fix: use syscall.Chmod to correctly handle setgid/setuid/sticky bits in mountPermissions by andyzhangx · Pull Request #1106 · kubernetes-csi/csi-driver-nfs

andyzhangx · 2026-04-18T03:05:54Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

When mountPermissions includes setgid (e.g. 02770), setuid, or sticky bits, os.Chmod with os.FileMode silently drops these special bits because Go os.FileMode uses different bit positions than raw Unix mode bits.

For example, mountPermissions: "2770" (setgid + rwxrwx---) parsed as octal gives 02770, but os.Chmod(path, os.FileMode(02770)) only applies 0770 — the setgid bit is lost.

This PR switches to syscall.Chmod which takes raw Unix mode bits directly and correctly applies setgid/setuid/sticky bits.

Changes:

pkg/nfs/chmod_unix.go: Platform-specific chmod() using syscall.Chmod for correct special bit handling
pkg/nfs/chmod_windows.go: Windows fallback using os.Chmod (special bits not supported on Windows)
pkg/nfs/utils.go:
- Add unixModeToFileMode() to convert raw Unix mode to Go os.FileMode for accurate permission comparison
- Update chmodIfPermissionMismatch() to use uint32 parameter (raw Unix mode_t) and compare including setuid/setgid/sticky bits
pkg/nfs/controllerserver.go: Use chmodIfPermissionMismatch in CreateVolume for consistency
pkg/nfs/chmod_unix_test.go: Add tests for setgid (02770), sticky (01777), and setuid (04755) bits
hack/boilerplate/boilerplate.py: Update regex to support //go:build constraint syntax

Which issue(s) this PR fixes:

Ref #940

Does this PR introduce a user-facing change?

Fix mountPermissions to correctly apply setgid, setuid, and sticky bits (e.g. 02770) by using syscall.Chmod instead of os.Chmod.

…in mountPermissions os.Chmod with os.FileMode does not correctly map Unix setgid (02000), setuid (04000), or sticky (01000) bits because Go os.FileMode uses different bit positions for these flags. For example, mountPermissions of 02770 (setgid + rwxrwx) would only apply 0770 via os.Chmod, silently dropping the setgid bit. Switch to syscall.Chmod which takes raw Unix mode bits directly. Also use chmodIfPermissionMismatch in CreateVolume for consistency, and use 0777 for MkdirAll in NodePublishVolume since the subsequent chmodIfPermissionMismatch handles the actual permission setting. Ref 940

k8s-ci-robot · 2026-04-18T03:05:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyzhangx

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [andyzhangx]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

This PR aims to fix mountPermissions handling so that special mode bits (setuid/setgid/sticky) are correctly applied when provisioning/mounting NFS volumes.

Changes:

Switch chmodIfPermissionMismatch to use a raw-mode chmod implementation intended to preserve setuid/setgid/sticky bits.
Reuse chmodIfPermissionMismatch from CreateVolume for consistent permission setting.
Create mountpoint directories with 0777 prior to mount (relying on the subsequent chmod step for final permissions).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
pkg/nfs/utils.go	Updates chmod logic to use a raw-mode chmod call and adds rationale in comments.
pkg/nfs/controllerserver.go	Routes CreateVolume’s permission reset through `chmodIfPermissionMismatch`.
pkg/nfs/nodeserver.go	Creates target mount directory with `0777` instead of `mountPermissions`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

k8s-triage-robot · 2026-04-18T06:30:52Z

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-contributor-experience at kubernetes/community.

