Re: [PATCH 1/2] nfs-service: Added the starting of gssproxy

Steve Dickson
2014-09-23T01:19:22Z

On 09/22/2014 08:19 PM, Simo Sorce wrote:
> On Mon, 22 Sep 2014 18:57:10 -0400
> Steve Dickson <SteveD@redhat.com> wrote:
>
>>
>>
>> On 09/22/2014 05:32 PM, Simo Sorce wrote:
>>> On Mon, 22 Sep 2014 17:14:05 -0400
>>> Steve Dickson <SteveD@redhat.com> wrote:
>>>
>>>>
>>>>
>>>> On 09/22/2014 04:44 PM, J. Bruce Fields wrote:
>>>>> On Mon, Sep 22, 2014 at 03:43:09PM -0400, Steve Dickson wrote:
>>>>>>
>>>>>>
>>>>>> On 09/22/2014 03:26 PM, Simo Sorce wrote:
>>>>>>> On Mon, 22 Sep 2014 15:20:07 -0400
>>>>>>> Steve Dickson <steved@redhat.com> wrote:
>>>>>>>
>>>>>>>> Added the gssproxy.service to both the Wants= and
>>>>>>>> Atfers= lines, before the rpc-svcgssd.service. There
>>>>>>>> are ConditionPathExists= lines in the rpc-svcgssd.service
>>>>>>>> unit which will stop the rpc.svcgssd daemon from
>>>>>>>> starting when the gssproxy daemon is already running.
>>>>>>>>
>>>>>>>> Signed-off-by: Steve Dickson <steved@redhat.com>
>>>>>>>> ---
>>>>>>>> systemd/nfs-server.service | 5 +++--
>>>>>>>> 1 file changed, 3 insertions(+), 2 deletions(-)
>>>>>>>>
>>>>>>>> diff --git a/systemd/nfs-server.service
>>>>>>>> b/systemd/nfs-server.service index 2fa7387..c740fa2 100644
>>>>>>>> --- a/systemd/nfs-server.service
>>>>>>>> +++ b/systemd/nfs-server.service
>>>>>>>> @@ -2,12 +2,13 @@
>>>>>>>> Description=NFS server and services
>>>>>>>> Requires= network.target proc-fs-nfsd.mount rpcbind.target
>>>>>>>> Requires= nfs-mountd.service
>>>>>>>> -Wants=rpc-statd.service nfs-idmapd.service rpc-gssd.service
>>>>>>>> rpc-svcgssd.service +Wants=rpc-statd.service
>>>>>>>> nfs-idmapd.service +Wants=rpc-gssd.service
>>>>>>>> Wants=rpc-statd-notify.service
>>>>>>>>
>>>>>>>> After= network.target proc-fs-nfsd.mount rpcbind.target
>>>>>>>> nfs-mountd.service After= nfs-idmapd.service rpc-statd.service
>>>>>>>> -After= rpc-gssd.service rpc-svcgssd.service
>>>>>>>> +After= rpc-gssd.service gssproxy.service rpc-svcgssd.service
>>>>>>>> Before= rpc-statd-notify.service
>>>>>>>>
>>>>>>>> Wants=nfs-config.service
>>>>>>>
>>>>>>> I think you really need to insure that the modules are loaded
>>>>>>> before any of the server services are started, perhaps adding a
>>>>>>> unit file that exec's modprobe and has "Before: gssproxy.service
>>>>>>> " in it ?
>>>>>> I really don't think its needed... From my testing it appears
>>>>>> gssproxy is always being started and rpc.svcgssd is not...
>>>>>
>>>>> Huh. Well rpc-svcgssd.service has var-lib-nfs-rpc_pipefs.mount as
>>>>> both "Requires=" and "After=", so rpc-svcgssd.service will never
>>>>> run without first running var-lib-nfs-rpc_pipefs.mount, which
>>>>> will load sunrpc. But I don't see where auth_rpcgss is getting
>>>>> loaded. And I don't see what ensures anything happening before
>>>>> gssproxy runs.
>>>> It happens during the mount on the client and when the server
>>>> is started.
>>>>
>>>>>
>>>>> We want to make sure your testing's not just getting lucky on the
>>>>> startup order.
>>>> The reason it working is because rpc.gssd is being started on the
>>>> server these days for callbacks and the After= line in
>>>> rpc-svcgssd.service is being executed before the
>>>> ConditionPathExists which cause rpc.svcgssd not to start.
>>>
>>> This guarantees ordering (to some degree) between rpc.gssd and
>>> rpoc.svcgssd, but says nothing about gssproxy ...
>> The question was how is the auth_rpcgss module being loaded. Since
>> both rpc-svcgssd.service and rpc-gssd.service service have
>> a After=var-lib-nfs-rpc_pipefs.mount and gssproxy is requiring
>> them, that's how auth_rpcgss is being loaded.
>>
>> If you only in enable gssproxy (not nfs-server or nfs-client) the
>> module still get loaded via gssproxy,service file
>>
>>>> So when gssproxy.service does it's "Before=nfs-secure.service
>>>> nfs-secure-server.service" line everything is loaded before
>>>> gssproxy start...
>>>>
>>>> I'm think gssproxy.service just needs to the put the Wants and
>>>> After= var-lib-nfs-rpc_pipefs.mount lines, instead of that Before
>>>> line..
>>>
>>> Maybe we should add "Before: gssproxy.service rpc-svcgssd.service"
>>> to var-lib-nfs-rpc_pipefs.mount instead (and also drop any mention
>>> of nfs services in gssproxy unit file so you have complete control
>>> of the dependencies ?
>> No.
>> The loading of sunrpc and the mounting of the file system has nothing
>> to do with starting up the gssd daemons.
>>
>> I would suggest gssproxy does to two things:
>>
>> 1) Add a Requires: nfs-utils to the spec file since you are requiring
>> services from nfs-utils
>
> No we are not requiring services from nfs-utils, nfs-utils is one of
> our users, you got that reversed.
So having "Before=nfs-secure.service nfs-secure-server.service" in
gssproxy.service and not having nfs-utils installed will not cause the
service fail during start up?

>
>> 2) Add a After=var-lib-nfs-rpc_pipefs.mount to the gssproxy.service
>> file since gssproxy could careless about either rpc.gssd or
>> rpc.svcgssd daemons. All it is looking for is the sunrpc and
>> auth_rpcgss kernel modules.
>
> The correct thing is to add a Before: gssproxy.service to
> var-lib-nfs-rpc_pipefs.mount IMO.
Again what happen if gssproxy is not installed? Things will
still come up successfully?

steved

>
> Simo.
>