Performing verification for jammy: We are going to perform a series of mounts and check if they work with a patched vs unpatched kernel, and make sure all mounts work.
We will start with an unpatched kernel: ubuntu@jammy-dc:~$ uname -rv 5.15.0-141-generic #151-Ubuntu SMP Sun May 18 21:35:19 UTC 2025 I installed cifs-utils 2:6.14-1ubuntu0.2 from -updates. Let's try and standard uid 1000 user: ubuntu@jammy-dc:~$ kinit [email protected] Password for [email protected]: Warning: Your password will expire in 38 days on Fri Jul 25 02:42:43 2025 ubuntu@jammy-dc:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:39:52 06/16/25 14:39:52 krbtgt/[email protected] renew until 06/17/25 04:39:49 ubuntu@jammy-dc:~$ sudo mount -t cifs -o cruid=ubuntu,user=ubuntu,sec=krb5i,uid=1000,gid=1000,cred=/tmp/krb5cc_1000 //samba-dc.example.com/demo /mnt/testshare1 ubuntu@jammy-dc:~$ mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=1000,cache=strict,username=ubuntu,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=ubuntu) $ journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1661]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x3e8;creduid=0x3e8;user=ubuntu;pid=0x665 cifs.upcall[1662]: ver=2 cifs.upcall[1662]: host=samba-dc.example.com cifs.upcall[1662]: ip=192.168.122.79 cifs.upcall[1662]: sec=1 cifs.upcall[1662]: uid=1000 cifs.upcall[1662]: creduid=1000 cifs.upcall[1662]: user=ubuntu cifs.upcall[1662]: pid=1637 cifs.upcall[1661]: upcall_target=app, switching namespaces to application thread cifs.upcall[1661]: get_cachename_from_process_env: pid == 0 cifs.upcall[1661]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000 cifs.upcall[1661]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1661]: handle_krb5_mech: obtained service ticket cifs.upcall[1661]: Exit status 0 Let's try as a different uid user, e.g. like AD user: ubuntu@jammy-dc:~$ mv /tmp/krb5cc_1000 /tmp/krb5cc_11200 ubuntu@jammy-dc:~$ export KRB5CCNAME=/tmp/krb5cc_11200 ubuntu@jammy-dc:~$ klist /tmp/krb5cc_11200 Ticket cache: FILE:/tmp/krb5cc_11200 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:39:52 06/16/25 14:39:52 krbtgt/[email protected] renew until 06/17/25 04:39:49 06/16/25 04:40:02 06/16/25 14:39:52 cifs/samba-dc.example.com@ renew until 06/17/25 04:39:49 Ticket server: cifs/[email protected] ubuntu@jammy-dc:~$ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1 mount error(126): Required key not available Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) ubuntu@jammy-dc:~$ mount -l | grep cifs $ journalctl -b0 kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1687]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x3e8;user=root;pid=0x68a cifs.upcall[1688]: ver=2 cifs.upcall[1688]: host=samba-dc.example.com cifs.upcall[1688]: ip=192.168.122.79 cifs.upcall[1688]: sec=1 cifs.upcall[1688]: uid=0 cifs.upcall[1688]: creduid=1000 cifs.upcall[1688]: user=root cifs.upcall[1688]: pid=1674 cifs.upcall[1687]: upcall_target=app, switching namespaces to application thread cifs.upcall[1687]: get_cachename_from_process_env: pid == 0 cifs.upcall[1687]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000 cifs.upcall[1687]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_1000) cifs.upcall[1687]: get_tgt_time: unable to get principal cifs.upcall[1687]: main: valid TGT is not present in credential cache cifs.upcall[1687]: krb5_get_init_creds_keytab: -1765328378 cifs.upcall[1687]: Exit status 1 sudo[1671]: pam_unix(sudo:session): session closed for user root kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 kernel: CIFS: VFS: cifs_mount failed w/return code = -126 We fail, due to only searching root's env, reproducing the issue. Let's try as root user: ubuntu@jammy-dc:~$ kdestroy ubuntu@jammy-dc:~$ unset KRB5CCNAME ubuntu@jammy-dc:~$ sudo -s root@jammy-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 38 days on Fri Jul 25 02:42:43 2025 root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:42:19 06/16/25 14:42:19 krbtgt/[email protected] renew until 06/17/25 04:42:16 root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu# mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=root) $ journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1709]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x6a7 cifs.upcall[1710]: ver=2 cifs.upcall[1710]: host=samba-dc.example.com cifs.upcall[1710]: ip=192.168.122.79 cifs.upcall[1710]: sec=1 cifs.upcall[1710]: uid=0 