diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2014-09-24 11:26:12 -0400 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2014-09-24 11:26:12 -0400 |
| commit | 2d9ea45bdbaf8bd78ce34b99480df548d367082d (patch) | |
| tree | dbfcfdd3b57bfca1163894a08b7ae2d1ba3a5492 | |
| parent | cfbbb7ac24f400d5a37c5fc9fd784bb81e99ed05 (diff) | |
| download | nfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.tar.gz nfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.tar.xz nfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.zip | |
systemd: manually insert auth_rpcgss module.
We need to insert the auth_rpcgss module before starting rpc.svcgssd or
gss-proxy, for two reasons:
- gss-proxy needs access to the /proc/net/rpc/use-gss-proxy file
to set up communication with knfsd.
- the unit files need to able to test for the existance of the
same path in order to decide whether the kernel supports
gss-proxy or not.
Currently we're using dependencies on proc-fs-nfsd.mount for this, but
that works only because of the nfsd kernel module references some
symbols in auth_rpcgss, which is an odd implementation detail we're
likely to fix some day.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
| -rw-r--r-- | systemd/auth-rpcgss-module.service | 14 | ||||
| -rw-r--r-- | systemd/nfs-client.target | 2 | ||||
| -rw-r--r-- | systemd/nfs-server.service | 1 |
3 files changed, 16 insertions, 1 deletions
diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service new file mode 100644 index 0000000..3fc2f4a --- /dev/null +++ b/systemd/auth-rpcgss-module.service @@ -0,0 +1,14 @@ +# We want to start gss-proxy on kernels that support it and rpc.svcgssd +# on those that don't. Those services check for support by checking +# for existence of the path /proc/net/rpc/use-gss-proxy. Before they +# can perform that check, they need this module loaded. (Unless +# rpcsec_gss support is built directly into the kernel, in which case this +# unit will fail. But that's OK.) +[Unit] +Description=Kernel Module supporting RPCSEC_GSS +Before=gssproxy.service rpc-svcgssd.service +ConditionPathExists=/etc/krb5.keytab + +[Service] +Type=oneshot +ExecStart=/sbin/modprobe -q auth_rpcgss diff --git a/systemd/nfs-client.target b/systemd/nfs-client.target index f3c09e7..474f5e9 100644 --- a/systemd/nfs-client.target +++ b/systemd/nfs-client.target @@ -5,7 +5,7 @@ Wants=remote-fs-pre.target # Note: we don't "Wants=rpc-statd.service" as "mount.nfs" will arrange to # start that on demand if needed. -Wants=rpc-gssd.service rpc-svcgssd.service +Wants=rpc-gssd.service rpc-svcgssd.service auth-rpcgss-module.service Wants=nfs-blkmap.service rpc-statd-notify.service Before=rpc-gssd.service rpc-svcgssd.service nfs-blkmap.service diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service index 2fa7387..fd213a3 100644 --- a/systemd/nfs-server.service +++ b/systemd/nfs-server.service @@ -3,6 +3,7 @@ Description=NFS server and services Requires= network.target proc-fs-nfsd.mount rpcbind.target Requires= nfs-mountd.service Wants=rpc-statd.service nfs-idmapd.service rpc-gssd.service rpc-svcgssd.service +Wants=auth-rpcgss-module.service Wants=rpc-statd-notify.service After= network.target proc-fs-nfsd.mount rpcbind.target nfs-mountd.service |