Re: [PATCH 1/2] nfs-service: Added the starting of gssproxy

[Simo Sorce <simo@redhat.com>]

On Tue, 23 Sep 2014 10:58:38 -0400
Steve Dickson <SteveD@redhat.com> wrote:

> 
> 
> On 09/23/2014 08:52 AM, Simo Sorce wrote:
> > On Mon, 22 Sep 2014 21:19:18 -0400
> > Steve Dickson <SteveD@redhat.com> wrote:
> > 
> >>
> >>
> >> On 09/22/2014 08:19 PM, Simo Sorce wrote:
> >>> On Mon, 22 Sep 2014 18:57:10 -0400
> >>> Steve Dickson <SteveD@redhat.com> wrote:
> >>>
> >>>>
> >>>>
> >>>> On 09/22/2014 05:32 PM, Simo Sorce wrote:
> >>>>> On Mon, 22 Sep 2014 17:14:05 -0400
> >>>>> Steve Dickson <SteveD@redhat.com> wrote:
> >>>>>
> >>>>>>
> >>>>>>
> >>>>>> On 09/22/2014 04:44 PM, J. Bruce Fields wrote:
> >>>>>>> On Mon, Sep 22, 2014 at 03:43:09PM -0400, Steve Dickson wrote:
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> On 09/22/2014 03:26 PM, Simo Sorce wrote:
> >>>>>>>>> On Mon, 22 Sep 2014 15:20:07 -0400
> >>>>>>>>> Steve Dickson <steved@redhat.com> wrote:
> >>>>>>>>>
> >>>>>>>>>> Added the gssproxy.service to both the Wants= and
> >>>>>>>>>> Atfers= lines, before the rpc-svcgssd.service. There
> >>>>>>>>>> are  ConditionPathExists= lines in the rpc-svcgssd.service
> >>>>>>>>>> unit which will stop the rpc.svcgssd daemon from
> >>>>>>>>>> starting when the gssproxy daemon is already running.
> >>>>>>>>>>
> >>>>>>>>>> Signed-off-by: Steve Dickson <steved@redhat.com>
> >>>>>>>>>> ---
> >>>>>>>>>>  systemd/nfs-server.service | 5 +++--
> >>>>>>>>>>  1 file changed, 3 insertions(+), 2 deletions(-)
> >>>>>>>>>>
> >>>>>>>>>> diff --git a/systemd/nfs-server.service
> >>>>>>>>>> b/systemd/nfs-server.service index 2fa7387..c740fa2 100644
> >>>>>>>>>> --- a/systemd/nfs-server.service
> >>>>>>>>>> +++ b/systemd/nfs-server.service
> >>>>>>>>>> @@ -2,12 +2,13 @@
> >>>>>>>>>>  Description=NFS server and services
> >>>>>>>>>>  Requires= network.target proc-fs-nfsd.mount rpcbind.target
> >>>>>>>>>>  Requires= nfs-mountd.service
> >>>>>>>>>> -Wants=rpc-statd.service nfs-idmapd.service
> >>>>>>>>>> rpc-gssd.service rpc-svcgssd.service
> >>>>>>>>>> +Wants=rpc-statd.service nfs-idmapd.service
> >>>>>>>>>> +Wants=rpc-gssd.service Wants=rpc-statd-notify.service
> >>>>>>>>>>  
> >>>>>>>>>>  After= network.target proc-fs-nfsd.mount rpcbind.target
> >>>>>>>>>> nfs-mountd.service After= nfs-idmapd.service
> >>>>>>>>>> rpc-statd.service -After= rpc-gssd.service
> >>>>>>>>>> rpc-svcgssd.service +After= rpc-gssd.service
> >>>>>>>>>> gssproxy.service rpc-svcgssd.service Before=
> >>>>>>>>>> rpc-statd-notify.service 
> >>>>>>>>>>  Wants=nfs-config.service
> >>>>>>>>>
> >>>>>>>>> I think you really need to insure that the modules are
> >>>>>>>>> loaded before any of the server services are started,
> >>>>>>>>> perhaps adding a unit file that exec's modprobe and has
> >>>>>>>>> "Before: gssproxy.service " in it ?
> >>>>>>>> I really don't think its needed... From my testing it
> >>>>>>>> appears gssproxy is always being started and rpc.svcgssd is
> >>>>>>>> not... 
> >>>>>>>
> >>>>>>> Huh.  Well rpc-svcgssd.service has
