summaryrefslogtreecommitdiffstats
path: root/utils/gssd
Commit message (Collapse)AuthorAgeFilesLines
* Avoid clobbering root's ccache if possiblefixrootccacheSimo Sorce2017-11-164-4/+21
| | | | | | | | If the gssapi library is modern enough, store the ccache in a process scoped keyring by default. This will avoid clobbering root's default ccache, and keep the creds from littering the filesystem. Signed-off-by: Simo Sorce <simo@redhat.com>
* nfs-utils: Restore ABI compat with pre-merge libnfsidmapJustin Mitchell2017-11-071-1/+1
| | | | | | | | | Prior to merge libnfsidmap leaked many private symbols that were not defined in its API, creating an accidental ABI. This patch renames and unhides symbols in order to match that ABI until a cleaned up API can be established and released. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: integrate libnfsidmap code with rest of nfs-utilsJustin Mitchell2017-10-261-1/+2
| | | | | | | | | | Modify libnfsidmap to use the now shared conffile code, adjust the build structure to generate everything correctly, and modify the other utils to use the merged version of libnfsidmap instead of testing for an external dependancy. Signed-off-by: Justin Mitchell <jumitche@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: split conffile to a separate convenience libJustin Mitchell2017-10-261-2/+2
| | | | | | | | | To allow better reuse of the code we split conffile and xlog into their own separate convenience library, then merge it back so as to not create extra dependancies for everything Signed-off-by: Justin Mitchell <jumitche@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* config: Remove the conf_path globalJustin Mitchell2017-05-052-5/+2
| | | | | | | | Working towards an nfs.conf library and API for system config tools, first step, replace the conf_path global with a parameter to conf_init Signed-off-by: Justin Mitchell <jumitche@rehat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: add a deprecation warning for pipefs-directory in gssd sectionScott Mayhew2017-04-092-4/+12
| | | | | | | | All the daemons should use the same rpc_pipefs, so pipefs-directory should be specified in the [general] section. Signed-off-by: Scott Mayhew <smayhew@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Duplicate the upcall string for error messagesFrank Sorenson2017-02-151-4/+13
| | | | | | | | | | | strsep() modifies the input string, so error messages may output only part of the upcall string. Make a copy of the upcall string, and use that in any error messages. Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: replace non-thread-safe strtok with strsepFrank Sorenson2017-02-151-1/+2
| | | | | | | | | | gssd uses the non-thread-safe strtok() function, which can lead to incorrect program behavior. Replace strtok() with the thread-safe strsep(). Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mount: fix mount fail that caused by uninitialized structJianhong Yin2017-02-021-11/+19
| | | | | | | | | | | | | From: "Jianhong.Yin" <yin-jianhong@163.com> recent changes of utils/mount cause a regression mount fail: https://bugzilla.redhat.com/show_bug.cgi?id=1415024 can not reproduce it on x86_64(gcc on x86_64 might do struct initialize by default, I'm not sure). but it can be reproduced always on platform ppc64le aarch64. Signed-off-by: Jianhong Yin <yin-jianhong@163.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* svcgssd: add /etc/nfs.conf supportNeilBrown2016-12-202-0/+31
| | | | | Signed-off-by: NeilBrown <neilb@suse.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: add /etc/nfs.conf supportNeilBrown2016-12-202-0/+83
| | | | | Signed-off-by: NeilBrown <neilb@suse.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Gssd: Avoid compiling warning and simplify codesKinglong Mee2016-07-201-8/+8
| | | | | | | | krb5_util.c: In function gssd_acquire_user_cred: krb5_util.c:1389:4: warning: this if clause does not guard... Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Convert 'rdma' to 'tcp' protocolChuck Lever2016-05-161-0/+16
| | | | | | | | | | | | | | | | | | | | | The kernel NFS client specifies 'rdma' as the transport protocol for NFS/RDMA mounts. This is a generic display token, probably not something the kernel should lie about. The kernel uses it to form NFSv4 client IDs, for example. Until gssd can speak RPC-over-RDMA, convert 'rdma' to 'tcp' in kernel gss upcalls. This means that the Linux NFS client requires an NFS/TCP service on an NFS/RDMA server when establishing a GSS context for proto=rdma mount points. This is probably not an onerous requirement for the time being. Eventually user space support for RPC-over-RDMA might be introduced, and gssd can use that for context establishment. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: no longer needed pid logicOlga Kornievskaia2016-05-141-6/+1
| | | | | | | with threads, we don't need to distinguish zero uid. Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: move read of upcall into main threadOlga Kornievskaia2016-05-143-83/+96
| | | | | | | | | | This patch moves reading of the upcall information from the child thread into the main thread. It removes the need to synchronize between the parent and child thread before processing upcall. Also it creates the thread in a detached state. Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: always call gss_krb5_ccache_nameOlga Kornievskaia2016-04-293-50/+19
| | | | | | | | | | | Previously the location of the credential cache was passed in either using environment variable KRB5CCNAME or gss_krb5_ccache_name() if supported. For threaded-gssd, we can't use an environment variable as it's shared among all thread. Thus always use the api call. Reviewed-by: Steve Dickson <steved@redhat.com> Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: using syscalls directly to change thread's identityOlga Kornievskaia2016-04-291-10/+9
| | | | | | | | | | | For the threaded version we have to set uid,gid per thread instead of per process. glibc setresuid() when called from a thread, it'll send a signal to all other threads to synchronize the uid in all other threads. To bypass this, we have to call syscall() directly. Reviewed-by: Jeff Layton <jlayton@poochiereds.net> Reviewed-by: Steve Dickson <steved@redhat.com> Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
