Re: gid & groups support

> From: Boris =?iso-8859-1?q?Herbini=E8re-S=E8ve?= <[email protected]>
> Date: Fri, 11 Jun 2004 17:05:37 +0200
> 
> > If you are using a Mac, then try this.  Otherwise, let us know more
> > precisely what the problem is--what OS, application, and error
> > message.
> 
> SFS : 0.7.2
> Server : FreeBSD-5.2.1
> Client : GNU/Linux 2.6.4

Okay, this is not the MacOS problem I was talking about, then.

> - - I added SFS on top of a working NFS server (which is still active, and 
> working well).
> 
> - - Key for server and user is OK. Excerpt of server syslog when I log in
> beren : sfssd: accepted connection from 192.168.0.2
> beren : sfsauthd: accepted user cariad from 192.168.0.2!sfsrwsd using public 
> key
> 
> (Is there a way to force public key authentication instead of SRP ?)

The file system always uses public key authentication.  SRP is only
used to download your private key and to create the symbolic link to
the self-certifying pathname.

> - - Groups on the client use LDAP (they're static on server, and have the same 
> name, gid)
> 
> $ cd /sfs/server_name/export
> $ ls -al
> drwxr-x---  10 root CSG_User      512 Mar 17 14:43 CS
> drwxrwxrwx   3 root User          512 Jun 11 15:19 Temp
> $ id
> uid=10001(cariad) gid=10025(User) groups=10017(CSG_User)
> $ cd Temp/
> $ cd ..
> $ cd CS
> bash: cd: CS/: Permission denied

Groups on the client should not matter.  Only the server matters.  If
you haven't configured things specially, the SFS server by default
determines what groups to put you in by iterating through the groups
file with getgrent ().

Can you run the command:

   id cariad

on the server to see what the output says.  Your file access should be
based on this.

Note that there is definitely some weirdness/bugginess in how FreeBSD
handles groups.  The first element of the group list is the egid, at
least for some versions of FreeBSD.  However, the RPC library does not
handle this properly, which also makes it impossible to configure the
property automaticaly.  There is supposed to be a workaround in the
code, using #define HAVE_EGID_IN_GROUPLIST in config.h.

Can you check on the server and see if HAVE_EGID_IN_GROUPLIST was
defined?  I'm guessing it is.  However, if FreeBSD fixed this bug in
5.2.1, then defining HAVE_EGID_IN_GROUPLIST would be incorrect.  You
could try commenting out the define in config.h and recompiling the
server.  That might fix your problem.

If that's the case, this is going to be annoying to work around.  I'll
need to figure out exactly which version of FreeBSD changed back to
normal behavior (since this stuff is impossible to autoconf unless
./configure runs as root).

David