Merge ~ahasenack/ubuntu/+source/nfs-utils:jammy-nfs-utils-svcgssd-principal-1977745 into ubuntu/+source/nfs-utils:ubuntu/jammy-devel

[Andreas Hasenack]

Bringing in one set of fixes from kinetic to jammy. I was planning on bundling these with other fixes we have in kinetic, but I didn't get feedback yet on those, so I'll leave them cooking in kinetic for a while longer and proceed with this SRU, which is more straighforward.

The linked bug has the necessary test cases.

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/nfs-utils-svcgssd-principal-1977745/

I just kicked the DEP8 tests, will post back in a while after there are results.

[Andreas Hasenack (ahasenack)]

Putting this back to "work in progress" because, after talking to the security team, I'll take this update opportunity and also fix https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1980095

[Andreas Hasenack (ahasenack)]

Back in business with the extra hardening fix.

[Bryce Harrington (bryce)]

The DEP8 tests from yesterday all passed. I've re-triggered to pick up today's changes but think maybe the ppa hasn't been updated?

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ahasenack-nfs-utils-svcgssd-principal-1977745/?format=plain)
  nfs-utils @ amd64:
    03.08.22 18:31:23 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ arm64:
    03.08.22 18:36:34 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ armhf:
    03.08.22 18:21:08 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ ppc64el:
    03.08.22 18:36:01 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ s390x:
    03.08.22 18:27:38 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
Running: (none)
Waiting: (none)

In any case changes all LGTM. Verified they match what landed in Kinetic.

Also reviewed the SRU text for both bugs, I didn't run through the test cases but they look very thorough and well documented.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, bryce
Uploaders: ahasenack, bryce
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

I see the ppa2 version of the package in the DEP8 logs, so it seems fine now, and the date is from today:

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ahasenack-nfs-utils-svcgssd-principal-1977745/?format=plain)
  nfs-utils @ amd64:
    04.08.22 03:28:56 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ arm64:
    04.08.22 03:28:23 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ armhf:
    04.08.22 03:10:38 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ ppc64el:
    04.08.22 03:21:24 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
  nfs-utils @ s390x:
    04.08.22 03:16:47 Log 🗒️ ✅ Triggers: nfs-utils/1:2.6.1-1ubuntu1.1~ppa2
Running: (none)
Waiting: (none)

[Andreas Hasenack (ahasenack)]

Uploaded, now it's up to the SRU team:

Uploading nfs-utils_2.6.1-1ubuntu1.1.dsc
Uploading nfs-utils_2.6.1-1ubuntu1.1.debian.tar.xz
Uploading nfs-utils_2.6.1-1ubuntu1.1_source.buildinfo
Uploading nfs-utils_2.6.1-1ubuntu1.1_source.changes

diff --git a/debian/changelog b/debian/changelog
index c8ab091..92e7b2e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+nfs-utils (1:2.6.1-1ubuntu1.1) jammy; urgency=medium
+
+  * rpc.svcgssd fixes and improvements (LP: #1977745):
+    - d/p/svcgssd-fix-use-after-free.patch: fix use-after-free which was
+      preventing svcgssd options set in /etc/nfs.conf from being used
+    - d/p/svcgssd-display-principal-if-set.patch: improve logging,
+      showing the expected principal name if it was set in the config
+    - d/p/svcgssd-document-missing-options.patch: add missing options to
+      the svcgssd manpage
+    - d/p/nfs-conf-manpage-missing-svcgssd-options.patch: also
+      document the missing svcgssd options to the nfs.conf(5) manpage
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 14 Sep 2022 14:34:00 -0300
+
 nfs-utils (1:2.6.1-1ubuntu1) jammy; urgency=medium
 