* gssd: use pthreads to handle upcallsOlga Kornievskaia2016-04-295-37/+71
| | | | | | | | | | | Currently, to persevere global data over multiple mounts, the root process does not fork when handling an upcall. Instead on not-forking create a pthread to handle the upcall since global data can be shared among threads. Reviewed-by: Jeff Layton <jlayton@poochiereds.net> Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Remove rpcsecgss library supportSteve Dickson2016-04-291-10/+5
| | | | | | | | | librpcsecgss has not been used in years so and there is no longer an upstream for it so the support for the library has been removed Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: ignore pipe directories that do not existSteve Dickson2016-03-191-2/+3
| | | | | | | | | | | | | Back when commit aba5ea5c and commit 55197c98 happen that replaced dnotify with inotify the ignoring of non-existent upcall directories got dropped. The patch adds it back and stops following error log ERROR: inotify_add_watch failed for nfs/clntXX: No such file or directory Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Fix inner-loop variable reuseBenjamin Coddington2016-03-161-3/+3
| | | | | | | | | | The var "i" is already in use iterating realmnames. Fixes: "6597e391 gssd: Don't assume the machine account will be in uppercase" Signed-off-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Corrected some types in the debugging codeSteve Dickson2016-03-081-2/+2
| | | | | | | Change some debugging levels in populate_port() to make easier to follow the code. Signed-off-by: Steve Dickson <steved@redhat.com>
* krb5_use_machine_creds: Fixed the format of some debugging messagesSteve Dickson2016-03-071-6/+7
| | | | | | | commit 1201d5d8 introduced some new debugging messages that needed some formatting Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: reworked second level of debuggingSteve Dickson2015-11-165-13/+13
| | | | | | | Trimmed down the number messages being logged by moving them into level 3 or 4 of debugging Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: log all fatal errorsSteve Dickson2015-11-163-8/+8
| | | | | | When gssd exist ensure a error message is logged. Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: reworked first level of debuggingSteve Dickson2015-11-162-21/+19
| | | | | | | Cleaned up first level of debugging. Only errors and warnings are logged. Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Make TCP the default protocol for GSSD connections.Chuck Lever2015-11-021-9/+2
| | | | | | | | No failure case if gssd doesn't recognize the kernel's requested protocol. Caught with "protocol=rdma" upcall. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Don't assume the machine account will be in uppercaseScott Mayhew2015-11-021-2/+14
| | | | | | | | | | | | | | | | | | | find_keytab_entry() first looks for an entry of the form <HOSTNAME>$@<DOMAIN>, which corresponds to the Active Directory machine account. It assumes that <HOSTNAME> will be in uppercase because that's how the entry is created if the machine is joined to the domain using Samba. But that's not necessarily the case if the another identity management solution is used... for example a keytab entry for a machine account created by Centrify will match the actual computer account in Active Directory, whether that be in upper case, lower case, or mixed case. So first look for an entry that matches the unmodified hostname and then convert it to uppercase and try again only if that failed. Signed-off-by: Scott Mayhew <smayhew@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Allow gssd and svcgssd to set the libtirpc debug levelScott Mayhew2015-11-022-0/+14
| | | | | | | | The interface for controlling the debug level in libtirpc was added over a year ago, but nothing's taking advantage of it. Signed-off-by: Scott Mayhew <smayhew@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* GSSD: clean up machine credentialsAndy Adamson2015-09-231-6/+5
| | | | | | | | | | | | | | Since we no longer fork for uid 0, gssd_atexit() is only called when uid != 0, and fails as permissions on the /tmp/krb5ccmachine_REALM file prohibit the clean up of machine credentials (as it should). Move the reaping of machine credentials back into a SIGINT sighandler so that <Ctrl-C> destroyes machine credentials. Signed-off-by: Andy Adamson <andros@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* GSSD only fork when uid is not zeroAndy Adamson2015-09-231-24/+38
| | | | | | | | | | | | | | | | | | | | | | | | commit f9cac65972da588d5218236de60a7be11247a8aa added the fork to process_krb5_upcall so that the child assumes the uid of the principal requesting service. When machine credentials are used, a gssd_k5_kt_princ entry is added to a global list and used by future upcalls to note when valid machine credentials have been obtained. When a child process performs this task, the entry to the global list is lost upon exit, and all upcalls for machine credentials re-fetch a TGT, even when a valid TGT is in the machine kerberos credential cache. Since forking is not necessary when the principal has uid=0, solve the gssd_k5_kt_princ_list issue by only forking when the uid != 0. Acked-by: Jeff Layton <jlayton@poochiereds.net> Signed-off-by: Andy Adamson <andros@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* GSSD: move process_krb5_updcall non machine cred case to helper functionAndy Adamson2015-09-231-27/+50
| | | | | | Signed-off-by: Andy Adamson <andros@netapp.com> Signed-off-by: Jeff Layton <jlayton@poochiereds.net> Signed-off-by: Steve Dickson <steved@redhat.com>
* GSSD: move process_krb5_upcall machine cred case to helper functionAndy Adamson2015-09-231-45/+65
| | | | | | Signed-off-by: Andy Adamson <andros@netapp.com> Signed-off-by: Jeff Layton <jlayton@poochiereds.net> Signed-off-by: Steve Dickson <steved@redhat.com>
* Revert "rpc.gssd: Replace exit(0) by return in process_krb5_upcall"Steve Dickson2015-09-081-1/+1
| | | | | This reverts commit 21f10369965bb183d1a72df1da0c2811cd2b1d5c due to child processes not exiting on upcalls.
