summaryrefslogtreecommitdiffstats
path: root/utils/gssd
Commit message (Collapse)AuthorAgeFilesLines
...
* Check the info file nfs/rpc_pipefs/nfs/clnt?/info toOlga Kornievskaia2008-05-072-2/+13
| | | | | | | | | see if a port number was supplied. If so, use it rather than the default port number. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Turn down gssd's syslog verbosityTimo Aaltonen2008-03-132-2/+5
| | | | | Modified-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fixed typo in gssd manpageSteinar H. Gunderson2008-03-101-1/+1
| | | | | Signed-off-by: Steinar H. Gunderson <sgunderson@bigfoot.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Increase the number of concurrent krb5 mounts by increasingDrew Middlesworth2008-03-041-1/+1
| | | | | | | the size of the poll array Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Stop gssd from ignoring the machine credential cacheVince Busam2008-02-261-1/+1
| | | | | | | defined by the -d flag Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Remove old logging implementation for idmapd and rework gssd and idmapd to ↵Kevin Coffman2007-10-152-38/+8
| | | | | | | | | | | | | use the new xlog logging infrastructure. This patch removes all of the old idmap_* logging functions and replaced them with the corresponding xlog functions. In addition that that it also reworks the gssd logging wrappers to use the new xlog_backend. Finally it makes necessary changes to the build files to get the project compiling again. Signed-off-by: David P. Quigley <dpquigl@tycho.nsa.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Remove svcgssd's private version of cacheio.cKevin Coffman2007-10-152-346/+0
| | | | | | | | Now that svcgssd is using the qword_* functions in the support library, remove the private version. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use nfslib versions of cacheio functionsKevin Coffman2007-10-152-3/+1
| | | | | | | | | | Now that the nfslib library has all the necessary functions and they all operate as needed, use them instead of the private versions in utils/gssd/cacheio.c. The obsolete private versions are removed in the next patch. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use printerr to print svcgssd downcall debugging infoKevin Coffman2007-10-152-12/+7
| | | | | | | | | | | Rather than depending on modified qword_* functions to print svcgssd debugging information, use printerr in the downcall function. And while we're at it, label things so we know what we're looking at! Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Make print_hexl function write to stdout rather than using printerrKevin Coffman2007-10-151-15/+18
| | | | | | | | | | print_hexl() currently uses printerr, but is really only necessary for local debugging and should simply write to stdout. Also change it to print the description internally. Wrap it and its use in #ifdef DEBUG. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix new warning after strict prototype checking enabledKevin Coffman2007-10-151-1/+1
| | | | | | | | Fix function declaration to eliminate compiler warning about it not being a prototype after -Wstrict-prototypes was added. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix the usage message for gssd to reflect new optionKevin Coffman2007-09-111-1/+1
| | | | | | | Fix the usage message for gssd to reflect new -M option added in 1.1.0 Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* gitignore updatesJ. Bruce Fields2007-07-101-0/+3
| | | | | | | Update gitignore to ignore some generated files. Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Always get addressless ticketsKevin Coffman2007-05-031-2/+32
| | | | | | | | Make sure we get addressless tickets so we can function behind a NAT. (Must use a different function to accomplish this with Heimdal.) Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Factor out error message printing differences between MIT and HeimdalKevin Coffman2007-04-203-23/+51
| | | | | | | | | | Use a common function that factors out differences between MIT and Heimdal in getting the right error message printed. Add an autoconf check to see if the newer error message function is available. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Tell Heimdal gss code the correct credential to useKevin Coffman2007-04-201-0/+2
| | | | | Always use the gss_krb5_ccache_name() function to tell Heimdal which credentials to use.
