* [PATCH 0/1] nfs-utils: Add flag and boolean to control SETENV behavior for $HOME in rpc.gssd
@ 2021-03-01 21:46 Jacob Shivers
2021-03-01 21:46 ` [PATCH 1/1] gssd: Add options to rpc.gssd to allow for the use of $HOME/.k5identity files Jacob Shivers
0 siblings, 1 reply; 3+ messages in thread
From: Jacob Shivers @ 2021-03-01 21:46 UTC (permalink / raw)
To: SteveD; +Cc: linux-nfs
A deadlock can occur when accessing NFS home directories when $HOME is
unmodified as Kerberos routines will attempt to access $HOME, but will be
inaccessible due to a lack of a Kerberos ticket. It would then check for the
existence of $HOME/.k5identity, but could not access the file due to not having
a TGT.
The issue was originally reported in:
https://bugzilla.redhat.com/show_bug.cgi?id=1052902
This patch allows for user control of this behavior granting users who do not
have Kerberized home directories access to their .k5identity file.
This addresses the following bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1868087
Jacob Shivers (1):
gssd: Add options to rpc.gssd to allow for the use of
$HOME/.k5identity files
nfs.conf | 1 +
systemd/nfs.conf.man | 3 ++-
utils/gssd/gssd.c | 28 ++++++++++++++++++++--------
utils/gssd/gssd.man | 19 ++++++++++++++++++-
4 files changed, 41 insertions(+), 10 deletions(-)
--
2.29.2
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH 1/1] gssd: Add options to rpc.gssd to allow for the use of $HOME/.k5identity files 2021-03-01 21:46 [PATCH 0/1] nfs-utils: Add flag and boolean to control SETENV behavior for $HOME in rpc.gssd Jacob Shivers @ 2021-03-01 21:46 ` Jacob Shivers 2021-03-15 19:40 ` Steve Dickson 0 siblings, 1 reply; 3+ messages in thread From: Jacob Shivers @ 2021-03-01 21:46 UTC (permalink / raw) To: SteveD; +Cc: linux-nfs Since commit 2f682f25c642fcfe7c511d04bc9d67e732282348 $HOME has been set to '/' to avoid a deadlock when accessing Kerberized NFS shares. While this works for most use cases, users who depend on the use of $HOME/.k5identity files are negatively impacted by this commit. This patch allows for users to use their $HOME/.k5identity to access subsequent Kerberized resources based on the credentials in said file. The default set by commit 2f682f25c642fcfe7c511d04bc9d67e732282348 still remains the same, but a user can pass '-H' to change rpc.gssd behavior to not set $HOME to '/'. Setting 'set-home=0' in /etc/nfs.conf has the same effect as passing '-H' directly to rpc.gssd. Signed-off-by: Jacob Shivers <jshivers@redhat.com> --- nfs.conf | 1 + systemd/nfs.conf.man | 3 ++- utils/gssd/gssd.c | 28 ++++++++++++++++++++-------- utils/gssd/gssd.man | 19 ++++++++++++++++++- 4 files changed, 41 insertions(+), 10 deletions(-) diff --git a/nfs.conf b/nfs.conf index bebb2e3d1e68..eabe8c7c34c4 100644 --- a/nfs.conf +++ b/nfs.conf @@ -24,6 +24,7 @@ # keytab-file=/etc/krb5.keytab # cred-cache-directory= # preferred-realm= +# set-home=1 # [lockd] # port=0 diff --git a/systemd/nfs.conf.man b/systemd/nfs.conf.man index d2187f8aca1a..7fa35d441eca 100644 --- a/systemd/nfs.conf.man +++ b/systemd/nfs.conf.man @@ -253,7 +253,8 @@ Recognized values: .BR rpc-timeout , .BR keytab-file , .BR cred-cache-directory , -.BR preferred-realm . +.BR preferred-realm , +.BR set-home . See .BR rpc.gssd (8) diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c index 85bc4b07bebd..1541d3710b24 100644 --- a/utils/gssd/gssd.c +++ b/utils/gssd/gssd.c @@ -87,6 +87,8 @@ unsigned int context_timeout = 0; unsigned int rpc_timeout = 5; char *preferred_realm = NULL; char *ccachedir = NULL; +/* set $HOME to "/" by default */ +static bool set_home = true; /* Avoid DNS reverse lookups on server names */ static bool avoid_dns = true; static bool use_gssproxy = false; @@ -900,7 +902,7 @@ sig_die(int signal) static void usage(char *progname) { - fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n", + fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D] [-H]\n", progname); exit(1); } @@ -941,6 +943,7 @@ read_gss_conf(void) preferred_realm = s; use_gssproxy = conf_get_bool("gssd", "use-gss-proxy", use_gssproxy); + set_home = conf_get_bool("gssd", "set-home", set_home); } int @@ -961,7 +964,7 @@ main(int argc, char *argv[]) verbosity = conf_get_num("gssd", "verbosity", verbosity); rpc_verbosity = conf_get_num("gssd", "rpc-verbosity", rpc_verbosity); - while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) { + while ((opt = getopt(argc, argv, "HDfvrlmnMp:k:d:t:T:R:")) != -1) { switch (opt) { case 'f': fg = 1; @@ -1009,6 +1012,9 @@ main(int argc, char *argv[]) case 'D': avoid_dns = false; break; + case 'H': + set_home = false; + break; default: usage(argv[0]); break; @@ -1018,13 +1024,19 @@ main(int argc, char *argv[]) /* * Some krb5 routines try to scrape info out of files in the user's * home directory. This can easily deadlock when that homedir is on a - * kerberized NFS mount. By setting $HOME unconditionally to "/", we - * prevent this behavior in routines that use $HOME in preference to - * the results of getpw*. + * kerberized NFS mount. By setting $HOME to "/" by default, we prevent + * this behavior in routines that use $HOME in preference to the results + * of getpw*. + * + * Some users do not use Kerberized home dirs and need $HOME to remain + * unchanged. Those users can leave $HOME unchanged by setting set_home + * to false. */ - if (setenv("HOME", "/", 1)) { - printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); - exit(1); + if (set_home) { + if (setenv("HOME", "/", 1)) { + printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); + exit(1); + } } if (use_gssproxy) { diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man index 26095a898293..c93cde6a66e5 100644 --- a/utils/gssd/gssd.man +++ b/utils/gssd/gssd.man @@ -8,7 +8,7 @@ rpc.gssd \- RPCSEC_GSS daemon .SH SYNOPSIS .B rpc.gssd -.RB [ \-DfMnlvr ] +.RB [ \-DfMnlvrH ] .RB [ \-k .IR keytab ] .RB [ \-p @@ -282,6 +282,16 @@ The default timeout is set to 5 seconds. If you get messages like "WARNING: can't create tcp rpc_clnt to server %servername% for user with uid %uid%: RPC: Remote system error - Connection timed out", you should consider an increase of this timeout. +.TP +.B -H +Avoids setting $HOME to "/". This allows rpc.gssd to read per user k5identity +files versus trying to read /.k5identity for each user. + +If +.B \-H +is not set, rpc.gssd will use the first match found in +/var/kerberos/krb5/user/$EUID/client.keytab and will not use a principal based on +host and/or service parameters listed in $HOME/.k5identity. .SH CONFIGURATION FILE Many of the options that can be set on the command line can also be controlled through values set in the @@ -347,6 +357,13 @@ section: .B pipefs-directory Equivalent to .BR -p . +.TP +.B set-home +Setting to +.B false +is equivalent to providing the +.B -H +flag. .SH SEE ALSO .BR rpc.svcgssd (8), -- 2.29.2 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] gssd: Add options to rpc.gssd to allow for the use of $HOME/.k5identity files 2021-03-01 21:46 ` [PATCH 1/1] gssd: Add options to rpc.gssd to allow for the use of $HOME/.k5identity files Jacob Shivers @ 2021-03-15 19:40 ` Steve Dickson 0 siblings, 0 replies; 3+ messages in thread From: Steve Dickson @ 2021-03-15 19:40 UTC (permalink / raw) To: Jacob Shivers; +Cc: linux-nfs On 3/1/21 4:46 PM, Jacob Shivers wrote: > Since commit 2f682f25c642fcfe7c511d04bc9d67e732282348 $HOME has been set to '/' > to avoid a deadlock when accessing Kerberized NFS shares. While this works for > most use cases, users who depend on the use of $HOME/.k5identity files are > negatively impacted by this commit. This patch allows for users to use their > $HOME/.k5identity to access subsequent Kerberized resources based on the > credentials in said file. > > The default set by commit 2f682f25c642fcfe7c511d04bc9d67e732282348 still remains > the same, but a user can pass '-H' to change rpc.gssd behavior to not set $HOME > to '/'. Setting 'set-home=0' in /etc/nfs.conf has the same effect as passing > '-H' directly to rpc.gssd. > > Signed-off-by: Jacob Shivers <jshivers@redhat.com> Committed... (tag: nfs-utils-2-5-4-rc1) steved. > --- > nfs.conf | 1 + > systemd/nfs.conf.man | 3 ++- > utils/gssd/gssd.c | 28 ++++++++++++++++++++-------- > utils/gssd/gssd.man | 19 ++++++++++++++++++- > 4 files changed, 41 insertions(+), 10 deletions(-) > > diff --git a/nfs.conf b/nfs.conf > index bebb2e3d1e68..eabe8c7c34c4 100644 > --- a/nfs.conf > +++ b/nfs.conf > @@ -24,6 +24,7 @@ > # keytab-file=/etc/krb5.keytab > # cred-cache-directory= > # preferred-realm= > +# set-home=1 > # > [lockd] > # port=0 > diff --git a/systemd/nfs.conf.man b/systemd/nfs.conf.man > index d2187f8aca1a..7fa35d441eca 100644 > --- a/systemd/nfs.conf.man > +++ b/systemd/nfs.conf.man > @@ -253,7 +253,8 @@ Recognized values: > .BR rpc-timeout , > .BR keytab-file , > .BR cred-cache-directory , > -.BR preferred-realm . > +.BR preferred-realm , > +.BR set-home . > > See > .BR rpc.gssd (8) > diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c > index 85bc4b07bebd..1541d3710b24 100644 > --- a/utils/gssd/gssd.c > +++ b/utils/gssd/gssd.c > @@ -87,6 +87,8 @@ unsigned int context_timeout = 0; > unsigned int rpc_timeout = 5; > char *preferred_realm = NULL; > char *ccachedir = NULL; > +/* set $HOME to "/" by default */ > +static bool set_home = true; > /* Avoid DNS reverse lookups on server names */ > static bool avoid_dns = true; > static bool use_gssproxy = false; > @@ -900,7 +902,7 @@ sig_die(int signal) > static void > usage(char *progname) > { > - fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n", > + fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D] [-H]\n", > progname); > exit(1); > } > @@ -941,6 +943,7 @@ read_gss_conf(void) > preferred_realm = s; > > use_gssproxy = conf_get_bool("gssd", "use-gss-proxy", use_gssproxy); > + set_home = conf_get_bool("gssd", "set-home", set_home); > } > > int > @@ -961,7 +964,7 @@ main(int argc, char *argv[]) > verbosity = conf_get_num("gssd", "verbosity", verbosity); > rpc_verbosity = conf_get_num("gssd", "rpc-verbosity", rpc_verbosity); > > - while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) { > + while ((opt = getopt(argc, argv, "HDfvrlmnMp:k:d:t:T:R:")) != -1) { > switch (opt) { > case 'f': > fg = 1; > @@ -1009,6 +1012,9 @@ main(int argc, char *argv[]) > case 'D': > avoid_dns = false; > break; > + case 'H': > + set_home = false; > + break; > default: > usage(argv[0]); > break; > @@ -1018,13 +1024,19 @@ main(int argc, char *argv[]) > /* > * Some krb5 routines try to scrape info out of files in the user's > * home directory. This can easily deadlock when that homedir is on a > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > - * prevent this behavior in routines that use $HOME in preference to > - * the results of getpw*. > + * kerberized NFS mount. By setting $HOME to "/" by default, we prevent > + * this behavior in routines that use $HOME in preference to the results > + * of getpw*. > + * > + * Some users do not use Kerberized home dirs and need $HOME to remain > + * unchanged. Those users can leave $HOME unchanged by setting set_home > + * to false. > */ > - if (setenv("HOME", "/", 1)) { > - printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); > - exit(1); > + if (set_home) { > + if (setenv("HOME", "/", 1)) { > + printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); > + exit(1); > + } > } > > if (use_gssproxy) { > diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man > index 26095a898293..c93cde6a66e5 100644 > --- a/utils/gssd/gssd.man > +++ b/utils/gssd/gssd.man > @@ -8,7 +8,7 @@ > rpc.gssd \- RPCSEC_GSS daemon > .SH SYNOPSIS > .B rpc.gssd > -.RB [ \-DfMnlvr ] > +.RB [ \-DfMnlvrH ] > .RB [ \-k > .IR keytab ] > .RB [ \-p > @@ -282,6 +282,16 @@ The default timeout is set to 5 seconds. > If you get messages like "WARNING: can't create tcp rpc_clnt to server > %servername% for user with uid %uid%: RPC: Remote system error - > Connection timed out", you should consider an increase of this timeout. > +.TP > +.B -H > +Avoids setting $HOME to "/". This allows rpc.gssd to read per user k5identity > +files versus trying to read /.k5identity for each user. > + > +If > +.B \-H > +is not set, rpc.gssd will use the first match found in > +/var/kerberos/krb5/user/$EUID/client.keytab and will not use a principal based on > +host and/or service parameters listed in $HOME/.k5identity. > .SH CONFIGURATION FILE > Many of the options that can be set on the command line can also be > controlled through values set in the > @@ -347,6 +357,13 @@ section: > .B pipefs-directory > Equivalent to > .BR -p . > +.TP > +.B set-home > +Setting to > +.B false > +is equivalent to providing the > +.B -H > +flag. > > .SH SEE ALSO > .BR rpc.svcgssd (8), > ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-15 19:39 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2021-03-01 21:46 [PATCH 0/1] nfs-utils: Add flag and boolean to control SETENV behavior for $HOME in rpc.gssd Jacob Shivers 2021-03-01 21:46 ` [PATCH 1/1] gssd: Add options to rpc.gssd to allow for the use of $HOME/.k5identity files Jacob Shivers 2021-03-15 19:40 ` Steve Dickson
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).