diff options
| author | NeilBrown <neilb@suse.de> | 2014-02-13 14:09:36 -0500 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2014-03-24 16:30:04 -0400 |
| commit | d86fc0c24e6a20a33c61b2b056901324194a0179 (patch) | |
| tree | 2d634fe0ee8b6e376ffbe761f2c60ff3fce427f0 | |
| parent | 5615e8924e9ebdf6808bb7a5f690a9d7c3af6dcd (diff) | |
| download | nfs-utils-d86fc0c24e6a20a33c61b2b056901324194a0179.tar.gz nfs-utils-d86fc0c24e6a20a33c61b2b056901324194a0179.tar.xz nfs-utils-d86fc0c24e6a20a33c61b2b056901324194a0179.zip | |
systemd: convert secure services to start without explicit
configuration.
This patch removes nfs-secure.target. Instead, rpc.gssd and
rpc.svcgssd start started if they appear to be needed.
For rpc.gssd, this means if the file /etc/krb5.keytab exists.
As the only security mechanism supported is krb5, that file must exist
for rpc.gssd to be useful. Conversely, if it does exist, it seems very
likely that krb5 is configured on the system an may be used for NFS.
For rpc.svcgssd, it also means checking if gss-proxy might be performing
the equivalent task instead. So we check if it is running, and if the
kernel is able to talk to it.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
| -rw-r--r-- | systemd/README | 17 | ||||
| -rw-r--r-- | systemd/nfs-secure.target | 8 | ||||
| -rw-r--r-- | systemd/rpc-gssd.service | 3 | ||||
| -rw-r--r-- | systemd/rpc-svcgssd.service | 6 |
4 files changed, 17 insertions, 17 deletions
diff --git a/systemd/README b/systemd/README index 34f1382..8359530 100644 --- a/systemd/README +++ b/systemd/README @@ -24,11 +24,6 @@ by a suitable 'preset' setting: is started by /usr/sbin/start-statd which mount.nfs will run if statd is needed. - nfs-secure.target - If enabled, then rpc.gssd will be run when either -client or - -server is started, and rpc.svcgssd will be run when -server - is started - nfs-blkmap.target If enabled, then blkmapd will be run when nfs-client.target is started. @@ -63,3 +58,15 @@ This should write /run/sysconfig/nfs-utils based on configuration information such as in /etc/sysconfig/nfs or /etc/defaults/nfs. It should write to a tmp file and rename to the target to avoid parallel units seeing incomplete copies of the file. + +rpc.gssd and rpc.svcgssd are assumed to be needed if /etc/krb5.keytab +is present. +If a site needs this file present but does not want the gss daemons +running, it should create + /etc/systemd/system/rpc-gssd.service.d/01-disable.conf +and + /etc/systemd/system/rpc-svcgssd.service.d/01-disable.conf + +containing + [Unit] + ConditionNull=false diff --git a/systemd/nfs-secure.target b/systemd/nfs-secure.target deleted file mode 100644 index 0127fdb..0000000 --- a/systemd/nfs-secure.target +++ /dev/null @@ -1,8 +0,0 @@ -[Unit] -Description=Secure NFS client/server services -# If this target is enabled, then rpc.gssd and rpc.svcgssd will be started -# as required. If it is not enabled they won't. - -[Install] -WantedBy=remote-fs.target -WantedBy=multi-user.target
\ No newline at end of file diff --git a/systemd/rpc-gssd.service b/systemd/rpc-gssd.service index 2285982..3757928 100644 --- a/systemd/rpc-gssd.service +++ b/systemd/rpc-gssd.service @@ -5,8 +5,7 @@ Conflicts=umount.target Requires=var-lib-nfs-rpc_pipefs.mount After=var-lib-nfs-rpc_pipefs.mount -Requisite=nfs-secure.target -After=nfs-secure.target +ConditionPathExists=/etc/krb5.keytab PartOf=nfs-utils.service diff --git a/systemd/rpc-svcgssd.service b/systemd/rpc-svcgssd.service index fa169e7..6bd4588 100644 --- a/systemd/rpc-svcgssd.service +++ b/systemd/rpc-svcgssd.service @@ -5,8 +5,10 @@ After=var-lib-nfs-rpc_pipefs.mount PartOf=nfs-server.service PartOf=nfs-utils.service -Requisite=nfs-secure.target -After=nfs-secure.target +After=gssproxy.service +ConditionPathExists=|!@localstatedir@/run/gssproxy.pid +ConditionPathExists=|!/proc/net/rpc/use-gss-proxy +ConditionPathExists=/etc/krb5.keytab [Service] EnvironmentFile=-/run/sysconfig/nfs-utils |