* Add a debug message indicating that gssd is ready to process requestsKevin Coffman2007-03-311-0/+1
| | | | | | | Add a debug message indicating that gssd is ready to process requests Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Remove the now unused functionsKevin Coffman2007-03-312-235/+0
| | | | | | | | Remove functions that are no longer used when when obtaining machine credentials. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Clean up gssd_get_single_krb5_cred and its debugging messagesKevin Coffman2007-03-311-8/+12
| | | | | | | Clean up gssd_get_single_krb5_cred and its debugging messages Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use newly added keytab functionsKevin Coffman2007-03-315-20/+31
| | | | | | | | | | | | | | | | | | | | | | | Use the new functions added in the previous patch. Obtain machine credentials in a pre-determined order Look for appropriate machine credentials in the following order: root/<fqdn>@REALM nfs/<fqdn>@REALM host/<fqdn>@REALM root/<any-name>@REALM nfs/<any-name>@REALM host/<any-name>@REALM The first matching credential will be used. Also, the machine credentials to be used are now determined "on-demand" rather than at gssd startup. This allows keytab additions to be noticed and used without requiring a restart of gssd. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add new keytab handling functions for dealing with machine credentialsKevin Coffman2007-03-312-0/+468
| | | | | | | | | | | | | | | Add new functions that will be used in the next patch. The new behavior is to search for particular keytab entries in a specified order: root/<fqdn>@<REALM> nfs/<fqdn>@<REALM> host/<fqdn>@<REALM> root/<any-name>@<REALM> nfs/<any-name>@<REALM> host/<any-name>@<REALM> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Hide differences between MIT and Heimdal in macrosKevin Coffman2007-03-312-25/+20
| | | | | | | | | Clean up a lot of #ifdef'd code using macros, masking the differences between MIT and Heimdal implementations. The currently unused macros will be used in later patches. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix memory leak on error path of limit_krb5_enctypes()Kevin Coffman2007-03-311-0/+1
| | | | | | | Return credential on error path of limit_krb5_enctypes() Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add missing newlinesKevin Coffman2007-03-311-6/+6
| | | | | | | Add missing newlines to error messages. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Create two separate paths for pipefs_dir and pipefs_nfsdir.Kevin Coffman2007-03-194-21/+23
| | | | | | | | | Future work needs access to the base pipefs directory rather than the nfs subdirectory. Create two separate paths called pipefs_dir and pipefs_nfsdir with the name of each. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Allow any credential to be used for machine credentialsKevin Coffman2007-03-192-18/+16
| | | | | | | | | | Don't restrict machine credentials to be "nfs/<machine.name>". Use any usable credentials contained in the keytab file. [We actually attempt to use the first entry found for each realm, not every entry, in the keytab.] Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add option to allow root to use credentials other than machine credentialsKevin Coffman2007-03-194-54/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a new option ("-n") to rpc.gssd to indicate that accesses as root (uid 0) should not use machine credentials, but should instead use "normal" Kerberos credentials obtained by root. This change was prompted by a suggestion and patch from Daniel Muntz <Dan.Muntz@netapp.com>. That patch suggested trying "normal" credentials first and falling back to using machine creds for uid 0 if normal creds failed. This opens up the case where root may have credentials as "foo@REALM" and begins accessing files. Then the context using those credentials expires and must be renewed. If the credentials are now expired, then root's new context would fall back and be created with the machine credentials. Instead, this patch insists that the administrator choose to use either machine credentials for accesses by uid 0 (the default behavior, as it was before) or "normal" credentials. In the latter case, arrangements must be made to obtain credentials before attempting a mount. There should be no doubts which credentials are used for uid 0. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Don't leak keytab entriesKevin Coffman2007-03-191-0/+5
| | | | | | | Free keytab entries while processing keytab file. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use lstat rather than stat in gssd_find_existing_krb5_ccacheNeil Brown2007-03-161-1/+1
| | | | | As this is a file in /tmp, a symlink could take us anywhere... If it was a NFS filesystem with a dead server, we could block for a long time..
* Add option to svcgssd to enable libnfsidmap debugging.Kevin Coffman2007-02-092-4/+20
| | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> As suggested by Glenn Machin <GMachin@sandia.gov>. Allow svcgssd to turn on libnfsidmap debugging. This uses a new command-line parameter so that it can be enabled independently from other debugging. Signed-off-by: Neil Brown <neilb@suse.de>
* Share handling of lucid_sec_context for Heimdal and MITKevin Coffman2007-02-095-170/+234
| | | | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> The 0.8 release of Heimdal has (will have) support for the lucid context. The handling of lucid_sec_context can be shared between builds with MIT or Heimdal Kerberos. Split out the lucid_sec_context code from context_mit.c and make a new common file, context_lucid.c. Signed-off-by: Neil Brown <neilb@suse.de>
* Use owner rather than filename format in choosing cred cache filesKevin Coffman2007-02-091-56/+50
| | | | | | | | | | | Signed-off-by: Glenn Machin <gmachin@sandia.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Some installations use different name formats for their credentials caches. Instead of checking that the uid is part of the name, just make sure that uid is the owner of the file. This is a modification of the original patch from Glenn. Signed-off-by: Neil Brown <neilb@suse.de>
* Use the gssglue version of gssapi.h for svcgssd_mech2file.cKevin Coffman2007-02-091-5/+1
| | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Remove Kerberos implementation dependency from svcgssd_mech2file.c Signed-off-by: Neil Brown <neilb@suse.de>
* Treat GSSAPI error codes as unsigned.Kevin Coffman2007-02-093-2/+14
| | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> GSSAPI error codes (major and minor) are defined as unsigned values. However, we treat them as signed while passing them down to the kernel where conversion fails if they include the minus sign. Convert them as unsigned. Signed-off-by: Neil Brown <neilb@suse.de>
* Fix an off-by-one in the handling of the -d option to rpc.gssdSteinar H. Gunderson2007-02-051-1/+1
| | | | https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/76409
* Error check messages sent to the kernel.Neil Brown2007-01-113-5/+8
| | | | | | And make sure that if we fail to export a filesystem in mountd, then we don't try to get a filehandle on it, or a deadlock might occur.
