[LU-17518] MDS still trust client-originated support GID on a Kerberos enabled filesystem Created: 09/Feb/24 Updated: 09/Feb/24 |
|
| Status: | Open |
| Project: | Lustre |
| Component/s: | None |
| Affects Version/s: | Lustre 2.16.0 |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Minor |
| Reporter: | Sebastien Buisson | Assignee: | Sebastien Buisson |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | gss, kerberos, patch, sec | ||
| Issue Links: |
|
||||
| Severity: | 3 | ||||
| Rank (Obsolete): | 9223372036854775807 | ||||
| Description |
|
On a kerberos enabled filesystem, the MDS should not trust the UID/GID/supplementary groups sent by the clients, and instead get the UID from the GSS context, and the GID and supplementary groups from the identity upcall. |
| Comments |
| Comment by Gerrit Updater [ 09/Feb/24 ] |
|
"Sebastien Buisson <sbuisson@ddn.com>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/53987 |