   * Merge with Debian unstable (LP: #1960829). Remaining changes:
diff --git a/debian/patches/nfs-conf-manpage-missing-svcgssd-options.patch b/debian/patches/nfs-conf-manpage-missing-svcgssd-options.patch
new file mode 100644
index 0000000..b57ad8c
--- /dev/null
+++ b/debian/patches/nfs-conf-manpage-missing-svcgssd-options.patch
@@ -0,0 +1,19 @@
+Description: add missing svcgssd long options to nfs.conf(5)
+Author: Andreas Hasenack <[e-mail]>
+Forwarded: https://marc.info/?l=linux-nfs&m=165635622607689&w=4
+Last-Update: 2022-06-27
+
+--- a/systemd/nfs.conf.man
++++ b/systemd/nfs.conf.man
+@@ -283,7 +283,10 @@
+ .TP
+ .B svcgssd
+ Recognized values:
+-.BR principal .
++.BR principal ,
++.BR verbosity ,
++.BR rpc-verbosity ,
++.BR idmap-verbosity .
+ 
+ See
+ .BR rpc.svcgssd (8)
diff --git a/debian/patches/series b/debian/patches/series
index 127f3e1..5626161 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,7 @@ multiarch-kerberos-paths.patch
 nfs-utils-fix-man-page-syntax-errors.patch
 tests-skip-test-if-dev-log-is-missing.patch
 remove-regex-from-docs.patch
+svcgssd-fix-use-after-free.patch
+svcgssd-display-principal-if-set.patch
+svcgssd-document-missing-options.patch
+nfs-conf-manpage-missing-svcgssd-options.patch
diff --git a/debian/patches/svcgssd-display-principal-if-set.patch b/debian/patches/svcgssd-display-principal-if-set.patch
new file mode 100644
index 0000000..a10edd8
--- /dev/null
+++ b/debian/patches/svcgssd-display-principal-if-set.patch
@@ -0,0 +1,37 @@
+From 284d249e0fe58443dafc96fa8be51a2cef4541a0 Mon Sep 17 00:00:00 2001
+From: Marcel Ritter <[e-mail]>
+Date: Tue, 21 Jun 2022 09:21:36 -0400
+Subject: [PATCH] svcgssd: Display principal if set
+
+It's a little irritating to only see the template "<...>@<...>" if you
+set a specific principal name. So let's show it (if set).
+
+Signed-off-by: Steve Dickson <[e-mail]>
+---
+ utils/gssd/svcgssd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Origin: upstream, http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=284d249e0fe58443dafc96fa8be51a2cef4541a0
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1977745
+Last-Update: 2022-06-27
+
+diff --git a/utils/gssd/svcgssd.c b/utils/gssd/svcgssd.c
+index a242b78..ce78d8f 100644
+--- a/utils/gssd/svcgssd.c
++++ b/utils/gssd/svcgssd.c
+@@ -295,9 +295,9 @@ main(int argc, char *argv[])
+ 				(const gss_OID)GSS_C_NT_HOSTBASED_SERVICE);
+ 		if (status == FALSE) {
+ 			printerr(0, "unable to obtain root (machine) credentials\n");
+-			printerr(0, "do you have a keytab entry for "
+-				"nfs/<your.host>@<YOUR.REALM> in "
+-				"/etc/krb5.keytab?\n");
++			printerr(0, "do you have a keytab entry for %s in"
++				"/etc/krb5.keytab?\n",
++				principal ? principal : "nfs/<your.host>@<YOUR.REALM>");
+ 			exit(1);
+ 		}
+ 	} else {
+-- 
+1.8.3.1
+
diff --git a/debian/patches/svcgssd-document-missing-options.patch b/debian/patches/svcgssd-document-missing-options.patch
new file mode 100644
index 0000000..18cf721
--- /dev/null
+++ b/debian/patches/svcgssd-document-missing-options.patch
@@ -0,0 +1,44 @@
+From f541550358f136e9a6d1fd131e83d17e6269dae4 Mon Sep 17 00:00:00 2001
+From: Marcel Ritter <[e-mail]>
+Date: Tue, 21 Jun 2022 09:23:22 -0400
+Subject: [PATCH] svcgssd: Add (undocumented) config options to man page
+
+There seem to be some undocumented options implemented.
+Why not mention them in the man page?
+
+Signed-off-by: Steve Dickson <[e-mail]>
+---
+ utils/gssd/svcgssd.man | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+Origin: upstream, http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=f541550358f136e9a6d1fd131e83d17e6269dae4
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1977745
+Last-Update: 2022-06-27
+
+diff --git a/utils/gssd/svcgssd.man b/utils/gssd/svcgssd.man
+index 15ef4c9..8771c03 100644
+--- a/utils/gssd/svcgssd.man
++++ b/utils/gssd/svcgssd.man
+@@ -61,6 +61,19 @@ this is equivalent to the
+ option.  If set to any other value, that is used like the
+ .B -p
+ option.
++.TP
++.B verbosity
++Value which is equivalent to the number of
++.BR -v .
++.TP
++.B rpc-verbosity
++Value which is equivalent to the number of
++.BR -r .
++.TP
++.B idmap-verbosity
++Value which is equivalent to the number of
++.BR -i .
++
+ 
+ .SH SEE ALSO
+ .BR rpc.gssd(8),
+-- 
+1.8.3.1
+
diff --git a/debian/patches/svcgssd-fix-use-after-free.patch b/debian/patches/svcgssd-fix-use-after-free.patch
new file mode 100644
index 0000000..5a9b0a6
--- /dev/null
+++ b/debian/patches/svcgssd-fix-use-after-free.patch
@@ -0,0 +1,45 @@
+From 2eabb25d5a43e48e769a0db29956e9f5dc5b5913 Mon Sep 17 00:00:00 2001
+From: Marcel Ritter <[e-mail]>
+Date: Tue, 21 Jun 2022 09:19:17 -0400
+Subject: [PATCH] svcgssd: Fix use-after-free bug (config variables)
+
+This patch fixes a bug when trying to set "principal" in /etc/nfs.conf.
+Memory gets freed by conf_cleanup() before being used - moving cleanup
+code resolves that.
+
+Signed-off-by: Steve Dickson <[e-mail]>
+---
+ utils/gssd/svcgssd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Origin: upstream, http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=2eabb25d5a43e48e769a0db29956e9f5dc5b5913
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1977745
+Last-Update: 2022-06-27
+
+diff --git a/utils/gssd/svcgssd.c b/utils/gssd/svcgssd.c
+index 881207b..a242b78 100644
+--- a/utils/gssd/svcgssd.c
++++ b/utils/gssd/svcgssd.c
+@@ -211,9 +211,6 @@ main(int argc, char *argv[])
+ 	rpc_verbosity = conf_get_num("svcgssd", "RPC-Verbosity", rpc_verbosity);
+ 	idmap_verbosity = conf_get_num("svcgssd", "IDMAP-Verbosity", idmap_verbosity);
+ 
+-	/* We don't need the config anymore */
+-	conf_cleanup();
+-
+ 	while ((opt = getopt(argc, argv, "fivrnp:")) != -1) {
+ 		switch (opt) {
+ 			case 'f':
+@@ -328,6 +325,9 @@ main(int argc, char *argv[])
+ 
+ 	daemon_ready();
+ 
++	/* We don't need the config anymore */
++	conf_cleanup();
++
+ 	nfs4_init_name_mapping(NULL); /* XXX: should only do this once */
+ 
+ 	rc = event_base_dispatch(evbase);
+-- 
+1.8.3.1
+