Re: Kernel nfsd doesn't impersonate the client us er?

Am 2012-07-12 21:43, schrieb Lorenzo Marcantonio:
> A while ago I asked if rsbac cooperated correctly with kernel based
> nfs. Well,
> it seems that's not the case...
>
> Using NFS4 from Linux to Linux, the uid is the same on both machine
> (uid=1000,
> by the way). Only host based authentication (no kerberos involved).
> Mounting is
> ok
>
> Trying to create a file in the exported directory (like a touch x)
> gives on the
> server (I enabled debugging for adf_rc):
>
> 0000003060|check_comp_rc(): pid 3717 (nfsd), owner 0, rc_role 999999,
> DIR rc_type 14, request CREATE -> NOT_GRANTED!
>
> 0000003061|rsbac_adf_request(): request CREATE, pid 3717, ppid 2,
> prog_name nfsd, uid 0, target_type DIR, tid Device 253:02 Inode
> 1232771217 Path /data/progetti/Appoggio, attr create_data, value FILE
> x, mode 644, result NOT_GRANTED by RC
>
> (That operation should have succeeded by the way)
>
> It seems that nfsd (a kernel thread) still run as root with the boot
> role! That would make nfs a no go with RSBAC... at least with the
> kernel server (samba for example setuids so it works fine)
>
> Any idea on this? kernel is 3.1.5-rsbac

Could you try to set a force and or initial role for nfsd?

-- 
Mit freundlichen Grüßen

Jens Kasten


http://www.kasten-edv.de
E-bikes: http://www.remsdale.de
_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac