summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-04-29cifs.upcall: remove unused variable and fix syslog messageAlexander Bokovoy1-2/+1
The code already checks arg->have and has no use for local 'have' variable other than syslog() print. That variable is not initialized and the intent is really to use arg->have instead. Signed-off-by: Alexander Bokovoy <ab@samba.org>
2022-04-29cifs.upcall: Switch to RFC principal type namingMichael Weiser1-1/+1
Switch from old-style MIT krb5 gss_nt_service_name principal type constant name to the now preferred GSS_C_NT_HOSTBASED_SERVICE. Signed-off-by: Michael Weiser <michael.weiser@atos.net>
2022-04-29man-pages: Update cifs.upcall to mention GSS_USE_PROXYJacob Shivers1-0/+9
Add ENVIRONMENT VARIABLES section with the usage of gssproxy as a credential retrieval method. Signed-off-by: Jacob Shivers <jshivers@redhat.com>
2022-04-29cifs.upcall: fix compiler warningRonnie Sahlberg1-1/+5
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
2022-04-29cifs.upcall: add gssproxy supportMichael Weiser2-20/+155
Add support for gssproxy usage through GSS-API. If no useable ticket cache or keytab can be found, fall on through into credential handling anyway but then divert into GSS routines. If no gssproxy is available this will still error out silently because no ticket cache is available. With gssproxy enabled, credentials can be retrieved from there and allow unattended access to shares e.g. from batch jobs. Signed-off-by: Michael Weiser <michael.weiser@atos.net>
2022-04-29cifs-utils: bump version to 6.15cifs-utils-6.15Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
2022-04-26mount.cifs: fix verbose messages on option parsingJeffrey Bencteux1-5/+1
When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains '=' signs. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15026 Signed-off-by: Jeffrey Bencteux <jbe@improsec.com> Reviewed-by: David Disseldorp <ddiss@suse.de>
2022-04-26CVE-2022-27239: mount.cifs: fix length check for ip option parsingJeffrey Bencteux1-2/+3
Previous check was true whatever the length of the input string was, leading to a buffer overflow in the subsequent strcpy call. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15025 Signed-off-by: Jeffrey Bencteux <jbe@improsec.com> Reviewed-by: David Disseldorp <ddiss@suse.de>
2021-09-23cifs-utils: bump version to 6.14cifs-utils-6.14Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
2021-09-23setcifsacl: fix formattingPavel Shilovsky1-3/+3
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
2021-07-08smbinfo: add support for new key dump ioctlAurelien Aptel1-16/+63
* try new one first, fall back on old one otherwise => retrocompatible * use better cipher descriptions Signed-off-by: Aurelien Aptel <aaptel@suse.com>
2021-07-08mount.cifs: fix crash when mount point does not existPaulo Alcantara1-5/+8
@mountpointp is initially set to a statically allocated string in main(), and if we fail to update it in acquire_mountpoint(), make sure to set it to NULL and avoid freeing it at mount_exit. This fixes the following crash $ mount.cifs //srv/share /mnt/foo/bar -o ... Couldn't chdir to /mnt/foo/bar: No such file or directory munmap_chunk(): invalid pointer Aborted Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
2021-07-08cifs.upcall: fix regression in kerberos mountAurelien Aptel1-75/+139
The fix for CVE-2021-20208 in commit e461afd ("cifs.upcall: try to use container ipc/uts/net/pid/mnt/user namespaces") introduced a regression for kerberos mounts when cifs-utils is built with libcap-ng. It makes mount fail with ENOKEY "Required key not available". Current state: mount.cifs '---> mount() ---> kernel negprot, session setup (need security blob for krb) request_key("cifs.spnego", payload="pid=%d;username=...") upcall /sbin/request-key <--------------' reads /etc/request-keys.conf dispatch cifs.spnego request calls /usr/sbin/cifs.upcall <key id> - drop privileges (capabilities) - fetch keyid - parse payload - switch to mount.cifs namespaces - call krb5_xxx() funcs - generate security blob - set key value to security blob '-----------------------------------> kernel put blob in session setup packet continue auth open tcon get share root setup superblock mount.cifs mount() returns <-----------' By the time cifs.upcall tries to switch to namespaces, enough capabilities have dropped in trim_capabilities() that it makes setns() fail with EPERM. setns() requires CAP_SYS_ADMIN. With libcap trim_capabilities() is a no-op. This fix: - moves the namespace switch earlier so that operations like setgroups(), setgid(), scanning of pid environment, ... happens in the contained namespaces. - moves trim_capabilities() after the namespace switch - moves the string processing to decode the key request payload in a child process with minimum capabilities. the decoded data is shared with the parent process via shared memory obtained with mmap(). Fixes: e461afd ("cifs.upcall: try to use container ipc/uts/net/pid/mnt/user namespaces") Signed-off-by: Aurelien Aptel <aaptel@suse.com>
2021-04-14smbinfo: Add command for displaying alternate data streamsJuan Pablo González2-0/+43
This patch adds a new command to smbinfo which retrieves and displays the list of alternate data streams for a file. Signed-off-by: Juan Pablo González <disablez@gmail.com> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
2021-04-13Reorder ACEs in preferred order during setcifsaclRohith Surabattula2-4/+145
Have added new option "-A" in setcifsacl utility to reorder ACEs in preferred order.
2021-04-12cifs-utils: bump version to 6.13cifs-utils-6.13Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2021-04-06cifs.upcall: try to use container ipc/uts/net/pid/mnt/user namespacesAlastair Houghton1-0/+172
In certain scenarios (e.g. kerberos multimount), when a process does syscalls, the kernel sometimes has to query information or trigger some actions in userspace. To do so it calls the cifs.upcall binary with information on the process that triggered the syscall in the first place. ls(pid=10) ====> open("foo") ====> kernel that user doesn't have an SMB session, lets create one using his kerberos credential cache call cifs.upcall and ask for krb info for whoever owns pid=10 | cifs.upcall --pid 10 <=================+ ...gather info... return binary blob used when establishing SMB session ===================> kernel open SMB session, handle open() syscall ls <=================================== return open() result to ls On a system using containers, the kernel is still calling the host cifs.upcall and using the host configuration (for network, pid, etc). This patch changes the behaviour of cifs.upcall so that it uses the calling process namespaces (ls in the example) when doing its job. Note that the kernel still calls the binary in the host, but the binary will place itself the contexts of the calling process namespaces. This code makes use of (but shouldn't require) the following kernel config options and syscall flags: approx. year | introduced | config/flags ---------------+---------------- 2008 | CONFIG_NAMESPACES=y 2007 | CONFIG_UTS_NS=y 2020 | CONFIG_TIME_NS=y 2006 | CONFIG_IPC_NS=y 2007 | CONFIG_USER_NS 2008 | CONFIG_PID_NS=y 2007 | CONFIG_NET_NS=y 2007 | CONFIG_CGROUPS 2016 | CLONE_NEWCGROUP setns() flag Signed-off-by: Aurelien Aptel <aaptel@suse.com> Signed-off-by: Alastair Houghton <alastair@alastairs-place.net>
2020-12-31cifs-utils: bump version to 6.12cifs-utils-6.12Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-12-30smbinfo: fix fsctl-getobjid outputPavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-12-30smbinfo: fix list-snapshots output and installationPavel Shilovsky2-6/+19
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-12-16cifs.upcall: drop bounding capabilities only if CAP_SETPCAP is givenAlexander Koch1-1/+6
Make drop_call_capabilities() in cifs.upcall update the bounding capabilities only if CAP_SETCAP is present. This is an addendum to the patch recently provided in [1]. Without this additional change, cifs.upcall can still fail while trying to mount a CIFS network share with krb5: kernel: CIFS: Attempting to mount //server.domain.lan/myshare cifs.upcall[39484]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=server.domain.lan> cifs.upcall[39484]: ver=2 cifs.upcall[39484]: host=server.domain.lan cifs.upcall[39484]: ip=172.22.3.14 cifs.upcall[39484]: sec=1 cifs.upcall[39484]: uid=1000 cifs.upcall[39484]: creduid=1000 cifs.upcall[39484]: user=username cifs.upcall[39484]: pid=39481 cifs.upcall[39484]: get_cachename_from_process_env: pathname=/proc/39481/environ cifs.upcall[39484]: get_cachename_from_process_env: cachename = FILE:/tmp/.krb5cc_1000 cifs.upcall[39484]: drop_all_capabilities: Unable to apply capability set: Success cifs.upcall[39484]: Exit status 1 [1] https://marc.info/?l=linux-cifs&m=160595758021261 Signed-off-by: Alexander Koch <mail@alexanderkoch.net> Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
2020-12-16mount.cifs: use SUDO_UID env variable for cruidShyam Prasad N1-16/+67
In the current mount.cifs logic, when sudo is used for mount, uid=0, so the mount command searches for cruid=0 unless explicitly specified by the user. The user may already have cred cache populated but mount.cifs would end up searching cred cache for uid=0. mount.cifs can avoid this confusion by reading the cruid from SUDO_UID environment variable. If it is set to non-zero, we can make cruid=$SUDO_UID. However, to maintain backward compatibility, keeping this as a fallback option. If mount fails with ENOKEY, then retry with this option. To enable this fallback, I had to make a few minor changes in the flow. Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
2020-12-16mount.cifs: fix max buffer size when parsing snapshot optionPavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-12-16Add missing position handling to mount parameters gid/backup_gid/snapshotSimon Arlott1-0/+3
The code tries to optimise for the last parameter not needing to update the position which means that every time a new one is added to the end by copying and pasting, the string position is not updated. That makes it impossible to use backup_uid=/backup_gid=/snapshot= after gid= or snapshot= after backup_gid= because part of the string is overwritten and contains invalid keys like "gbackup_uid". Prepare for the next parameter to be added on the end by updating the position for snapshot= even though it will be unused.
2020-12-16cifs.upcall: update the cap bounding set only when CAP_SETPCAP is givenJonas Witschel1-1/+6
libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error of -4 when trying to update the capability bounding set without having the CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng silently skipped updating the bounding set and only updated the normal CAPNG_SELECT_CAPS capabilities instead. Check beforehand whether we have CAP_SETPCAP, in which case we can use CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set. Otherwise, we can at least update the normal capabilities, but refrain from trying to update the bounding set to avoid getting an error. Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
2020-12-16mount.cifs: update the cap bounding set only when CAP_SETPCAP is givenJonas Witschel1-1/+6
libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error of -4 when trying to update the capability bounding set without having the CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng silently skipped updating the bounding set and only updated the normal CAPNG_SELECT_CAPS capabilities instead. Check beforehand whether we have CAP_SETPCAP, in which case we can use CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set. Otherwise, we can at least update the normal capabilities, but refrain from trying to update the bounding set to avoid getting an error. Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
2020-12-16Extend cifs acl utilities to handle SACLsBoris Protopopov5-281/+719
Extend getcifsacl/setcifsacl utilities to handle System ACLs (SACLs) in addition to Discretionary ACLs (DACLs). The SACL extensions depend on CIFS client support for system.cifs_ntsd_full extended attribute. Signed-off-by: Boris Protopopov <pboris@amazon.com>
2020-12-04getcifsacl: return error if input path doesn't existPavel Shilovsky1-9/+13
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-11-09Fix mount error when mount point has an extra trailing slash.Rohith Surabattula1-0/+9
2020-11-09mount.cifs: ignore comment mount optionMartin Schwenke1-0/+2
mount.cifs currently complains about the "comment" option: CIFS: Unknown mount option "comment=foo" mount(8) on Linux says: The command mount does not pass the mount options unbindable, runbindable, private, rprivate, slave, rslave, shared, rshared, auto, noauto, comment, x-*, loop, offset and sizelimit to the mount.<suffix> helpers. So if mount.cifs decides to re-read /etc/fstab it should ignore the comment option. A lot of online posts say to use comment=x-gvfs-show as an option to have a Linux file manager display a mountpoint for a user mountable filesystem. While the "comment=" part is superfluous when combined with an x-* option, the problem is still difficult to debug. Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
2020-09-03setcifsacl: fix quoting of backslash in man pageBjoern Jacke1-4/+4
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
2020-09-03Separate binary names using comma in mount.cifs.rstSergio Durigan Junior1-3/+3
According to lexgrog(1), when a manpage refers to multiple programs their names should be separated using a comma and a whitespace. This helps silence a lintian warning when building cifs-utils on Debian. Signed-off-by: Sergio Durigan Junior <sergio.durigan@canonical.com>
2020-09-03cifs-utils: fix probabilistic compiling errorlizhe1-1/+1
When we compile cifs-utils, we may probabilistic encounter install error like: cd ***/sbin && ln -sf mount.cifs mount.smb3 ***/sbin: No such file or directory The reason of this problem is that if we compile cifs-utils using multithreading, target 'install-sbinPROGRAMS' may be built after target 'install-exec-hook' of the main Makefile. Target 'install-sbinPROGRAMS' will copy the executable file 'mount.cifs' to the $(ROOTSBINDIR), which target 'install-exec-hook' will do the 'ln' command on. This patch add the dependency of target 'install-exec-hook' to ensure the correct order of the compiling. Signed-off-by: lizhe <lizhe67@huawei.com>
2020-09-03cifs-utils: Don't create symlinks for mans if mans are disabledMikhail Novosyolov1-1/+3
2020-09-03cifs-utils: Respect DESTDIR when installing smb3 stuffMikhail Novosyolov1-4/+4