cifs.upcall[1710]: creduid=0 cifs.upcall[1710]: user=root cifs.upcall[1710]: pid=1703 cifs.upcall[1709]: upcall_target=app, switching namespaces to application thread cifs.upcall[1709]: get_cachename_from_process_env: pid == 0 cifs.upcall[1709]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1709]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1709]: handle_krb5_mech: obtained service ticket cifs.upcall[1709]: Exit status 0 I then enabled -security-proposed from the following ppa: https://launchpad.net/~ubuntu-security- proposed/+archive/ubuntu/ppa/+packages?field.name_filter=cifs- utils&field.status_filter=published&field.series_filter= I then installed cifs-utils 2:6.14-1ubuntu0.3 Let's try and standard uid 1000 user: ubuntu@jammy-dc:~$ kinit [email protected] Password for [email protected]: Warning: Your password will expire in 38 days on Fri Jul 25 02:42:43 2025 ubuntu@jammy-dc:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:43:49 06/16/25 14:43:49 krbtgt/[email protected] renew until 06/17/25 04:43:46 ubuntu@jammy-dc:~$ sudo mount -t cifs -o cruid=ubuntu,user=ubuntu,sec=krb5i,uid=1000,gid=1000,cred=/tmp/krb5cc_1000 //samba-dc.example.com/demo /mnt/testshare1 ubuntu@jammy-dc:~$ mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=1000,cache=strict,username=ubuntu,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=ubuntu) $ journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1895]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x3e8;creduid=0x3e8;user=ubuntu;pid=0x761 cifs.upcall[1896]: ver=2 cifs.upcall[1896]: host=samba-dc.example.com cifs.upcall[1896]: ip=192.168.122.79 cifs.upcall[1896]: sec=1 cifs.upcall[1896]: uid=1000 cifs.upcall[1896]: creduid=1000 cifs.upcall[1896]: user=ubuntu cifs.upcall[1896]: pid=1889 cifs.upcall[1895]: upcall_target=app, switching namespaces to application thread cifs.upcall[1895]: get_cachename_from_process_env: pathname=/proc/1889/environ cifs.upcall[1895]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000 cifs.upcall[1895]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1895]: handle_krb5_mech: obtained service ticket cifs.upcall[1895]: Exit status 0 ubuntu@jammy-dc:~$ sudo umount /mnt/testshare1 Let's try as a different uid user, e.g. like AD user: ubuntu@jammy-dc:~$ export KRB5CCNAME=/tmp/krb5cc_11200 ubuntu@jammy-dc:~$ mv /tmp/krb5cc_1000 /tmp/krb5cc_11200 ubuntu@jammy-dc:~$ klist /tmp/krb5cc_11200 Ticket cache: FILE:/tmp/krb5cc_11200 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:43:49 06/16/25 14:43:49 krbtgt/[email protected] renew until 06/17/25 04:43:46 06/16/25 04:43:59 06/16/25 14:43:49 cifs/samba-dc.example.com@ renew until 06/17/25 04:43:46 Ticket server: cifs/[email protected] ubuntu@jammy-dc:~$ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1 ubuntu@jammy-dc:~$ mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1) $ journalctl -b0 kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1915]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x775 cifs.upcall[1916]: ver=2 cifs.upcall[1916]: host=samba-dc.example.com cifs.upcall[1916]: ip=192.168.122.79 cifs.upcall[1916]: sec=1 cifs.upcall[1916]: uid=0 cifs.upcall[1916]: creduid=0 cifs.upcall[1916]: user=root cifs.upcall[1916]: pid=1909 cifs.upcall[1915]: upcall_target=app, switching namespaces to application thread cifs.upcall[1915]: get_cachename_from_process_env: pid == 0 cifs.upcall[1915]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1915]: main: valid service ticket exists in credential cache cifs.upcall[1915]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1915]: handle_krb5_mech: obtained service ticket cifs.upcall[1915]: Exit status 0 The mount now works correctly, and the regression is fixed. Let's try as root user: root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_11200 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:43:49 06/16/25 14:43:49 krbtgt/[email protected] renew until 06/17/25 04:43:46 06/16/25 04:43:59 06/16/25 14:43:49 cifs/samba-dc.example.com@ renew until 06/17/25 04:43:46 Ticket server: cifs/[email protected] root@jammy-dc:/home/ubuntu# umount /mnt/testshare1 root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu# mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=root) $ journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1939]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x78d cifs.upcall[1940]: ver=2 cifs.upcall[1940]: host=samba-dc.example.com