summaryrefslogtreecommitdiffstats
path: root/support
Commit message (Collapse)AuthorAgeFilesLines
...
* libexport.a: Clean up client_compose() and client_member()Chuck Lever2010-03-222-17/+29
| | | | | | | | Clean up: Replace outdated comments, and fix some function declarations. Use proper type for a couple of automatic variables. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libexport.a: Remove dead codeChuck Lever2010-03-222-24/+0
| | | | | | | | Clean up: I can't find any call sites for client_find() or client_match(). Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: fix --manage-gids hang due to int/uint bugSteve Dickson2010-03-081-0/+19
| | | | | | | | | | | | | A uid or gid should be represented as unsigned, not signed. The conversion to signed here could cause a hang on access by an unknown user to a server running mountd with --manage-gids; such a user is likely to be mapped to 232-1, which may be converted to 231-1 when represented as an int, resulting in a downcall for uid 231-1, hence the original rpc hanging forever waiting for a cache downcall for 232-1. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Use authunix_create() instead of authsys_create() to fix regression.Steve Dickson2010-03-081-1/+1
| | | | | | | | | | | | | Commit 409b8 introduced a regression when the --disable-tirpc configuration flag is set. The authsys_create() interface, which was introduced, does not exist in the legacy glibc library. Since the authsys_create() interface is a redefined of the authunix_create() interface, which is defined in glibc, using authunix_create() resolves the regression, Acked-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: add and use nfs_authsys_createJeff Layton2010-03-012-0/+24
| | | | | | | | | | | | | | | | | | The current mount, umount and showmount code uses authunix_create_default to get an auth handle. The one provided by glibc returned a truncated list of groups when there were more than 16 groups. libtirpc however currently does an abort() in this case, which causes the program to crash and dump core. nfs-utils just uses these auth handles for the MNT protocol, so the group list doesn't make a lot of difference here. Add a new function that creates an auth handle with a supplemental gids list that consists only of the primary gid. Have nfs-utils use that function anywhere that it currently uses authunix_create_default. Also, have the caller properly check for a NULL return from that function. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfsd: Disble NFS 4.1 functionality by defaultSteve Dickson2010-02-171-0/+6
| | | | | | | | | | | | Due to the fact the current kernel code do not completely conform to the NFS 4.1 RFC, this patch disable the 4.1 support on the server. To control this 41 functionality, the NFS41_SUPPORTED configuration variable now exist that will allow us to re enable the functionality without any code changes. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: don't fdatasync the rmtabBen Myers2010-02-122-8/+20
| | | | | | | If we're using the new caching interface the rmtab will be ignored by exportfs so there is no need to fdatasync. This improves mountd performance. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: remove xflock timeoutBen Myers2010-02-121-17/+1
| | | | | | | Remove this 10 second timeout which can cause unexpected behavior and corruption in the rmtab when hit. Signed-off-by: Steve Dickson <steved@redhat.com>
* Teach nfs_compare_sockaddr() to handle NULL arguments.Steve Dickson2010-01-251-0/+4
| | | | | Reviewed-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* tcpwrapper: Add support for IPv6Chuck Lever2010-01-172-37/+81
| | | | | | | | | | Assuming the tcp_wrappers library can actually support IPv6 addresses, here's a crack at IPv6 support in nfs-utils' TCP wrapper shim. Some reorganization is done to limit the number of times that @sap is converted to a presentation address string. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* tcpwrapper: Eliminated shadowed declaration warningsChuck Lever2010-01-172-19/+16
| | | | | | | | | | | | | | | | | | | | | | Clean up: the use of identifiers called "access" and "daemon" shadow function declarations in unistd.h. Seen with "-Wextra -pedantic". tcpwrapper.c: In function haccess_add: tcpwrapper.c:112: warning: declaration of access shadows a global declaration /usr/include/unistd.h:288: warning: shadowed declaration is here tcpwrapper.c: In function good_client: tcpwrapper.c:161: warning: declaration of daemon shadows a global declaration /usr/include/unistd.h:953: warning: shadowed declaration is here tcpwrapper.c: In function check_default: tcpwrapper.c:212: warning: declaration of daemon shadows a global declaration /usr/include/unistd.h:953: warning: shadowed declaration is here good_client() is used only in support/misc/tcpwrapper.c, so make it static (and update its prototype to c99 standard form). Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* tcpwrapper: Fix signage problems in the tcp_wrappers hash functionChuck Lever2010-01-171-14/+20
| | | | | | | | | | | | | | | | | | | | Eliminate the following compiler warnings: tcpwrapper.c:78: warning: no previous prototype for strtoint tcpwrapper.c: In function strtoint tcpwrapper.c:81: warning: conversion to int size_t may change the sign of the result tcpwrapper.c:85: warning: conversion to unsigned int from int may change the sign of the result tcpwrapper.c: In function hashint: tcpwrapper.c:91: warning: conversion to int from unsigned int may change the sign of the result The hash value is probably computed consistently even with unexpected sign inversions. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* tcp_wrapper: Clean up logit()Chuck Lever2010-01-172-39/+25
| | | | | | | | | | | | | | | | | | | | | | | | | Eliminate these compiler warnings: tcpwrapper.c: In function logit tcpwrapper.c:225: warning: unused parameter procnum tcpwrapper.c:225: warning: unused parameter prognum Actually, @procnum is not used anywhere in our tcpwrapper.c, so let's just get rid of it. Since there is only one logit() call site in tcpwrapper.c, the macro wrapper just adds needless clutter. Let's get rid of that too. Finally, both mountd and statd now use xlog(), which adds an appropriate program name prefix to every message. Replace the open-coded syslog(2) call with an xlog() call in order to consistently identify the RPC service reporting the intrusion. Since logit() no longer references "deny_severity" and no nfs-utils caller sets either allow_severity or deny_severity, we remove them. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* tcp_wrappers: Use getifaddrs(3) if it is availableChuck Lever2010-01-173-9/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After glibc 2.3.3, getifaddrs(3) can return AF_INET6 addresses for local network interfaces. Using the library call is easier than trying to update the open code in from_local(), and means we have less to maintain in nfs-utils going forward. And, since from_local() can now support IPv6, change its synopsis to take a "struct sockaddr *" . Note that the original code discovers local addresses once. These days, with wifi, DHCP, and NetworkManager, the local network configuration can change dynamically over time. So, call getifaddrs() more often to ensure from_local() has up-to-date network configuration information. This implementation refreshes the list if from_local() has not been called in the last second. This is actually not terribly honerous. check_default() invokes from_local() only when the remote host is not in its access cache, or the access/deny files have changed. So new hosts will cause a refresh, but previously seen hosts (including localhost) should not. On the other hand, it still may not be often enough. After the first call, if only previously seen hosts attempt to access our daemons, from_local() would never be called, and the local list would never be updated. This might be possible during steady-state operation with a small number of servers and clients. It would also be nice if we could free the local interface address list at shutdown time, but that would be a lot of trouble for little gain. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* tcpwrappers: Use xlog() instead of perror(3) and syslog(2)Chuck Lever2010-01-171-12/+13
| | | | | | | | | | | | Clean up: Replace calls to syslog(2) and perror(3) in from_local.c with calls to xlog(). The problems displayed by the perror(3) calls especially should be reported. Currently they are never seen in the system log. As part of a build test, I defined TEST, and found a couple of problems with main(), which are also addressed in this patch. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* Tone down a number xlog messages in svc_create_bindaddr()Steve Dickson2010-01-151-11/+5
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* statd: Support TI-RPC statd listenerChuck Lever2010-01-153-2/+260
| | | | | | | | | | | | | | | | | | | | If TI-RPC is available, use it to create statd's svc listener. If not, use the old function, rpc_init(), to create statd's listener. IPv6 can be supported if TI-RPC is available. In this case, /etc/netconfig is searched to determine which transports to advertise. Add the new listener creation API in libnfs.a since other components of nfs-utils (such as rpc.mountd) will eventually want to share it. A little re-arrangement of when the statd listener is created is done to make unregistration of the statd service more reliable. As it is now, the statd service is never unregistered when it exits. After it is gone, other programs usually hang when trying to access statd or see if it's running, since the registration is still there but statd itself does not respond. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* libnsm.a: retain CAP_NET_BIND when dropping privilegesChuck Lever2010-01-151-1/+40
