctly or winbind or
-+  sssd is not configured and running, ID mapping will fail. In that
-+  case uid and gid will default to either to those values of the share
-+  or to the values of uid and/or gid mount options if specified.
- 
- **********************************
- ACCESSING FILES WITH BACKUP INTENT
--- 
-2.44.0
-

SOURCES/mount.cifs.rst-update-section-about-xattr-acl-suppor.patch

@@ -1,59 +0,0 @@
-From 4718e09e4b15b957bf9d729793bc3de7caad8134 Mon Sep 17 00:00:00 2001
-From: Paulo Alcantara <pc@manguebit.com>
-Date: Sun, 10 Mar 2024 22:24:25 -0300
-Subject: [PATCH 2/2] mount.cifs.rst: update section about xattr/acl support
-
-Update section about required xattr/acl support for UID/GID mapping.
-
-Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
----
- mount.cifs.rst | 26 +++++++++++++++++++-------
- 1 file changed, 19 insertions(+), 7 deletions(-)
-
-diff --git a/mount.cifs.rst b/mount.cifs.rst
-index 64127b23cf17..d82a13c932b3 100644
---- a/mount.cifs.rst
-+++ b/mount.cifs.rst
-@@ -321,11 +321,12 @@ soft
- noacl
-   Do not allow POSIX ACL operations even if server would support them.
- 
--  The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to Samba
--  servers version 3.0.10 and later. Setting POSIX ACLs requires enabling
--  both ``CIFS_XATTR`` and then ``CIFS_POSIX`` support in the CIFS
--  configuration options when building the cifs module. POSIX ACL support
--  can be disabled on a per mount basis by specifying ``noacl`` on mount.
-+  The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to
-+  Samba servers version 3.0.10 and later. Setting POSIX ACLs requires
-+  enabling both ``CONFIG_CIFS_XATTR`` and then ``CONFIG_CIFS_POSIX``
-+  support in the CIFS configuration options when building the cifs
-+  module. POSIX ACL support can be disabled on a per mount basis by
-+  specifying ``noacl`` on mount.
- 
- cifsacl
-   This option is used to map CIFS/NTFS ACLs to/from Linux permission
-@@ -762,8 +763,19 @@ bits, and POSIX ACL as user authentication model. This is the most
- common authentication model for CIFS servers and is the one used by
- Windows.
- 
--Support for this requires both CIFS_XATTR and CIFS_ACL support in the
--CIFS configuration options when building the cifs module.
-+Support for this requires cifs kernel module built with both
-+``CONFIG_CIFS_XATTR`` and ``CONFIG_CIFS_ACL`` options enabled.  Since
-+Linux 5.3, ``CONFIG_CIFS_ACL`` option no longer exists as CIFS/NTFS
-+ACL support is always built into cifs kernel module.
-+
-+Most distribution kernels will already have those options enabled by
-+default, but you can still check if they are enabled with::
-+
-+  cat /lib/modules/$(uname -r)/build/.config
-+
-+Alternatively, if kernel is configured with ``CONFIG_IKCONFIG_PROC``::
-+
-+  zcat /proc/config.gz
- 
- A CIFS/NTFS ACL is mapped to file permission bits using an algorithm
- specified in the following Microsoft TechNet document:
--- 
-2.44.0
-

SPECS/cifs-utils.spec

@@ -3,7 +3,7 @@
 
 Name:            cifs-utils
 Version:         7.0
-Release:         5%{pre_release}%{?dist}
+Release:         1%{pre_release}%{?dist}
 Summary:         Utilities for mounting and managing CIFS mounts
 
 Group:           System Environment/Daemons
@@ -19,12 +19,6 @@ Requires(preun): /usr/sbin/alternatives
 
 Source0:         https://download.samba.org/pub/linux-cifs/cifs-utils/%{name}-%{version}.tar.bz2
 Patch1:          0001-Use-explicit-usr-bin-python3.patch
-Patch2:          mount.cifs.rst-add-missing-reference-for-sssd.patch
-Patch3:          mount.cifs.rst-update-section-about-xattr-acl-suppor.patch
-Patch4:          docs-update-echo_interval-description.patch
-Patch5:          cifs.upcall-remove-getpwuid-dependency.patch
-Patch6:          cifs.upcall-fix-compiler-warning-with-Wvla.patch
-Patch7:          cifs.upcall-fix-regression-with-krb5-creduid.patch
 
 %description
 The SMB/CIFS protocol is a standard file sharing protocol widely deployed
@@ -60,12 +54,6 @@ provide these credentials to the kernel automatically at login.
 %prep
 %setup -q -n %{name}-%{version}%{pre_release}
 %patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
-%patch7 -p1
 
 %build
 autoreconf -i
@@ -125,23 +113,6 @@ fi
 %{_mandir}/man8/pam_cifscreds.8.gz
 
 %changelog
-* Tue Jul 7 2026 Paulo Alcantara <paalcant@redhat.com> - 7.0-5
-- resolves: RHEL-192933 - fix krb5 mount regression
-
-* Thu Jun 25 2026 Paulo Alcantara <paalcant@redhat.com> - 7.0-4
-- cifs.upcall: remove getpwuid dependency
-- cifs.upcall: fix compiler warning with -Wvla
-- Resolves: RHEL-185759 - Fix CVE-2026-12505
-
-* Thu Feb 19 2026 Paulo Alcantara <paalcant@redhat.com> - 7.0-3
-- docs: update echo_interval description
-- Resolves: RHEL-80397
-
-* Thu Jun 13 2024 Paulo Alcantara <paalcant@redhat.com> - 7.0-2
-- mount.cifs.rst: add missing reference for sssd
-- mount.cifs.rst: update section about xattr/acl support
-- Resolves: RHEL-41059
-
 * Mon Jan 30 2023 Pavel Filipenský <pfilipen@redhat.com> - 7.0-1
 - Update to cifs-utils-7.0
 - Resolves: rhbz#2163373