From: Steve Dickson <SteveD@redhat.com>
To: Weston Andros Adamson <dros@netapp.com>
Cc: linux-nfs@vger.kernel.org
Subject: Re: [PATCH] gssd: validate cred in gssd_acquire_user_cred
Date: Mon, 28 Oct 2013 08:44:44 -0400 [thread overview]
Message-ID: <526E5C3C.10405@RedHat.com> (raw)
In-Reply-To: <1382720974-2746-1-git-send-email-dros@netapp.com>
On 25/10/13 13:09, Weston Andros Adamson wrote:
> Call gss_inquire_cred after gssd_acquire_krb5_cred check for expired
> credentials.
>
> This fixes a recent regression (since 302de786930a2c533068f9d8909a817b40f07c32)
> that causes the user's ticket cache to grow unbounded with expired service
> tickets when the user's credentials expire.
>
> To reproduce this issue:
>
> - mount kerberos nfs export
> - kinit for a short lifetime (ie "kinit -l 1m")
> - run a job that opens a file and writes for more than the lifetime
> - run klist a few times after expiry and see the list grow, ie:
>
> Ticket cache: DIR::/run/user/1749600001/krb5cc/tktYmpGlX
> Default principal: dros@APIKIA.FAKE
>
> Valid starting Expires Service principal
> 10/21/2013 15:39:38 10/21/2013 15:40:35 krbtgt/APIKIA.FAKE@APIKIA.FAKE
> 10/21/2013 15:39:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:35 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:36 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:37 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:37 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:38 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:38 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:41 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:41 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
> 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
>
> Signed-off-by: Weston Andros Adamson <dros@netapp.com>
> Reviewed-by: Simo Sorce <simo@redhat.com>
Committed...
steved.
>
> ---
>
> Version 2 of the patch - version 1 had compiler warnings I completely missed!
> I wonder how it worked before... but this now compiles cleanly and I verified
> that it fixes the growing tkt cache problem.
>
> Thanks,
> -dros
>
>
> utils/gssd/krb5_util.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
> index c6e52fd..697d1d2 100644
> --- a/utils/gssd/krb5_util.c
> +++ b/utils/gssd/krb5_util.c
> @@ -1405,6 +1405,13 @@ gssd_acquire_user_cred(uid_t uid, gss_cred_id_t *gss_cred)
>
> ret = gssd_acquire_krb5_cred(name, gss_cred);
>
> + /* force validation of cred to check for expiry */
> + if (ret == 0) {
> + if (gss_inquire_cred(&min_stat, *gss_cred, NULL, NULL,
> + NULL, NULL) != GSS_S_COMPLETE)
> + ret = -1;
> + }
> +
> maj_stat = gss_release_name(&min_stat, &name);
> return ret;
> }
> -- 1.8.3.1 (Apple Git-46)
>
next prev parent reply other threads:[~2013-10-28 12:43 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-25 17:09 [PATCH] gssd: validate cred in gssd_acquire_user_cred Weston Andros Adamson
2013-10-28 12:44 ` Steve Dickson [this message]
-- strict thread matches above, loose matches on Subject: below --
2013-10-22 14:04 Weston Andros Adamson
2013-10-22 14:41 ` Simo Sorce
2013-10-22 16:03 ` Weston Andros Adamson
2013-10-22 16:11 ` Weston Andros Adamson
2013-10-22 16:13 ` Simo Sorce
2013-10-22 16:22 ` Weston Andros Adamson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=526E5C3C.10405@RedHat.com \
--to=steved@redhat.com \
--cc=dros@netapp.com \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.