cifs.upcall[1940]: ip=192.168.122.79 cifs.upcall[1940]: sec=1 cifs.upcall[1940]: uid=0 cifs.upcall[1940]: creduid=0 cifs.upcall[1940]: user=root cifs.upcall[1940]: pid=1933 cifs.upcall[1939]: upcall_target=app, switching namespaces to application thread cifs.upcall[1939]: get_cachename_from_process_env: pid == 0 cifs.upcall[1939]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 cifs.upcall[1939]: main: valid service ticket exists in credential cache cifs.upcall[1939]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1939]: handle_krb5_mech: obtained service ticket cifs.upcall[1939]: Exit status 0 Next, we will just do a run with a patched kernel. I enabled -proposed and installed: ubuntu@jammy-dc:~$ uname -rv 5.15.0-142-generic #152-Ubuntu SMP Mon May 19 10:54:31 UTC 2025 We will keep cifs-utils from -security-proposed installed. Let's try and standard uid 1000 user: ubuntu@jammy-dc:~$ kinit [email protected] Password for [email protected]: Warning: Your password will expire in 38 days on Fri Jul 25 02:42:43 2025 ubuntu@jammy-dc:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:50:22 06/16/25 14:50:22 krbtgt/[email protected] renew until 06/17/25 04:50:19 ubuntu@jammy-dc:~$ sudo mount -t cifs -o cruid=ubuntu,user=ubuntu,sec=krb5i,uid=1000,gid=1000,cred=/tmp/krb5cc_1000 //samba-dc.example.com/demo /mnt/testshare1 ubuntu@jammy-dc:~$ mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=1000,cache=strict,upcall_target=app,username=ubuntu,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=ubuntu) $ journalctl -b0 kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1505]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x3e8;creduid=0x3e8;user=ubuntu;pid=0x5cb;upcall_target=app cifs.upcall[1506]: ver=2 cifs.upcall[1506]: host=samba-dc.example.com cifs.upcall[1506]: ip=192.168.122.79 cifs.upcall[1506]: sec=1 cifs.upcall[1506]: uid=1000 cifs.upcall[1506]: creduid=1000 cifs.upcall[1506]: user=ubuntu cifs.upcall[1506]: pid=1483 cifs.upcall[1506]: upcall_target=app cifs.upcall[1505]: upcall_target=app, switching namespaces to application thread cifs.upcall[1505]: get_cachename_from_process_env: pathname=/proc/1483/environ cifs.upcall[1505]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000 cifs.upcall[1505]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1505]: handle_krb5_mech: obtained service ticket cifs.upcall[1505]: Exit status 0 Let's try as a different uid user, e.g. like AD user: ubuntu@jammy-dc:~$ export KRB5CCNAME=/tmp/krb5cc_11200 ubuntu@jammy-dc:~$ mv /tmp/krb5cc_1000 /tmp/krb5cc_11200 ubuntu@jammy-dc:~$ klist Ticket cache: FILE:/tmp/krb5cc_11200 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:50:22 06/16/25 14:50:22 krbtgt/[email protected] renew until 06/17/25 04:50:19 06/16/25 04:50:33 06/16/25 14:50:22 cifs/samba-dc.example.com@ renew until 06/17/25 04:50:19 Ticket server: cifs/[email protected] ubuntu@jammy-dc:~$ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1 ubuntu@jammy-dc:~$ mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=1000,cache=strict,upcall_target=app,username=root,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1) $ journalctl -b0 kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo cifs.upcall[1528]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x3e8;user=root;pid=0x5ef;upcall_target=app cifs.upcall[1529]: ver=2 cifs.upcall[1529]: host=samba-dc.example.com cifs.upcall[1529]: ip=192.168.122.79 cifs.upcall[1529]: sec=1 cifs.upcall[1529]: uid=0 cifs.upcall[1529]: creduid=1000 cifs.upcall[1529]: user=root cifs.upcall[1529]: pid=1519 cifs.upcall[1529]: upcall_target=app cifs.upcall[1528]: upcall_target=app, switching namespaces to application thread cifs.upcall[1528]: get_cachename_from_process_env: pathname=/proc/1519/environ cifs.upcall[1528]: get_cachename_from_process_env: cachename = /tmp/krb5cc_11200 cifs.upcall[1528]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_11200 cifs.upcall[1528]: main: valid service ticket exists in credential cache cifs.upcall[1528]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[1528]: handle_krb5_mech: obtained service ticket cifs.upcall[1528]: Exit status 0 Let's try as root user: ubuntu@jammy-dc:~$ kdestroy ubuntu@jammy-dc:~$ unset KRB5CCNAME ubuntu@jammy-dc:~$ sudo -s root@jammy-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 38 days on Fri Jul 25 02:42:43 2025 root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 06/16/25 