This version fixes a few problems that Chuck and agentic review pointed out. Original cover letter follows:
While working on the recent hardening patches for the nfsd listener netlink interface, Chuck mentioned that we could allow userland to handle rpcbind registation itself. This adds such a mechanism to the netlink listener set interface. The main idea is to add a new optional flag to the netlink downcall that tells the kernel to skip rpcbind registration altogether for the nfsd listeners. Note that NLM registration is not affected and is still handled by the kernel. Handling that is trickier since it can be started by the client. Patches to nfsdctl will follow. Signed-off-by: Jeff Layton <[email protected]> --- Changes in v3: - Exempt an empty listener list from the rpcbind ownership check. - Drop the dead nfsacl test in nfsd_version_registerable(). - Set an extack when the listener_set reply cannot be built. - selftests: check nlmsg_len against the recv() count before parsing the reply. - selftests: cover teardown in both ownership directions. - Link to v2: https://lore.kernel.org/r/[email protected] Changes in v2: - Refuse the legacy portlist add-fd write against a userspace-rpcbind serv. nfsd_create_serv() cannot flip ownership back for an existing serv, svc_addsock() expects svc_register() to register the listener, and there is no way to tell the rpcbind owner about it. - selftests: require NFSv3 in the reply and skip where NFSv4 is not built, rather than passing when neither is present. - selftests: cover the portlist refusal. - Link to v1: https://lore.kernel.org/r/[email protected] --- Jeff Layton (5): SUNRPC: allow a service to opt out of rpcbind registration NFSD: add a userspace-rpcbind flag to listener_set NFSD: honour the userspace-rpcbind flag in listener_set NFSD: report registerable programs in the listener_set reply selftests/nfsd: exercise the userspace-rpcbind listener_set flag Documentation/netlink/specs/nfsd.yaml | 55 ++- fs/nfsd/netlink.c | 5 +- fs/nfsd/nfsctl.c | 195 +++++++++- fs/nfsd/nfsd.h | 4 +- fs/nfsd/nfssvc.c | 66 ++-- include/linux/sunrpc/svc.h | 2 + include/uapi/linux/nfsd_netlink.h | 20 + net/sunrpc/svc.c | 5 + net/sunrpc/svc_xprt.c | 2 +- .../testing/selftests/nfsd/nfsd_netlink_listener.c | 404 ++++++++++++++++++++- 10 files changed, 718 insertions(+), 40 deletions(-) --- base-commit: 4d46e877c21d07ddcad03da7f3b05ad2cc22b5b3 change-id: 20260903-nfsd-norpcb-21cdcaf246bb Best regards, -- Jeff Layton <[email protected]>
