Re: gssd and linux containers

[bfields@fieldses.org (J. Bruce Fields)]

On Thu, Apr 14, 2016 at 02:57:51PM -0400, Benjamin Coddington wrote:
> On Thu, 14 Apr 2016, Olga Kornievskaia wrote:
> 
> > Hi folks,
> >
> > Does somebody know if it's possible to do secure mounts within linux
> > containers? I seem to recall that gssd is not container-aware. Or is
> > container-magic makes it so that gssd runs per container and has its
> > own dedicated krb5.conf+keytab configurations?
> >
> > Thank you.

On the server side it should work in theory, I don't know if anyone's
tested it.  On the client side:

> As far as I know there's no good way to run multiple gssd inside containers.
> There's only one global upcall mechanism, so even if we could keep track of
> which container is doing IO, there doesn't exist a way to upcall to the
> appropriate gssd.  Additionally, containers are a collection of shared
> namespaces.  A gssd could share one or more of those namespaces with a
> process doing IO, so what sort of rules do we use to pick the right gssd?
> 
> Ian Kent has led some discussion on solving this, and right now the thinking
> is to always upcall into whichever namespace collection created the mount,
> but the bet way to preserve those namespaces has not been agreed upon yet.

Isn't the client side still using the rpc_pipefs upcall?  That might
still need containerization work.  But that's different than the problem
Ian was looking at with running usermode helpers.  Making gssd work
might be easier.

--b.