* gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
@ 2020-11-23 18:17 Jacob Shivers
2020-12-07 18:06 ` Steve Dickson
0 siblings, 1 reply; 6+ messages in thread
From: Jacob Shivers @ 2020-11-23 18:17 UTC (permalink / raw)
To: linux-nfs
Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
behavior to avoid a deadlock for users using Kerberized NFS home dirs.
However, this also prevents users leveraging their own k5identity
files under their home directory and instead rpc.gssd uses a
system-wide /.k5identity file. For users expecting to use their own
k5identity file this is certainly unexpected.
Below is some pseudo code that was proposed and would just add a flag
allowing for the behavior prior to
2f682f25c642fcfe7c511d04bc9d67e732282348:
/* psudo code snippet starts here */
/*
* Some krb5 routines try to scrape info out of files in the user's
* home directory. This can easily deadlock when that homedir is on a
- * kerberized NFS mount. By setting $HOME unconditionally to "/", we
+ * kerberized NFS mount. Some users may not have $HOME on NFS.
+ * By default setting $HOME unconditionally to "/", we
* prevent this behavior in routines that use $HOME in preference to
* the results of getpw*.
+ * Users who have $HOME on krb5-NFS should set
`--home-not-kerberized` in argv
+ * Users who have $HOME on krb5-NFS but want to use their
$HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
*/
+ if (argv == '--home-not-kerberized') ||
(getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
+ log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
+ }
+ else {
+ log.debug('Assuming $HOME requires Kerberos, use
`--home-not-kerberized` to change this behavior');
if (setenv("HOME", "/", 1)) {
printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
exit(1);
}
+ }
/* psudo code snippet ends here */
While acknowledging the use of this flag for Kerberized NFS home dirs
is undesirable and would cause a deadlock, there should be no issue
for users not using Kerberized NFS home dirs.
Does anyone consider adding the above proposed flag as being problematic?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
2020-11-23 18:17 gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted Jacob Shivers
@ 2020-12-07 18:06 ` Steve Dickson
2021-01-04 16:00 ` Jacob Shivers
0 siblings, 1 reply; 6+ messages in thread
From: Steve Dickson @ 2020-12-07 18:06 UTC (permalink / raw)
To: Jacob Shivers, linux-nfs
Hello,
Sorry for the delayed response... Trying to burn up some PTO.
On 11/23/20 1:17 PM, Jacob Shivers wrote:
> Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
> behavior to avoid a deadlock for users using Kerberized NFS home dirs.
>
> However, this also prevents users leveraging their own k5identity
> files under their home directory and instead rpc.gssd uses a
> system-wide /.k5identity file. For users expecting to use their own
> k5identity file this is certainly unexpected.
So how is the deadlock not happening when ~/.k5identity is on a NFS
home directory? What am I missing?
>
> Below is some pseudo code that was proposed and would just add a flag
> allowing for the behavior prior to
> 2f682f25c642fcfe7c511d04bc9d67e732282348:
>
> /* psudo code snippet starts here */
> /*
> * Some krb5 routines try to scrape info out of files in the user's
> * home directory. This can easily deadlock when that homedir is on a
> - * kerberized NFS mount. By setting $HOME unconditionally to "/", we
> + * kerberized NFS mount. Some users may not have $HOME on NFS.
> + * By default setting $HOME unconditionally to "/", we
> * prevent this behavior in routines that use $HOME in preference to
> * the results of getpw*.
> + * Users who have $HOME on krb5-NFS should set
> `--home-not-kerberized` in argv
> + * Users who have $HOME on krb5-NFS but want to use their
> $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
> */
> + if (argv == '--home-not-kerberized') ||
> (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
> + log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
> + }
> + else {
> + log.debug('Assuming $HOME requires Kerberos, use
> `--home-not-kerberized` to change this behavior');
> if (setenv("HOME", "/", 1)) {
> printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
> exit(1);
> }
> + }
> /* psudo code snippet ends here */
In general I'm pretty reluctant to add flags but what is needed
to do so is a company single letter flag '-H' and a man page
entry describing the flag.
>
> While acknowledging the use of this flag for Kerberized NFS home dirs
> is undesirable and would cause a deadlock, there should be no issue
> for users not using Kerberized NFS home dirs.
What apps are you using that is seeing this problem?
steved.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
2020-12-07 18:06 ` Steve Dickson
@ 2021-01-04 16:00 ` Jacob Shivers
2021-03-01 16:50 ` Jacob Shivers
0 siblings, 1 reply; 6+ messages in thread
From: Jacob Shivers @ 2021-01-04 16:00 UTC (permalink / raw)
To: Steve Dickson; +Cc: linux-nfs
Hello,
I completely missed this so please excuse the delay.
> On 11/23/20 1:17 PM, Jacob Shivers wrote:
> > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
> > behavior to avoid a deadlock for users using Kerberized NFS home dirs.
> >
> > However, this also prevents users leveraging their own k5identity
> > files under their home directory and instead rpc.gssd uses a
> > system-wide /.k5identity file. For users expecting to use their own
> > k5identity file this is certainly unexpected.
> So how is the deadlock not happening when ~/.k5identity is on a NFS
> home directory? What am I missing?
They are not using NFS for home directories. They are accessing
systems with a local fs backing the /home
> > Below is some pseudo code that was proposed and would just add a flag
> > allowing for the behavior prior to
> > 2f682f25c642fcfe7c511d04bc9d67e732282348:
> >
> > /* psudo code snippet starts here */
> > /*
> > * Some krb5 routines try to scrape info out of files in the user's
> > * home directory. This can easily deadlock when that homedir is on a
> > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we
> > + * kerberized NFS mount. Some users may not have $HOME on NFS.