* Allow gssd ccaches in MEMORY: rather than FILE:Kevin Coffman2006-10-173-2/+13
| | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add option to store gssd ccaches in a MEMORY: cache rather than the default FILE: cache. In response to suggestion from Steve Dickson <steved@redhat.com> and Nalin Dahyabhai <nalin@redhat.com>.
* Implement a new version of lucid spkm3 context.Olga Kornievskaia2006-10-171-20/+19
| | | | | | | | Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Implement a new version of lucid spkm3 context which is passed down to the kernel.
* Fix misc warning messagesKevin Coffman2006-10-173-1/+3
| | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Clean up a few warning messages.
* Fix compilation problem - write_oid not definedKevin Coffman2006-07-211-0/+13
|
* Use uid/gid of -1 to indicate the export's anonuid/anongid should be usedKevin Coffman2006-07-081-2/+5
| | | | | | | | | | | Kernel routine nfsd_setuser() in fs/nfsd/auth.c checks for the value -1 and defaults the credential's fsuid/fsgid to the correct anonuid/anongid values for the given export. We should be passing this value (-1) down when a name mapping cannot be found. Thanks to J. Bruce Fields <bfields@fieldses.org> for the reference. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Acked-by: J. Bruce Fields <bfields@fieldses.org>
* Change svcgssd_LDFLAGS to match gssd_LDFLAGSKevin Coffman2006-07-081-1/+1
|
* Only use -rpath for Kerberos libs when actually needed.Neil Brown2006-07-061-1/+1
| | | | Avoid usage of -rpath is generally safer, and is required by Debian policy.
* Use 65534 instead of -2 in svcgssd_proc.cNeil Brown2006-07-061-4/+3
| | | | as this is more consistant across achitectures.
* Handle mapping failure from get_ids.kwc@citi.umich.edu2006-07-041-2/+15
| | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Temporary patch to do default mapping if we get an error while trying to map a gss principal to the appropriate uid/gid. This currently returns hardcoded values. This may be correct, or we may need to try and figure out the correct values to match the anonuid/anongid for the export.
* Properly report errors in readline() functionkwc@citi.umich.edu2006-07-042-4/+8
| | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Change message priorities for errors and debug messages.
* Change default buffer size increment for readline()kwc@citi.umich.edu2006-07-041-3/+5
| | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> The readline routine expects much smaller messages than we are passing. Change the default initial allocation and increment value from 128 to 2048. This saves many calls to realloc().
* Clean up the printerr() logging function.kwc@citi.umich.edu2006-07-041-30/+31
| | | | | | | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Update the printerr() function to: 1) Determine whether we'll print the message before going to all the work of formatting it. 2) Don't just toss away messages that are too long for the buffer. Print what we can and give an indication of the truncation with "..." at the end. 3) Use a single buffer rather than two. 4) Messages either go to syslog (with level ERR) or stderr. Don't send some messages to syslog level DEBUG.
* Use setfsuid() rather than seteuid() while creating contextskwc@citi.umich.edu2006-07-041-7/+7
| | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> As suggested by Olaf Kirch <okir@suse.de>, use setfsuid() rather than seteuid() when creating a gss context. This prevents users from using credentials that do not belong to them, while also preventing them from doing things like killing, renicing, or changing the priority of the gssd process while it is processing the context creation.
* Limit acquire_cred call to to Kerberos onlykwc@citi.umich.edu2006-07-041-1/+6
| | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Specify that the acquire_cred call should only be concerned with returning Kerberos credentials since this is Kerberos-only functionality.
generated by cgit (git 2.34.1) at 2025-07-02 10:37:45 +0000