Re: [PATCH] Adding the nfs4_use_min_auth module parameter

["J. Bruce Fields" <bfields@fieldses.org>]

On Fri, Nov 08, 2013 at 10:09:18AM -0800, Chuck Lever wrote:
> I let this pass earlier, but...
> 
> The krb5i setting is _ONLY_ for lease management, not for data access.  Traversing the pseudo-fs counts as data access.  Our client is supposed to use the security flavor specified on the mount command line for the pseudo-fs.  (That's why the pseudo-fs security policy is the union of all the real exports on the server, right?)
> 
> If no flavor is specified by the client administrator, we have SECINFO_NONAME for negotiating the pseudo-fs security flavor in NFSv4.1, and some roughly equivalent heuristics for this in NFSv4.0, which doesn't have the SECINFO_NONAME operation.  Since 3.11, I believe, our client should be using these mechanisms instead of just plowing ahead with AUTH_SYS.

That makes sense.

(By the way: if a mount is done with krb5*, are we guaranteed the entire
export path is looked up with security at least as strong, or is it
possible we trust cached lookups possibly originally obtained with
weaker security?)

--b.