Public bug reported: OS: Ubuntu24 Kernel: 6.17.0-1028-oem
Packages: autofs 5.1.9-1ubuntu4.1 amd64 cifs-utils 2:7.0-2ubuntu0.3 Description: With latest update of cifs-utils to version 2:7.0-2ubuntu0.3 autofs service lost way to get and read kerberos tickets created by other users than root. It is connected with CVE https://ubuntu.com/security/CVE-2026-12505 where they removed or updated function of cifs.upcall getpwuid and service autofs that run under root privileges to create mounts cannot now see user created kerberos ticket. Can you provide how can autofs with cifs be able to work with user created kerberos ticket? Or make updates to cifs-utils that will be able to safely use %{uid} and getpwuid? Is there some official working configuration that use autofs to mount cifs via kerberos ticket authentication? Configuration snippets: - "/etc/auto.cifs": " mount_dir_name -fstype=cifs,sec=krb5,cruid=123456,user=tester,uid=123456,gid=123456,vers=3.1.1,soft,actimeo=1 ://fs.example.com/mount_dir_name " - "/etc/auto.master" " /remote/fs /etc/auto.cifs --timeout=10 " - "/etc/krb5.conf": " [libdefaults] default_ccache_name = FILE:/tmp/krb5cc_%{uid} " Kerberos ticket cache file: -rw------- 1 tester tester 3395 Jul 7 13:32 /tmp/krb5cc_123456 When autofs.service is started and you try to go to /remote/fs/mount_dir_name you can see in journal that it ignores getting /tmp/krb5cc_123456(before cifs-utils update) and use user root id=0 to look for /tmp/krb5cc_0. - journal logs " Jul 03 14:04:48 machine kernel: CIFS: Attempting to mount //fs.example.com/mount_dir_name Jul 03 14:04:48 machine cifs.upcall[17762]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=fs.example.com;ip4=1.2.3.4;sec=krb5;uid=0x32253;creduid=0x32253;user=root;pid=0x455f;upcall_target=app Jul 03 14:04:48 machine cifs.upcall[17763]: ver=2 Jul 03 14:04:48 machine cifs.upcall[17763]: host=fs.example.com Jul 03 14:04:48 machine cifs.upcall[17763]: ip=1.2.3.4 Jul 03 14:04:48 machine cifs.upcall[17763]: sec=1 Jul 03 14:04:48 machine cifs.upcall[17763]: uid=123456 Jul 03 14:04:48 machine cifs.upcall[17763]: creduid=123456 Jul 03 14:04:48 machine cifs.upcall[17763]: user=root Jul 03 14:04:48 machine cifs.upcall[17763]: pid=17759 Jul 03 14:04:48 machine cifs.upcall[17763]: upcall_target=app Jul 03 14:04:48 machine cifs.upcall[17762]: upcall_target=app, switching namespaces to application thread Jul 03 14:04:48 machine cifs.upcall[17762]: get_cachename_from_process_env: pathname=/proc/17759/environ Jul 03 14:04:48 machine cifs.upcall[17762]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 Jul 03 14:04:48 machine cifs.upcall[17762]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_0) Jul 03 14:04:48 machine cifs.upcall[17762]: get_tgt_time: unable to get principal Jul 03 14:04:48 machine cifs.upcall[17762]: main: valid TGT is not present in credential cache Jul 03 14:04:48 machine cifs.upcall[17762]: krb5_get_init_creds_keytab: -1765328203 Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: getting service ticket for fs.example.com Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: using GSS-API Jul 03 14:04:48 machine cifs.upcall[17762]: GSS-API error init_sec_context: No credentials were supplied, or the credentials were unavailable or inaccessible Jul 03 14:04:48 machine cifs.upcall[17762]: GSS-API error init_sec_context: No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_0) Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: failed to obtain service ticket via GSS (458752) Jul 03 14:04:48 machine cifs.upcall[17762]: Unable to obtain service ticket Jul 03 14:04:48 machine cifs.upcall[17762]: Exit status 458752 Jul 03 14:04:48 machine kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed Jul 03 14:04:48 machine kernel: CIFS: VFS: \\fs.example.com Send error in SessSetup = -126 Jul 03 14:04:48 machine kernel: CIFS: VFS: cifs_mount failed w/return code = -126 " If I update "/etc/krb5.conf" with "default_ccache_name = FILE:/tmp/krb5cc_123456" it still does not work as cache is not readable for autofs service. Changing permission of cache is not possibble as kerberos ticket and cache is created on login or when kinit used. - journal logs " Jul 03 15:05:19 machine kernel: CIFS: Attempting to mount //fs.example.com/mount_dir_name Jul 03 15:05:19 machine cifs.upcall[26207]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=fs.example.com;ip4=1.2.3.4;sec=krb5;uid=0x32253;creduid=0x32253;user=root;pid=0x665c;upcall_target=app Jul 03 15:05:19 machine cifs.upcall[26208]: ver=2 Jul 03 15:05:19 machine cifs.upcall[26208]: host=fs.example.com Jul 03 15:05:19 machine cifs.upcall[26208]: ip=1.2.3.4 Jul 03 15:05:19 machine cifs.upcall[26208]: sec=1 Jul 03 15:05:19 machine cifs.upcall[26208]: uid=123456 Jul 03 15:05:19 machine cifs.upcall[26208]: creduid=123456 Jul 03 15:05:19 machine cifs.upcall[26208]: user=root Jul 03 15:05:19 machine cifs.upcall[26208]: pid=26204 Jul 03 15:05:19 machine cifs.upcall[26208]: upcall_target=app Jul 03 15:05:19 machine cifs.upcall[26207]: upcall_target=app, switching namespaces to application thread Jul 03 15:05:19 machine cifs.upcall[26207]: get_cachename_from_process_env: pathname=/proc/26204/environ Jul 03 15:05:19 machine cifs.upcall[26207]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_123456 Jul 03 15:05:19 machine cifs.upcall[26207]: check_service_ticket_exists: unable to get client principal from cache: Credentials cache permissions incorrect (filename: /tmp/krb5cc_123456) Jul 03 15:05:19 machine cifs.upcall[26207]: get_tgt_time: unable to get principal Jul 03 15:05:19 machine cifs.upcall[26207]: main: valid TGT is not present in credential cache Jul 03 15:05:19 machine cifs.upcall[26207]: krb5_get_init_creds_keytab: -1765328203 Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: getting service ticket for fs.example.com Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: using GSS-API Jul 03 15:05:19 machine cifs.upcall[26207]: GSS-API error init_sec_context: No credentials were supplied, or the credentials were unavailable or inaccessible Jul 03 15:05:19 machine cifs.upcall[26207]: GSS-API error init_sec_context: No Kerberos credentials available: Credentials cache permissions incorrect (filename: /tmp/krb5cc_123456) Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: failed to obtain service ticket via GSS (458752) Jul 03 15:05:19 machine cifs.upcall[26207]: Unable to obtain service ticket Jul 03 15:05:19 machine cifs.upcall[26207]: Exit status 458752 Jul 03 15:05:19 machine kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed Jul 03 15:05:19 machine kernel: CIFS: VFS: \\fs.example.com Send error in SessSetup = -126 Jul 03 15:05:19 machine kernel: CIFS: VFS: cifs_mount failed w/return code = -126 " ** Affects: ubuntu Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2160026 Title: autofs could not read kerberos ticket with cifs-utils update To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+bug/2160026/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