04:52:33 06/16/25 14:52:33 krbtgt/[email protected] renew until 06/17/25 04:52:29 root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu# mount -l | grep cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,upcall_target=app,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.79,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=root) $ journalctl -b0 Jkernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified Jkernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified Jkernel: CIFS: Attempting to mount \\samba-dc.example.com\demo Jcifs.upcall[1553]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.79;sec=krb5;uid=0x0;creduid=0x0;user=root;pid=0x60d;upcall_target=app Jcifs.upcall[1554]: ver=2 Jcifs.upcall[1554]: host=samba-dc.example.com Jcifs.upcall[1554]: ip=192.168.122.79 Jcifs.upcall[1554]: sec=1 Jcifs.upcall[1554]: uid=0 Jcifs.upcall[1554]: creduid=0 Jcifs.upcall[1554]: user=root Jcifs.upcall[1554]: pid=1549 Jcifs.upcall[1554]: upcall_target=app Jcifs.upcall[1553]: upcall_target=app, switching namespaces to application thread Jcifs.upcall[1553]: get_cachename_from_process_env: pid == 0 Jcifs.upcall[1553]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 Jcifs.upcall[1553]: handle_krb5_mech: getting service ticket for samba-dc.example.com Jcifs.upcall[1553]: handle_krb5_mech: obtained service ticket Jcifs.upcall[1553]: Exit status 0 Everything still mounts okay with the cifs-utils package in -security- proposed. Happy to mark verified for jammy. ** Tags added: verification-done-jammy -- You received this bug notification because you are a member of Debcrafters packages, which is subscribed to cifs-utils in Ubuntu. https://bugs.launchpad.net/bugs/2112614 Title: Regression: After CVE-2025-2312 cifs.upcall can't find credential caches from user env Status in cifs-utils package in Ubuntu: Fix Released Status in cifs-utils source package in Focal: Fix Committed Status in cifs-utils source package in Jammy: Fix Committed Status in cifs-utils source package in Noble: Fix Committed Status in cifs-utils source package in Oracular: Fix Committed Status in cifs-utils source package in Plucky: Fix Committed Status in cifs-utils source package in Questing: Fix Released Bug description: [Impact] Unfortunately, the release of CVE-2025-2312 caused a minor regression for some users of cifs-utils, particularly those with AD users mounting shares from non-standard UID numbers that aren't the default 0 or 1000. Trying to mount a share with credentials in environment variables like $KRB5CCNAME gets messages like: $ echo $KRB5CCNAME /tmp/krb5cc_11200 $ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1 mount error(126): Required key not available Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) Affected packages: questing: 2:7.3-1 plucky: 2:7.2-2 oracular: 2:7.0-2.1ubuntu0.1 noble: 2:7.0-2ubuntu0.1 jammy: 2:6.14-1ubuntu0.2 focal: 2:6.9-1ubuntu0.3 We changed debian/patches/CVE-2025-2312-1.patch: @@ -1384,7 +1423,7 @@ * look at the environ file. */ env_cachename = - get_cachename_from_process_env(env_probe ? arg->pid : 0); + get_cachename_from_process_env((env_probe && (arg->upcall_target == UPTARGET_APP)) ? arg->pid : 0); rc = setuid(uid); if (rc == -1) { Unfortunately, we missed the UPTARGET_UNSPECIFIED option. The fix from Henrique Carvalho simply sets upcall_target to be UPTARGET_APP if UPTARGET_UNSPECIFIED is the current option. This affects users who use the non-patched kernels. I'm broken, please get me a fix / Workarounds: 1) You can install the test packages in the [Testcase] section. or 2) You can enable -proposed and install any of the 5.4.0-218-generic, 5.15.0-142-generic, 6.8.0-62-generic or 6.11.0-28-generic kernels. or 3) You can edit the following files: /etc/krb5.conf - Add this to [libdefaults]: default_ccache_name = /tmp/krb5cc_%{uid} /etc/sssd/sssd.conf - Add this to [domain] krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%{uid} Ideally restart sssd so sssd-pam can find the kerberos crediental cache again. sudo systemctl restart sssd or 4) you can simply downgrade the package to what is in the release pocket. [Testcase] Follow the entire testcase of https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914 first. $ kinit administrator Password for [email protected]: Warning: Your password will expire in 36 days on Sat Jul 12 01:54:39 2025 $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: [email