| | | | | | | | | | | | | | | | | I'm about to switch the order of listener creation and dropping root privileges. rpc.statd will drop privileges first, then create its listeners. The reason for the new ordering is explained in a subsequent patch. However, for non-TI-RPC builds, rpc_init() needs to use a privileged port to do pmap registrations. For both TI-RPC and non-TI-RPC builds, CAP_NET_BIND is required in case the admin requests a privileged listener port on the statd command line. So that these requirements are met, nsm_drop_privileges() will now retain CAP_NET_BIND while dropping root. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* libnsm.a: Add support for multiple lines in monitor record filesChuck Lever2010-01-152-12/+155
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To support IPv6, statd must support multi-homed remote peers. For our purposes, "multi-homed peer" means that more than one unique IP address maps to the one canonical host name for that peer. An SM_MON request from the local lockd has a "mon_name" argument that statd reverse maps to a canonical hostname (ie the A record for that host). statd assumes the canonical hostname is unique enough that it stores the callback data for this mon_name in a file named after that canonical hostname. Because lockd can't distinguish between two unique IP addresses that may be from the same physical host, the kernel can hand statd a mon_name that maps to the same canonical hostname as some previous mon_name. So that the kernel can keep this instance of the mon_name unique, it creates a fresh priv cookie for each new address. Note that a mon_name can be a presentation address string, or the caller_name string sent in each NLMPROC_LOCK request. There's nothing that requires the caller_name to be a fully-qualified hostname, thus it's uniqueness is not guaranteed. The current design of statd assumes that canonical hostnames will be unique enough. When a mon_name for a fresh SM_MON request maps to the same canonical hostname as an existing monitored peer, but the priv cookie is new, statd will try to write the information for the fresh request into an existing monitor record file, wiping out the contents of the file. This is because the mon_name/cookie combination won't match any record statd already has. Currently, statd doesn't check if a record file already exists before writing into it. statd's logic assumes that the svc routine has already checked that no matching record exists in the in-core monitor list. And, it doesn't use O_EXCL when opening the record file. Not only is the old data in that file wiped out, but statd's in-core monitor list will no longer match what's in the on-disk monitor list. Note that IPv6 isn't needed to exercise multi-homed peer support. Any IPv4 peer that has multiple addresses that map to its canonical hostname will trigger this behavior. However, this scenario will become quite common when all hosts on a network automatically get both an IPv4 address and an IPv6 address. I can think of a few ways to address this: 1. Replace the current on-disk format with a database that has a uniqueness constraint on the monitor records 2. Create a new file naming scheme; eg. one that uses a truly unique name such as a hash generated from the mon_name, my_name, and priv cookie 3. Support multiple lines in each monitor record file Since statd's on-disk format constitutes a formal API, options 1 and 2 are right out. This patch implements option 3. There are two parts: adding a new line to an existing file; and deleting a line from a file with more than one line. Interestingly, the existing code already supports reading more than one line from these files, so we don't need to add extra code here to do that. One file may contain a line for every unique mon_name / priv cookie where the mon_name reverse maps to the same canonical hostname. We use the atomic write facility added by a previous patch to ensure the on-disk monitor record list is updated atomically. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* libnsm.a: Factor atomic write code out of nsm_get_state()Chuck Lever2010-01-151-45/+89
| | | | | | | | | | | | We're about to use the same logic (mktemp, write, rename) for other new purposes, so pull it out into its own function. This change also addresses a latent bug: O_TRUNC is now used when creating the temporary file. This eliminates the possibility of getting stale data in the temp file, if somehow a previous "atomic write" was interrupted and didn't remove the temporary file. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* nfs-utils: Collect socket address helpers into one locationChuck Lever2010-01-154-68/+257
| | | | | | | | | | | | | Introduce generic helpers for managing socket addresses. These are general enough that they are useful for pretty much any component of nfs-utils. We also include the definition of nfs_sockaddr here, so it can be shared. See: https://bugzilla.redhat.com/show_bug.cgi?id=448743 Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* libnsm.a: Add RPC construction helper functionsChuck Lever2010-01-153-1/+560
