Re: [PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

[Ameer Hamza <ameer.hamza@truenas.com>]

On Fri, Aug 14, 2026 at 04:02:23PM -0400, Chuck Lever wrote:
> 
> 
> On Fri, Aug 14, 2026, at 1:25 PM, Ameer Hamza wrote:
> > When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
> > failure, e.g. while winbind or sssd is briefly unreachable), it
> > answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
> > installs that as a valid positive entry, and svcauth_unix_set_client()
> > then replaces the credential's group list with the empty one on
> > every request, RPCSEC_GSS included via svcauth_gss_set_client().
> > One failed lookup strips that uid of all supplementary groups on
> > every export for up to mountd's configured TTL (30 minutes by
> > default), long after the NSS backend has recovered.
> >
> > mountd cannot send an empty list for a successful lookup, since
> > getgrouplist(3) always includes at least the user's primary group,
> > so a zero-group reply can only mean the lookup failed. Record it as
> > a negative entry: unix_gid_find() then returns -ENOENT and
> > svcauth_unix_set_client() keeps the groups the RPC credential
> > already carries. This is the fallback that
> > commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
> > gid list when using AUTH_UNIX authentication") promised when no
> > answer is available, and the same state try_to_negate_entry()
> > already creates when no listener holds the channel open.
> >
> > Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid 
> > list when using AUTH_UNIX authentication")
> > Assisted-by: Claude:claude-fable-5
> > Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
> 
> Looks like the same bug exists for the new mountd netlink
> mechanism. Since that instance of the bug arrived in a
> different commit, that fix needs to be a separate patch
> with its own Fixes: tag.
> 
> Can you make this a two-patch series?
> 
> 
> -- 
> Chuck Lever

Sure, will send v2 with the netlink fix as a separate patch. Thanks for taking a look.