When make install is run during package building, DESTDIR parameter is passed, e.g.: $ rpm --eval %makeinstall_std make DESTDIR=/root/rpmbuild/BUILDROOT/%{name}-%{version}-%{release}-rosa2016.1.x86_64-buildroot install Without DESTDIR build scripts tried to create symlinks outside of the build root: make[3]: Entering directory '/tmp/abf/rpmbuild/BUILD/cifs-utils-6.10' (cd /sbin && ln -sf mount.cifs mount.smb3) ln: failed to create symbolic link 'mount.smb3': Permission denied The same fix was introduced in Arch Linux package when updating from 6.9 to 6.10: https://git.archlinux.org/svntogit/packages.git/commit/trunk/PKGBUILD?h=packages/cifs-utils&id=c75b246a762ea9b90db404dfebc6d35d5b16972f
2020-09-03mount.cifs.rst: add nolease mount optionPavel Shilovsky1-0/+6
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-09-03Add support for setting owner and group in ntsdBoris Protopopov3-49/+235
Extend setcifsacl utility to allow setting owner and group SIDs in the security descriptor in addition to setting ACLs. This is a user-friendly intefrace for setting owner and group SIDs that takes advantage of the recent extensions in the CIFS kernel client, and it complements setting raw values via setfattr. Signed-off-by: Boris Protopopov <boris.v.protopopov@gmail.com>
2020-09-03Convert owner and group SID offsets to LE formatBoris Protopopov1-2/+4
Convert owner and group SID offsets to LE format when writing to ntsd Signed-off-by: Boris Protopopov <boris.v.protopopov@gmail.com>
2020-09-03smbinfo: remove invalid arguments to ioctl methodRonnie Sahlberg1-2/+2
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
2020-09-03smbinfo: rewrite in pythonAurelien Aptel3-1298/+780
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
2020-09-03cifs-utils: bump version to 6.11cifs-utils-6.11Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2020-09-03CVE-2020-14342: mount.cifs: fix shell command injectionAurelien Aptel1-21/+75
A bug has been reported recently for the mount.cifs utility which is part of the cifs-utils package. The tool has a shell injection issue where one can embed shell commands via the username mount option. Those commands will be run via popen() in the context of the user calling mount. The bug requires cifs-utils to be built with --with-systemd (enabled by default if supported). A quick test to check if the mount.cifs binary is vulnerable is to look for popen() calls like so: $ nm mount.cifs | grep popen U popen@@GLIBC_2.2.5 If the user is allowed to run mount.cifs via sudo, he can obtain a root shell. sudo mount.cifs -o username='`sh`' //1 /mnt If mount.cifs has the setuid bit, the command will still be run as the calling user (no privilege escalation). The bug was introduced in June 2012 with commit 4e264031d0da7d3f2 ("mount.cifs: Use systemd's mechanism for getting password, if present."). Affected versions: cifs-utils-5.6 cifs-utils-5.7 cifs-utils-5.8 cifs-utils-5.9 cifs-utils-6.0 cifs-utils-6.1 cifs-utils-6.2 cifs-utils-6.3 cifs-utils-6.4 cifs-utils-6.5 cifs-utils-6.6 cifs-utils-6.7 cifs-utils-6.8 cifs-utils-6.9 cifs-utils-6.10 Bug: https://bugzilla.samba.org/show_bug.cgi?id=14442 Reported-by: Vadim Lebedev <vadim@mbdsys.com> Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Signed-off-by: Aurelien Aptel <aaptel@suse.com>
2019-12-16cifs-utils: bump version to 6.10cifs-utils-6.10Pavel Shilovsky1-1/+1
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2019-12-16Rename secdesc-ui.py to smb2-secdescPavel Shilovsky1-0/+0
2019-12-16Properly install mount.smb3 helper filesPavel Shilovsky1-0/+6
Signed-off-by: Kenneth D'souza <kdsouza@redhat.com> Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
2019-12-16Install smb2-quota and its manpageRonnie Sahlberg3-0/+12
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
2019-12-12smb2-quota: Simplify code logic for quota entries.Kenneth D'souza2-16/+11
This patch changes the program name from smb2quota to smb2-quota and uses a simple code logic for quota entries. Signed-off-by: Kenneth D'souza <kdsouza@redhat.com> Signed-off-by: Ronnie Sahlberg <lsahlberg@redhat.com>
2019-12-12Add program name to error output instead of static mount.cifsKenneth D'souza1-28/+28
As we are supporting mount.smb3 to be invoked, the error output should contain the called program and not mount.cifs Signed-off-by: Kenneth D'souza <kdsouza@redhat.com>
2019-12-12Add support for smb3 alias/fstype in mount.cifs.cKenneth D'souza3-4/+20
As we will slowly move towards smb3 filesystem, supporting through "mount -t smb3" is important. Signed-off-by: Kenneth D'souza <kdsouza@redhat.com>
2019-12-12smbinfo.rst: document new `keys` commandAurelien Aptel1-0/+4
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-22 17:41:45 +0000