| | | | | | | | | | | | | | | | | | | To manage concurrency, both statd and sm-notify construct raw RPC requests in socket buffers, and use a minimal request scheduler to send these requests and manage replies. Both statd and sm-notify open code the RPC request construction. Introduce helper functions that can construct and send raw NSMPROC_NOTIFY, NLM downcalls, and portmapper calls over a datagram socket, and receive and parse their replies. Support for IPv6 and RPCB_GETADDR is featured. This code (and the IPv6 support it introduces) can now be shared by statd and sm-notify, eliminating code and bug duplication. This implementation is based on what's in utils/statd/rmtcall.c now, but is wrapped up in a nice API and includes extra error checking. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
* Revert "Automatically set 'nohide' on referral exports."J. Bruce Fields2010-01-131-6/+0
| | | | | | | | | | | | | This partially reverts commit ec637de16210c1c6fcb3a0df34d7889592f577dc. Only NFSv4 clients will actually want to see referall points--others are better off just seeing an empty directory, that they can manually (or with automount) mount the appropriate filesystem on. So we want the kernel to automatically traverse only in the v4 case (as recent kernels do). Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* exports: common exportent initializerJ. Bruce Fields2010-01-131-32/+27
| | | | | | Consolidate duplicated initialization code. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* exports: export_read() cleanupJ. Bruce Fields2010-01-131-19/+21
| | | | | | Use standard indentation, move warnings to helper function. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* exports: turn on pseudo exportsSteve Dickson2010-01-131-0/+6
| | | | | | | | If a pseudo root is not defined in the export file, the v4root_needed global variable will be set, signaling v4root_set() create the dynamic pseudo root. Signed-off-by: Steve Dickson <steved@redhat.com>
* exports: NFSv4 pseudoroot support routinesSteve Dickson2010-01-133-1/+18
| | | | | | | | | Create v4root exports for each directory that is a parent of an explicit export. Give each the minimal security required to traverse to any of its children. Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* exports: add new flag for NFSv4 pseudorootSteve Dickson2010-01-131-0/+1
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* exports: let kernel decide which flags vary by flavorJ. Bruce Fields2010-01-133-27/+75
| | | | | | | | | Query the kernel to ask which flavors vary by pseudoflavor, and use that instead of a fixed constant. To allow the possibility of more flags varying by pseudoflavor, use the set/clear_flags functions for all options instead of setting some by hand. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* exports: minor parse_opts cleanupJ. Bruce Fields2010-01-131-5/+13
| | | | | | | Move this into a helper function. (We'll be adding a little more code here.) Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
* nfs-utils: make private cookie to hex conversion a library routineJeff Layton2010-01-122-10/+36
| | | | | Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libnsm.a: Introduce common routines to handle persistent storageChuck Lever2010-01-124-1/+886
| | | | | | | | | | | | | | | | | | | | | | | | | | | | rpc.statd and sm-notify access the same set of files under /var/lib/nfs/statd, but both have their own code base to handle this. They should share this code. In addition, the on-disk format used by statd and friends is considered a formal interface, so this new code will codify the API and provide documentation for it. The shared code handles switching from the default parent statd directory, reducing privileges at start-up, and managing the NSM state files, in addition to handling normal operations on the monitored host and notification lists on disk. The new code is simply a copy of the same logic that was used in rpc.statd and sm-notify, but wrapped in a nice API. There should be minimal behavioral and no on-disk format changes with the new libnsm.a code. The new code is more careful to check for bad corner cases. Occassionally this code may not allow an operation that was permitted in the past, but hopefully the error reporting has improved enough that it should be easy to track down any problems. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libnsm.a: Move the sm_inter XDR pieces to libnsm.aChuck Lever2009-12-233-1/+177
| | | | | | | | | | | | | | | | | | | | | Clean up: Move the .x file and the generated C source for NSM to libnsm.a, echoing the architecture of mountd and exportfs. This makes the NSM protocol definitions, data types, and XDR routines available to be shared across nfs-utils. This simplifies the addition of other NSM-related code (for example for testing or providing clustering support), and also provides public data type definitions that can be used to make sense of the contents of statd's on-disk database. Because sim_sm_inter.x still resides in utils/statd, I've left some rpcgen build magic in utils/statd/Makefile.am. This is an internal organization change only. This patch should not affect code behavior in any way. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libexport.a: fix a long-standing typo in name_cmp()Chuck Lever2009-12-231-1/+1
