summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2014-09-24 11:26:12 -0400
committerSteve Dickson <steved@redhat.com>2014-09-24 11:26:12 -0400
commit2d9ea45bdbaf8bd78ce34b99480df548d367082d (patch)
treedbfcfdd3b57bfca1163894a08b7ae2d1ba3a5492
parentcfbbb7ac24f400d5a37c5fc9fd784bb81e99ed05 (diff)
downloadnfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.tar.gz
nfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.tar.xz
nfs-utils-2d9ea45bdbaf8bd78ce34b99480df548d367082d.zip
systemd: manually insert auth_rpcgss module.
We need to insert the auth_rpcgss module before starting rpc.svcgssd or gss-proxy, for two reasons: - gss-proxy needs access to the /proc/net/rpc/use-gss-proxy file to set up communication with knfsd. - the unit files need to able to test for the existance of the same path in order to decide whether the kernel supports gss-proxy or not. Currently we're using dependencies on proc-fs-nfsd.mount for this, but that works only because of the nfsd kernel module references some symbols in auth_rpcgss, which is an odd implementation detail we're likely to fix some day. Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
-rw-r--r--systemd/auth-rpcgss-module.service14
-rw-r--r--systemd/nfs-client.target2
-rw-r--r--systemd/nfs-server.service1
3 files changed, 16 insertions, 1 deletions
diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service
new file mode 100644
index 0000000..3fc2f4a
--- /dev/null
+++ b/systemd/auth-rpcgss-module.service
@@ -0,0 +1,14 @@
+# We want to start gss-proxy on kernels that support it and rpc.svcgssd
+# on those that don't. Those services check for support by checking
+# for existence of the path /proc/net/rpc/use-gss-proxy. Before they
+# can perform that check, they need this module loaded. (Unless
+# rpcsec_gss support is built directly into the kernel, in which case this
+# unit will fail. But that's OK.)
+[Unit]
+Description=Kernel Module supporting RPCSEC_GSS
+Before=gssproxy.service rpc-svcgssd.service
+ConditionPathExists=/etc/krb5.keytab
+
+[Service]
+Type=oneshot
+ExecStart=/sbin/modprobe -q auth_rpcgss
diff --git a/systemd/nfs-client.target b/systemd/nfs-client.target
index f3c09e7..474f5e9 100644
--- a/systemd/nfs-client.target
+++ b/systemd/nfs-client.target
@@ -5,7 +5,7 @@ Wants=remote-fs-pre.target
# Note: we don't "Wants=rpc-statd.service" as "mount.nfs" will arrange to
# start that on demand if needed.
-Wants=rpc-gssd.service rpc-svcgssd.service
+Wants=rpc-gssd.service rpc-svcgssd.service auth-rpcgss-module.service
Wants=nfs-blkmap.service rpc-statd-notify.service
Before=rpc-gssd.service rpc-svcgssd.service nfs-blkmap.service
diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service
index 2fa7387..fd213a3 100644
--- a/systemd/nfs-server.service
+++ b/systemd/nfs-server.service
@@ -3,6 +3,7 @@ Description=NFS server and services
Requires= network.target proc-fs-nfsd.mount rpcbind.target
Requires= nfs-mountd.service
Wants=rpc-statd.service nfs-idmapd.service rpc-gssd.service rpc-svcgssd.service
+Wants=auth-rpcgss-module.service
Wants=rpc-statd-notify.service
After= network.target proc-fs-nfsd.mount rpcbind.target nfs-mountd.service