> >>>>>>> var-lib-nfs-rpc_pipefs.mount as both "Requires=" and
> >>>>>>> "After=", so rpc-svcgssd.service will never run without first
> >>>>>>> running var-lib-nfs-rpc_pipefs.mount, which will load
> >>>>>>> sunrpc.  But I don't see where auth_rpcgss is getting
> >>>>>>> loaded.  And I don't see what ensures anything happening
> >>>>>>> before gssproxy runs.
> >>>>>> It happens during the mount on the client and when the server
> >>>>>> is started. 
> >>>>>>
> >>>>>>>
> >>>>>>> We want to make sure your testing's not just getting lucky on
> >>>>>>> the startup order.
> >>>>>> The reason it working is because rpc.gssd is being started on
> >>>>>> the server these days for callbacks and the After= line in
> >>>>>> rpc-svcgssd.service is being executed before the
> >>>>>> ConditionPathExists which cause rpc.svcgssd not to start.
> >>>>>
> >>>>> This guarantees ordering (to some degree) between rpc.gssd and
> >>>>> rpoc.svcgssd, but says nothing about gssproxy ...
> >>>> The question was how is the auth_rpcgss module being loaded.
> >>>> Since both rpc-svcgssd.service and rpc-gssd.service service have
> >>>> a After=var-lib-nfs-rpc_pipefs.mount and gssproxy is requiring 
> >>>> them, that's how auth_rpcgss is being loaded. 
> >>>>
> >>>> If you only in enable gssproxy (not nfs-server or nfs-client)
> >>>> the module still get loaded via gssproxy,service file 
> >>>>
> >>>>>> So when gssproxy.service does it's "Before=nfs-secure.service
> >>>>>> nfs-secure-server.service" line everything is loaded before
> >>>>>> gssproxy start... 
> >>>>>>
> >>>>>> I'm think gssproxy.service just needs to the put the Wants and
> >>>>>> After= var-lib-nfs-rpc_pipefs.mount lines, instead of that
> >>>>>> Before line.. 
> >>>>>
> >>>>> Maybe we should add "Before: gssproxy.service
> >>>>> rpc-svcgssd.service" to var-lib-nfs-rpc_pipefs.mount instead
> >>>>> (and also drop any mention of nfs services in gssproxy unit
> >>>>> file so you have complete control of the dependencies ?
> >>>> No. 
> >>>> The loading of sunrpc and the mounting of the file system has
> >>>> nothing to do with starting up the gssd daemons.
> >>>>
> >>>> I would suggest gssproxy does to two things:
> >>>>
> >>>> 1) Add a Requires: nfs-utils to the spec file since you are
> >>>> requiring services from  nfs-utils
> >>>
> >>> No we are not requiring services from nfs-utils, nfs-utils is one
> >>> of our users, you got that reversed.
> >> So having "Before=nfs-secure.service nfs-secure-server.service" in 
> >> gssproxy.service and not having nfs-utils installed will not cause
> >> the service fail during start up? 
> > 
> > It will not, but right now gssproxy.service also has:
> >  Requires=proc-fs-nfsd.mount
> > 
> > I want to drop this one.
> You don't want to drop this because it loads the needed kernel
> modules.

I want the unit file Bruce proposed to require this and to be run before
gssproxy.service
Once we have that unit I can drop mine which has always been just a
workaround.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York