protected] Valid starting Expires Service principal 06/05/25 21:44:07 06/06/25 07:44:07 krbtgt/[email protected] renew until 06/06/25 21:44:04 $ mv /tmp/krb5cc_1000 /tmp/krb5cc_11200 $ klist /tmp/krb5cc_11200 Ticket cache: FILE:/tmp/krb5cc_11200 Default principal: [email protected] Valid starting Expires Service principal 06/05/25 21:44:07 06/06/25 07:44:07 krbtgt/[email protected] renew until 06/06/25 21:44:04 $ export KRB5CCNAME=/tmp/krb5cc_11200 $ sudo mount -t cifs -o sec=krb5i //samba-dc.example.com/demo /mnt/testshare1 mount error(126): Required key not available Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) $ journalctl -b0 kernel: CIFS: Attempting to mount //samba-dc.example.com/demo cifs.upcall[5177]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.248;sec=krb5;uid=0x0;creduid=0x3e8;user=root;pid=0x142c cifs.upcall[5178]: ver=2 cifs.upcall[5178]: host=samba-dc.example.com cifs.upcall[5178]: ip=192.168.122.248 cifs.upcall[5178]: sec=1 cifs.upcall[5178]: uid=0 cifs.upcall[5178]: creduid=1000 cifs.upcall[5178]: user=root cifs.upcall[5178]: pid=5164 cifs.upcall[5177]: upcall_target=app, switching namespaces to application thread cifs.upcall[5177]: get_cachename_from_process_env: pid == 0 cifs.upcall[5177]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_1000 cifs.upcall[5177]: check_service_ticket_exists: unable to get client principal from cache: No credentials cache found (filename: /tmp/krb5cc_1000) cifs.upcall[5177]: get_tgt_time: unable to get principal cifs.upcall[5177]: main: valid TGT is not present in credential cache cifs.upcall[5177]: krb5_get_init_creds_keytab: -1765328378 cifs.upcall[5177]: handle_krb5_mech: getting service ticket for samba-dc.example.com cifs.upcall[5177]: handle_krb5_mech: using GSS-API cifs.upcall[5177]: GSS-API error init_sec_context: No credentials were supplied, or the credentials were unavailable or inaccessible cifs.upcall[5177]: GSS-API error init_sec_context: No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000) cifs.upcall[5177]: handle_krb5_mech: failed to obtain service ticket via GSS (458752) cifs.upcall[5177]: Unable to obtain service ticket cifs.upcall[5177]: Exit status 458752 kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 kernel: CIFS: VFS: cifs_mount failed w/return code = -126 If you install the test packages in the following ppa: https://launchpad.net/~mruffell/+archive/ubuntu/sf407276-regression- test Please note this package is NOT SUPPORTED by Canonical, and is for TESTING PURPOSES ONLY. ONLY Install in a dedicated test environment. Instructions to Install (On a focal, jammy, noble, oracular, plucky system): 1) sudo add-apt-repository ppa:mruffell/sf407276-regression-test 2) sudo apt update 3) sudo apt install cifs-utils 4) sudo apt-cache policy cifs-utils | grep Installed Check for +sf407276v20250531b1 The share mounts normally as expected. [Where problems can occur] This is a part of the fix of CVE-2025-2312, and we need to make sure that we again, test the following scenarios: * patched kernel, patched cifs-utils * patched kernel, existing cifs-utils * existing kernel, patched cifs-utils This time, we really need to spend a bit more time on the unpatched kernel scenario, because clearly I wasn't thorough enough. If a regression were to occur, it could affect mounting of cifs / smb shares and users would not be able to access their data. Due to the nature of this bug, there is no secret leakage from CVE-2025-2312. [Other info] This regression was caused in: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914 This has been fixed upstream in cifs-utils 7.4 by: commit f4fd27cf60d6431d83ea18b4962aef845f9312bd Author: Henrique Carvalho <[email protected]> Date: Fri May 30 12:28:14 2025 -0300 Subject: cifs.upcall: correctly treat UPTARGET_UNSPECIFIED as UPTARGET_APP Link: https://git.samba.org/?p=cifs-utils.git;a=commit;h=f4fd27cf60d6431d83ea18b4962aef845f9312bd Mailing list link: https://lore.kernel.org/linux-cifs/[email protected]/T/ Note, there is an additional regression caused by: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099917 that is getting fixed in: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2113906 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2112614/+subscriptions -- Mailing list: https://launchpad.net/~debcrafters-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~debcrafters-packages More help : https://help.launchpad.net/ListHelp
