ksmbd's login extension and SIDs for UUID and GUID users, NFSv4 owner strings, and what AUTH_SYS and the SMB3 POSIX extensions can't carry. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Jan Koester --- Documentation/userspace-api/uid_r.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/Documentation/userspace-api/uid_r.rst b/Documentation/userspace-api/uid_r.rst index c080485455..d16d4317f5 100644 --- a/Documentation/userspace-api/uid_r.rst +++ b/Documentation/userspace-api/uid_r.rst @@ -159,11 +159,28 @@ RPCSEC_GSS upcalls user as ``__kernel_uid_r_t``, then the usual fields. The binary (v0) upcall can't carry such users and fails with ``EACCES``. +SMB (ksmbd) + The login response extension (``struct ksmbd_login_response_ext``) + carries the user's ids as ``__kernel_uid_r_t`` with + ``KSMBD_LOGIN_EXT_ID_R`` and the supplementary groups as + ``__kernel_gid_r_t`` with ``KSMBD_LOGIN_EXT_GROUPS_R``. Such users and + groups appear in security descriptors as + ``S-1-22--w0-w1-w2-w3``: kind 3 and 4 for a UUID user and group, + 5 and 6 for a GUID user and group, w0 to w3 the 16 bytes of the id as + big endian words. + +NFSv4 + Owners and ACL principals that are UUIDs or GUIDs travel as their text + form, on the server and the client, with or without idmapd. + Limitations =========== - Quotas don't account UUID and GUID owners; quota files hold 32 bit ids. - RPCSEC_GSS needs a gssd that knows ``uid_r=`` for UUID and GUID users. +- NFS with AUTH_SYS sends a 32 bit uid: a UUID or GUID user on a client + reaches the server as the overflow id. +- The SMB3 POSIX extensions' fixed size SID fields show the overflow id. - UUID and GUID users can't create unprivileged ublk devices. - Audit filter rules, SafeSetID policies and IMA policy rules name classic ids only. -- 2.56.0