* rpc.gssd: Replace exit(0) by return in process_krb5_upcallAndy Adamson2015-08-241-1/+1
| | | | | | | | | | | From: Andy Adamson <andros@netapp.com> exit(0) silenty reaps the gssd_k5_kt_princ struct, the in-memory rpc.gssd cache which means that rpc.gssd will get a new TGT and TGS for each upcall, ignoring a valid TGT in the kerberos credential cache. Signed-off-by: Andy Adamson <andros@netapp.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* rpc.gssd: Only clear the retval if it has not been setSteve Dickson2015-07-311-1/+3
| | | | | | | | In gssd_search_krb5_keytab() an error code can be cleared by blindly setting retval to zero. Reported-by: Jianhong Yin <jiyin@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - simplify handle_gssd_upcallDavid Hardeman2015-01-231-68/+38
| | | | | | | | Stumbled across this function, just had to simplify it. No mallocs necessary, one quick loop to find the parameters. Much simpler. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - improve inotifyDavid Hardeman2015-01-232-52/+116
| | | | | | | | | | Make full use of inotify by not rescanning the whole tree on each change, instead keep track of the inotify events and make sure that the minimum work (scan/create/delete) clients is done in most cases. Still detect anomalies and perform a full rescan in those cases. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - further shorten some pathnamesDavid Hardeman2015-01-231-9/+7
| | | | | | | Save some more memory by using relative pathnames. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - change dnotify to inotifyDavid Hardeman2015-01-232-30/+73
| | | | | | | | | This is just the first step, replacing dnotify with an inotify implementation that is not much better (still does a complete rescan of the whole rpc_pipefs tree on each change). Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - cleanup read_service_infoDavid Hardeman2015-01-231-98/+110
| | | | | | | | | There's a lot of fixed buffers in use here. Clean up the code and add more documentation on the different formats that have been used by the kernel. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - simplify client scanningDavid Hardeman2015-01-231-91/+80
| | | | | | | | Simplify the code responsible for the client dir scanning. This is also in preparation for the inotify patches. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - simplify topdir scanningDavid Hardeman2015-01-232-92/+81
| | | | | | | | Simplify and refactor the code that does the topdir scanning, this is in preparation for the inotify patches. Signed-off-by: David H?rdeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - use more relative pathsDavid Hardeman2015-01-233-41/+40
| | | | | | | | Using more relative paths saves memory and lets us get rid of more PATH_MAX fixed arrays. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - keep the rpc_pipefs dir openDavid Hardeman2015-01-231-49/+37
| | | | | | | | Keep the rpc_pipefs dir open and just do a rewind/rescan when necessary. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - make the client lists per-topdirDavid Hardeman2015-01-232-73/+66
| | | | | | | | This makes it easier to keep track of which client belongs to which topdir. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - remove "close me" codeDavid Hardeman2015-01-232-20/+8
| | | | | | | | This code is mostly just confusing. Close the fds immediately instead of doing so later. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - use libeventDavid Hardeman2015-01-233-266/+138
| | | | | | | | Using libevent (which is already in use in idmap) saves about a hundred lines of hand-rolled event loop code. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - move over pipfs scanning codeDavid Hardeman2015-01-234-563/+566
| | | | | | | | Move all rpc_pipefs scanning code from gssd_proc.c to gssd.c in preparation for later patches. Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd - simplify topdirs pathDavid Hardeman2015-01-232-59/+40
| | | | | | | | | | By chdir():ing to the root of the rpc_pipefs dir and making paths relative from there (gssd already keeps a number of files open in rpc_pipefs so chdir doesn't suddenly make it impossible to umount rpc_pipefs because of this patch). Signed-off-by: David Hardeman <david@hardeman.nu> Signed-off-by: Steve Dickson <steved@redhat.com>
generated by cgit (git 2.34.1) at 2025-07-03 10:14:44 +0000