Public bug reported:

OS: Ubuntu24
Kernel: 6.17.0-1028-oem

Packages:
autofs 5.1.9-1ubuntu4.1 amd64
cifs-utils 2:7.0-2ubuntu0.3

Description:
With latest update of cifs-utils to version 2:7.0-2ubuntu0.3 autofs service 
lost way to get and read kerberos tickets created by other users than root. It 
is connected with CVE https://ubuntu.com/security/CVE-2026-12505 where they 
removed or updated function of cifs.upcall getpwuid and service autofs that run 
under root privileges to create mounts cannot now see user created kerberos 
ticket.

Can you provide how can autofs with cifs be able to work with user
created kerberos ticket? Or make updates to cifs-utils that will be able
to safely use %{uid} and getpwuid? Is there some official working
configuration that use autofs to mount cifs via kerberos ticket
authentication?

Configuration snippets:
- "/etc/auto.cifs":
"
mount_dir_name  
-fstype=cifs,sec=krb5,cruid=123456,user=tester,uid=123456,gid=123456,vers=3.1.1,soft,actimeo=1
  ://fs.example.com/mount_dir_name
"

- "/etc/auto.master"
"
/remote/fs /etc/auto.cifs --timeout=10
"

- "/etc/krb5.conf":
"
[libdefaults]
 default_ccache_name = FILE:/tmp/krb5cc_%{uid}
"

Kerberos ticket cache file:
-rw-------  1 tester tester  3395 Jul  7 13:32 /tmp/krb5cc_123456

When autofs.service is started and you try to go to /remote/fs/mount_dir_name 
you can see in journal that it ignores getting /tmp/krb5cc_123456(before 
cifs-utils update) and use user root id=0 to look for /tmp/krb5cc_0.
- journal logs
"
Jul 03 14:04:48 machine kernel: CIFS: Attempting to mount 
//fs.example.com/mount_dir_name
Jul 03 14:04:48 machine cifs.upcall[17762]: key description: 
cifs.spnego;0;0;39010000;ver=0x2;host=fs.example.com;ip4=1.2.3.4;sec=krb5;uid=0x32253;creduid=0x32253;user=root;pid=0x455f;upcall_target=app
Jul 03 14:04:48 machine cifs.upcall[17763]: ver=2
Jul 03 14:04:48 machine cifs.upcall[17763]: host=fs.example.com
Jul 03 14:04:48 machine cifs.upcall[17763]: ip=1.2.3.4
Jul 03 14:04:48 machine cifs.upcall[17763]: sec=1
Jul 03 14:04:48 machine cifs.upcall[17763]: uid=123456
Jul 03 14:04:48 machine cifs.upcall[17763]: creduid=123456
Jul 03 14:04:48 machine cifs.upcall[17763]: user=root
Jul 03 14:04:48 machine cifs.upcall[17763]: pid=17759
Jul 03 14:04:48 machine cifs.upcall[17763]: upcall_target=app
Jul 03 14:04:48 machine cifs.upcall[17762]: upcall_target=app, switching 
namespaces to application thread
Jul 03 14:04:48 machine cifs.upcall[17762]: get_cachename_from_process_env: 
pathname=/proc/17759/environ
Jul 03 14:04:48 machine cifs.upcall[17762]: get_existing_cc: default ccache is 
FILE:/tmp/krb5cc_0
Jul 03 14:04:48 machine cifs.upcall[17762]: check_service_ticket_exists: unable 
to get client principal from cache: No credentials cache found (filename: 
/tmp/krb5cc_0)
Jul 03 14:04:48 machine cifs.upcall[17762]: get_tgt_time: unable to get 
principal
Jul 03 14:04:48 machine cifs.upcall[17762]: main: valid TGT is not present in 
credential cache
Jul 03 14:04:48 machine cifs.upcall[17762]: krb5_get_init_creds_keytab: 
-1765328203
Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: getting service 
ticket for fs.example.com
Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: using GSS-API
Jul 03 14:04:48 machine cifs.upcall[17762]: GSS-API error init_sec_context: No 
credentials were supplied, or the credentials were unavailable or inaccessible
Jul 03 14:04:48 machine cifs.upcall[17762]: GSS-API error init_sec_context: No 
Kerberos credentials available (default cache: FILE:/tmp/krb5cc_0)
Jul 03 14:04:48 machine cifs.upcall[17762]: handle_krb5_mech: failed to obtain 
service ticket via GSS (458752)
Jul 03 14:04:48 machine cifs.upcall[17762]: Unable to obtain service ticket
Jul 03 14:04:48 machine cifs.upcall[17762]: Exit status 458752
Jul 03 14:04:48 machine kernel: CIFS: VFS: Verify user has a krb5 ticket and 
keyutils is installed
Jul 03 14:04:48 machine kernel: CIFS: VFS: \\fs.example.com Send error in 
SessSetup = -126
Jul 03 14:04:48 machine kernel: CIFS: VFS: cifs_mount failed w/return code = 
-126
"