| | | | | | | | | Not sure what "(!*a || !a == ',')" means... but just a few lines later is "(!*a || *a == ',')". I think "a is '\0' or ','" is what was intended. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libnfs.a: Provide shared helpers for managing netidsChuck Lever2009-12-112-7/+97
| | | | | | | | Introduce a couple of shared functions that can convert netids to protocol numbers and families, and back. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* statd: Replace note() with xlog() in rpc.statdChuck Lever2009-11-241-4/+0
| | | | | | | | | | | To facilitate code sharing between statd and sm-notify (and with other components of nfs-utils), replace sm-notify's nsm_log() with xlog(). Since opt_quiet is used in only a handful of insignificant cases, it is removed. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Added wrappers around the setting of default valuesSteve Dickson2009-10-271-5/+0
| | | | | | | from the config file which will be compiled out when the config file is not enabled. Signed-off-by: Steve Dickson <steved@redhat.com>
* Introducing the parsing of both 'defaultvers' and 'defaultproto'Steve Dickson2009-10-221-0/+7
| | | | | | | | | | | config variables which will be used to set the the default version and network protocol. A global variable will be set for each option with the corresponding value. The value will be used as the initial value in the server negation. Signed-off-by: Steve Dickson <steved@redhat.com>
* Cleaned up some warnings in the mount config file code.Steve Dickson2009-08-271-0/+1
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* Cleaned up parsing errors to hopeful be more preciseSteve Dickson2009-08-171-5/+5
| | | | | | | Also had mount_config_init() call xlog_open() so the program name is set on xlog() calls. Signed-off-by: Steve Dickson <steved@redhat.com>
* Added support for line comments parsing which shouldBenny Halevy2009-08-171-5/+19
| | | | | | help with readability with in the configuration file. Signed-off-by: Steve Dickson <steved@redhat.com>
* Now that only the Section names are case-insensitiveSteve Dickson2009-08-162-12/+10
| | | | | | | | | the mount code has to make sure the the mount options given to the kernel are in the correct case. Fixed a couple of warnings on #ifndefs Signed-off-by: Steve Dickson <steved@redhat.com>
* Added an conditional argument to the Section namesSteve Dickson2009-08-162-19/+97
| | | | | | | | | | | | | | with the format being: [ Section <"argument"> ] This will help group similar functioning Section together. The argument is conditional but must be surrounded by the '"' characters. The new conf_get_section() interface can used to locate a Section by its Section name and/or argument. Signed-off-by: Steve Dickson <steved@redhat.com>
* Make Section names case-insensitive which shouldSteve Dickson2009-08-161-0/+15
| | | | | | | help in locating them resulting in make the config files a bit less error prone Signed-off-by: Steve Dickson <steved@redhat.com>
* Taught conf_parse_line() to ignore spaces in theSteve Dickson2009-08-161-9/+26
| | | | | | '[section]' parsing and before the assignment statements Signed-off-by: Steve Dickson <steved@redhat.com>
* Move idmapd's configuration file parsing routines intoSteve Dickson2009-08-164-2/+920
| | | | | | | the shared libnfs.a library, making them available to\ other daemons and programs. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: clean up NFSCTL_* macros for handling protocol bitsJeff Layton2009-08-011-4/+11
| | | | | | | | | | They are a little hard to follow currently. Clean them up and add new macros that can set these bits in addition to the ones that unset them. Also add a new macro that reports when any valid protocol bit is set. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: move nfssvc.c to nfsd dir and clean up linking of nfsdJeff Layton2009-08-013-189/+1
| | | | | | | | | | rpc.nfsd is the only user of nfssvc.c, so we might as well move it out of libnfs.a. Also, don't link in libexport.a and libmisc.a, they aren't needed. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* errno not be set on RPC errorsSteve Dickson2009-07-151-1/+5
| | | | | | | | | | | | Changed both nfs_advise_umount() and nfs_gp_ping() to set the errno by calling CLNT_GETERR() after a CLNT_CALL() error. Also added code to rpc_strerror() that will log the errno value, when set, via strerror(). These changes added essential information to the error message making it much easier to detect errorsuch as "Connection refused" Signed-off-by: Steve Dickson <steved@redhat.com>
* support: Introduce sockaddr helpers to get and set IP port numbersChuck Lever2009-07-143-39/+58
| | | | | | | | | | Introduce address family-agnostic functions that get and set IP port numbers in socket addresses. We can already replace a few similar functions in the mount command, and a few more will come up with statd and sm-notify. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>