Kernel nfsd doesn't impersonate the client user?

Lorenzo Marcantonio <[email protected]> Thu, 12 Jul 2012 21:43:42 +0200
Newsgroups gmane.linux.rsbac
Message-ID <[email protected]>
A while ago I asked if rsbac cooperated correctly with kernel based nfs. Well,
it seems that's not the case...

Using NFS4 from Linux to Linux, the uid is the same on both machine (uid=1000,
by the way). Only host based authentication (no kerberos involved). Mounting is
ok

Trying to create a file in the exported directory (like a touch x) gives on the
server (I enabled debugging for adf_rc):

0000003060|check_comp_rc(): pid 3717 (nfsd), owner 0, rc_role 999999, DIR rc_type 14, request CREATE -> NOT_GRANTED!

0000003061|rsbac_adf_request(): request CREATE, pid 3717, ppid 2, prog_name nfsd, uid 0, target_type DIR, tid Device 253:02 Inode 1232771217 Path /data/progetti/Appoggio, attr create_data, value FILE x, mode 644, result NOT_GRANTED by RC

(That operation should have succeeded by the way)

It seems that nfsd (a kernel thread) still run as root with the boot role! That would make nfs a no go with RSBAC... at least with the kernel server (samba for example setuids so it works fine)

Any idea on this? kernel is 3.1.5-rsbac

-- 
Lorenzo Marcantonio
Logos Srl