If I update "/etc/krb5.conf" with "default_ccache_name = 
FILE:/tmp/krb5cc_123456" it still does not work as cache is not readable for 
autofs service. Changing permission of cache is not possibble as kerberos 
ticket and cache is created on login or when kinit used.
- journal logs
"
Jul 03 15:05:19 machine kernel: CIFS: Attempting to mount 
//fs.example.com/mount_dir_name
Jul 03 15:05:19 machine cifs.upcall[26207]: key description: 
cifs.spnego;0;0;39010000;ver=0x2;host=fs.example.com;ip4=1.2.3.4;sec=krb5;uid=0x32253;creduid=0x32253;user=root;pid=0x665c;upcall_target=app
Jul 03 15:05:19 machine cifs.upcall[26208]: ver=2
Jul 03 15:05:19 machine cifs.upcall[26208]: host=fs.example.com
Jul 03 15:05:19 machine cifs.upcall[26208]: ip=1.2.3.4
Jul 03 15:05:19 machine cifs.upcall[26208]: sec=1
Jul 03 15:05:19 machine cifs.upcall[26208]: uid=123456
Jul 03 15:05:19 machine cifs.upcall[26208]: creduid=123456
Jul 03 15:05:19 machine cifs.upcall[26208]: user=root
Jul 03 15:05:19 machine cifs.upcall[26208]: pid=26204
Jul 03 15:05:19 machine cifs.upcall[26208]: upcall_target=app
Jul 03 15:05:19 machine cifs.upcall[26207]: upcall_target=app, switching 
namespaces to application thread
Jul 03 15:05:19 machine cifs.upcall[26207]: get_cachename_from_process_env: 
pathname=/proc/26204/environ
Jul 03 15:05:19 machine cifs.upcall[26207]: get_existing_cc: default ccache is 
FILE:/tmp/krb5cc_123456
Jul 03 15:05:19 machine cifs.upcall[26207]: check_service_ticket_exists: unable 
to get client principal from cache: Credentials cache permissions incorrect 
(filename: /tmp/krb5cc_123456)
Jul 03 15:05:19 machine cifs.upcall[26207]: get_tgt_time: unable to get 
principal
Jul 03 15:05:19 machine cifs.upcall[26207]: main: valid TGT is not present in 
credential cache
Jul 03 15:05:19 machine cifs.upcall[26207]: krb5_get_init_creds_keytab: 
-1765328203
Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: getting service 
ticket for fs.example.com
Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: using GSS-API
Jul 03 15:05:19 machine cifs.upcall[26207]: GSS-API error init_sec_context: No 
credentials were supplied, or the credentials were unavailable or inaccessible
Jul 03 15:05:19 machine cifs.upcall[26207]: GSS-API error init_sec_context: No 
Kerberos credentials available: Credentials cache permissions incorrect 
(filename: /tmp/krb5cc_123456)
Jul 03 15:05:19 machine cifs.upcall[26207]: handle_krb5_mech: failed to obtain 
service ticket via GSS (458752)
Jul 03 15:05:19 machine cifs.upcall[26207]: Unable to obtain service ticket
Jul 03 15:05:19 machine cifs.upcall[26207]: Exit status 458752
Jul 03 15:05:19 machine kernel: CIFS: VFS: Verify user has a krb5 ticket and 
keyutils is installed
Jul 03 15:05:19 machine kernel: CIFS: VFS: \\fs.example.com Send error in 
SessSetup = -126
Jul 03 15:05:19 machine kernel: CIFS: VFS: cifs_mount failed w/return code = 
-126
"

** Affects: ubuntu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160026

Title:
  autofs could not read kerberos ticket with cifs-utils update

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/2160026/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to