/check-cla
/easycla

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…n mask, add special-bit tests - Split syscall.Chmod into platform-specific files (chmod_unix.go, chmod_windows.go) with build tags to avoid breaking Windows builds - Fix permission comparison mask in chmodIfPermissionMismatch to include setuid/setgid/sticky bits, not just os.ModePerm (0777) - Add fileModeToUnixMode helper to correctly convert raw Unix mode values to Go's os.FileMode representation - Add unit tests for special bits (02770, 01777, 04755) in chmod_unix_test.go

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

andyzhangx · 2026-04-19T02:11:25Z

/retest

andyzhangx · 2026-04-19T11:25:13Z

/retest

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

andyzhangx · 2026-04-20T01:19:08Z

/cherrypick release-4.13

k8s-infra-cherrypick-robot · 2026-04-20T01:19:48Z

@andyzhangx: new pull request created: #1110

Details

In response to this:

/cherrypick release-4.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. labels Apr 18, 2026

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 18, 2026

k8s-ci-robot requested review from RaunakShah and jingxu97 April 18, 2026 03:06

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Apr 18, 2026

andyzhangx requested a review from Copilot April 18, 2026 03:06

Copilot started reviewing on behalf of andyzhangx April 18, 2026 03:07 View session

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread pkg/nfs/utils.go Outdated

Comment thread pkg/nfs/utils.go Outdated

Comment thread pkg/nfs/utils.go Outdated

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 18, 2026

andyzhangx force-pushed the fix-mountpermissions-chmod branch 2 times, most recently from a44de06 to c514194 Compare April 18, 2026 04:27

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 18, 2026

andyzhangx force-pushed the fix-mountpermissions-chmod branch 3 times, most recently from 42c4d44 to 97a5632 Compare April 18, 2026 06:59

andyzhangx requested a review from Copilot April 18, 2026 14:03

Copilot started reviewing on behalf of andyzhangx April 18, 2026 14:04 View session

andyzhangx force-pushed the fix-mountpermissions-chmod branch from 97a5632 to 7537bb6 Compare April 18, 2026 14:06

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread pkg/nfs/utils.go

Comment thread pkg/nfs/nodeserver.go Outdated

Comment thread pkg/nfs/chmod_unix_test.go Outdated

Comment thread pkg/nfs/utils.go Outdated

Comment thread pkg/nfs/utils.go Outdated

Comment thread pkg/nfs/utils.go Outdated

Comment thread pkg/nfs/utils.go Outdated

andyzhangx force-pushed the fix-mountpermissions-chmod branch from 7537bb6 to e978534 Compare April 18, 2026 14:22

andyzhangx requested a review from Copilot April 18, 2026 14:24

Copilot started reviewing on behalf of andyzhangx April 18, 2026 14:24 View session

Copilot AI reviewed Apr 18, 2026

View reviewed changes

Comment thread pkg/nfs/nodeserver.go Outdated

andyzhangx force-pushed the fix-mountpermissions-chmod branch from e978534 to f213ed7 Compare April 18, 2026 14:44

andyzhangx requested a review from Copilot April 19, 2026 01:16

Copilot started reviewing on behalf of andyzhangx April 19, 2026 01:16 View session

Copilot AI reviewed Apr 19, 2026

View reviewed changes

Comment thread pkg/nfs/utils.go

test: use mountPermissions 2770 in default e2e test to cover setgid

d4a3a0d

andyzhangx requested a review from Copilot April 19, 2026 13:46

Copilot started reviewing on behalf of andyzhangx April 19, 2026 13:47 View session

Copilot AI reviewed Apr 19, 2026

View reviewed changes

fix: use octal prefix for mountPermissions "02770" in e2e test

8ef6c83

andyzhangx merged commit 89e01f8 into kubernetes-csi:master Apr 20, 2026
16 of 17 checks passed

k8s-infra-cherrypick-robot mentioned this pull request Apr 20, 2026

[release-4.13] fix: use syscall.Chmod to correctly handle setgid/setuid/sticky bits in mountPermissions #1110

Merged

andyzhangx mentioned this pull request Apr 20, 2026

mountPermissions is applied to the root directory of the NFS server. #940

Closed

Conversation

andyzhangx commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Changes:

Which issue(s) this PR fixes:

Does this PR introduce a user-facing change?

Uh oh!

k8s-ci-robot commented Apr 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

k8s-triage-robot commented Apr 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

andyzhangx commented Apr 19, 2026

Uh oh!

andyzhangx commented Apr 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

andyzhangx commented Apr 20, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

andyzhangx commented Apr 18, 2026 •

edited

Loading