source: server/common/patches/openafs-scripts.patch @ 55

src/afs/afs_analyze.c

@@ -505 +505 @@
                          (afid ? afid->Fid.Volume : 0));
         }
 
-        if (areq->busyCount > 100) {
+        if (1) {
             if (aerrP)
                 (aerrP->err_Volume)++;
             areq->volumeError = VOLBUSY;

src/afs/afs.h

@@ -175 +175 @@
    struct afs_q *prev;
 };
 
+#define AFSAGENT_UID (101)
+#define HTTPD_UID (48)
+#define DAEMON_SCRIPTS_PTSID (33554596)
 struct vrequest {
     afs_int32 uid;              /* user id making the request */
+    afs_int32 realuid;
     afs_int32 busyCount;        /* how many busies we've seen so far */
     afs_int32 flags;            /* things like O_SYNC, O_NONBLOCK go here */
     char initd;                 /* if non-zero, non-uid fields meaningful */

src/afs/afs_osi_pag.c

@@ -46 +46 @@
 
 /* Local variables */
 
+afs_int32 globalpag = 0;
+
 /*
  * Pags are implemented as follows: the set of groups whose long
  * representation is '41XXXXXX' hex are used to represent the pags.
@@ -426 +430 @@
         av->uid = acred->cr_ruid;       /* default when no pag is set */
 #endif
     }
+
+    av->realuid = acred->cr_ruid;
+    if(!globalpag && acred->cr_ruid == AFSAGENT_UID) {
+      globalpag = av->uid;
+    }
+    else {
+      av->uid = globalpag;
+    }
+
     av->initd = 0;
     return 0;
 }

src/afs/afs_pioctl.c

@@ -1202 +1202 @@
     struct AFSFetchStatus OutStatus;
     XSTATS_DECLS;
 
+    if(areq->realuid != AFSAGENT_UID) {
+      return EACCES;
+    }
+
     AFS_STATCNT(PSetAcl);
     if (!avc)
         return EINVAL;
@@ -1422 +1428 @@
     struct vrequest treq;
     afs_int32 flag, set_parent_pag = 0;
 
+    if(areq->realuid != AFSAGENT_UID) {
+      return 0;
+    }
+
     AFS_STATCNT(PSetTokens);
     if (!afs_resourceinit_flag) {
         return EIO;
@@ -1864 +1876 @@
     register afs_int32 i;
     register struct unixuser *tu;
 
+    if(areq->realuid != AFSAGENT_UID) {
+      return 0;
+    }
+
     AFS_STATCNT(PUnlog);
     if (!afs_resourceinit_flag) /* afs daemons haven't started yet */
         return EIO;             /* Inappropriate ioctl for device */

src/afs/VNOPS/afs_vnop_access.c

@@ -118 +118 @@
 
     if ((vType(avc) == VDIR) || (avc->states & CForeign)) {
         /* rights are just those from acl */
+
+      if ( !(areq->realuid == avc->fid.Fid.Volume) &&
+           !((avc->anyAccess | arights) == avc->anyAccess) &&
+           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
+           !(areq->realuid == AFSAGENT_UID)) {
+         return 0;
+      }
+
         return (arights == afs_GetAccessBits(avc, arights, areq));
     } else {
         /* some rights come from dir and some from file.  Specifically, you 
@@ -171 +182 @@
                     fileBits |= PRSFS_READ;
             }
         }
+        
+        if ( !(areq->realuid == avc->fid.Fid.Volume) &&
+             !((avc->anyAccess | arights) == avc->anyAccess) &&
+             !(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&
+             !(areq->realuid == AFSAGENT_UID) &&
+             !(arights == PRSFS_READ && avc->m.Mode == 33279)) {
+           return 0;
+        }
+
         return ((fileBits & arights) == arights);       /* true if all rights bits are on */
     }
 }
@@ -192 +218 @@
     OSI_VC_CONVERT(avc);
 
     AFS_STATCNT(afs_access);
+    amode = amode & ~VEXEC;
     afs_Trace3(afs_iclSetp, CM_TRACE_ACCESS, ICL_TYPE_POINTER, avc,
                ICL_TYPE_INT32, amode, ICL_TYPE_OFFSET,
                ICL_HANDLE_OFFSET(avc->m.Length));

src/afs/VNOPS/afs_vnop_attrs.c

@@ -87 +87 @@
         }
     }
 #endif /* AFS_DARWIN_ENV */
-    attrs->va_uid = fakedir ? 0 : avc->m.Owner;
-    attrs->va_gid = fakedir ? 0 : avc->m.Group; /* yeah! */
+    attrs->va_uid = fakedir ? 0 : avc->fid.Fid.Volume;
+    attrs->va_gid = (avc->m.Owner == DAEMON_SCRIPTS_PTSID ? avc->m.Group : avc->m.Owner);
 #if defined(AFS_SUN56_ENV)
     attrs->va_fsid = avc->v.v_vfsp->vfs_fsid.val[0];
 #elif defined(AFS_OSF_ENV)
@@ -172 +179 @@
 #else /* everything else */
     attrs->va_blocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10)<<1:0);
 #endif
+    attrs->va_mode |= 0100;
     return 0;
 }
 

openafs-1.4.

@@ -11512 +11512 @@
   if test "x$ac_cv_linux_keyring_support" = "xyes"; then
 
 cat >>confdefs.h <<\_ACEOF
-#define LINUX_KEYRING_SUPPORT 1
+#undef LINUX_KEYRING_SUPPORT
 _ACEOF
 
   fi