> > + * By default setting $HOME unconditionally to "/", we
> > * prevent this behavior in routines that use $HOME in preference to
> > * the results of getpw*.
> > + * Users who have $HOME on krb5-NFS should set
> > `--home-not-kerberized` in argv
> > + * Users who have $HOME on krb5-NFS but want to use their
> > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
> > */
> > + if (argv == '--home-not-kerberized') ||
> > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
> > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
> > + }
> > + else {
> > + log.debug('Assuming $HOME requires Kerberos, use
> > `--home-not-kerberized` to change this behavior');
> > if (setenv("HOME", "/", 1)) {
> > printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
> > exit(1);
> > }
> > + }
> > /* psudo code snippet ends here */
> In general I'm pretty reluctant to add flags but what is needed
> to do so is a company single letter flag '-H' and a man page
> entry describing the flag.
Ok.
> >
> > While acknowledging the use of this flag for Kerberized NFS home dirs
> > is undesirable and would cause a deadlock, there should be no issue
> > for users not using Kerberized NFS home dirs.
> What apps are you using that is seeing this problem?
It is just when accessing the Kerberized NFS share. Other Kerberos
aware services/applications check for the existence of ~/.k5identify
before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd
no longer does this and the intent of the patch would be to add
granularity to choose the behavior or rpc.gssd with respect to
scanning for a k5identity file.
If any additional information is required, please inform me.
Thanks,
Jacob Shivers
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
2021-01-04 16:00 ` Jacob Shivers
@ 2021-03-01 16:50 ` Jacob Shivers
2021-03-01 18:54 ` David Wysochanski
0 siblings, 1 reply; 6+ messages in thread
From: Jacob Shivers @ 2021-03-01 16:50 UTC (permalink / raw)
To: Steve Dickson; +Cc: linux-nfs
[-- Attachment #1: Type: text/plain, Size: 3656 bytes --]
Patches that include a '-H' flag and man page entry.
The default is to maintain behavior since
2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids
$HOME being set to '/'.
Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting
it to false is equivalent to passing '-H' to rpc.gssd.
Regards,
Jacob Shivers
On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote:
>
> Hello,
>
> I completely missed this so please excuse the delay.
>
> > On 11/23/20 1:17 PM, Jacob Shivers wrote:
> > > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
> > > behavior to avoid a deadlock for users using Kerberized NFS home dirs.
> > >
> > > However, this also prevents users leveraging their own k5identity
> > > files under their home directory and instead rpc.gssd uses a
> > > system-wide /.k5identity file. For users expecting to use their own
> > > k5identity file this is certainly unexpected.
> > So how is the deadlock not happening when ~/.k5identity is on a NFS
> > home directory? What am I missing?
> They are not using NFS for home directories. They are accessing
> systems with a local fs backing the /home
>
> > > Below is some pseudo code that was proposed and would just add a flag
> > > allowing for the behavior prior to
> > > 2f682f25c642fcfe7c511d04bc9d67e732282348:
> > >
> > > /* psudo code snippet starts here */
> > > /*
> > > * Some krb5 routines try to scrape info out of files in the user's
> > > * home directory. This can easily deadlock when that homedir is on a
> > > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we
> > > + * kerberized NFS mount. Some users may not have $HOME on NFS.
> > > + * By default setting $HOME unconditionally to "/", we
> > > * prevent this behavior in routines that use $HOME in preference to
> > > * the results of getpw*.
> > > + * Users who have $HOME on krb5-NFS should set
> > > `--home-not-kerberized` in argv
> > > + * Users who have $HOME on krb5-NFS but want to use their
> > > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
> > > */
> > > + if (argv == '--home-not-kerberized') ||
> > > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
> > > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
> > > + }
> > > + else {
> > > + log.debug('Assuming $HOME requires Kerberos, use
> > > `--home-not-kerberized` to change this behavior');
> > > if (setenv("HOME", "/", 1)) {
> > > printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
> > > exit(1);
> > > }
> > > + }
> > > /* psudo code snippet ends here */
> > In general I'm pretty reluctant to add flags but what is needed
> > to do so is a company single letter flag '-H' and a man page
> > entry describing the flag.
> Ok.
>
> > >
> > > While acknowledging the use of this flag for Kerberized NFS home dirs
> > > is undesirable and would cause a deadlock, there should be no issue
> > > for users not using Kerberized NFS home dirs.
> > What apps are you using that is seeing this problem?
> It is just when accessing the Kerberized NFS share. Other Kerberos
> aware services/applications check for the existence of ~/.k5identify
> before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd
> no longer does this and the intent of the patch would be to add
> granularity to choose the behavior or rpc.gssd with respect to
> scanning for a k5identity file.
>
> If any additional information is required, please inform me.
>
> Thanks,
>
> Jacob Shivers
[-- Attachment #2: 0001-nfsconf_set-home.patch --]
[-- Type: text/x-patch, Size: 224 bytes --]
diff --git a/nfs.conf b/nfs.conf
index 9fcf1bf..4c41666 100644
--- a/nfs.conf
+++ b/nfs.conf
@@ -24,6 +24,7 @@
# keytab-file=/etc/krb5.keytab
# cred-cache-directory=
# preferred-realm=
+# set-home=1
#
[lockd]
# port=0
[-- Attachment #3: 0001-gssd-set_home.patch --]
[-- Type: text/x-patch, Size: 2606 bytes --]
diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
index 85bc4b07..1541d371 100644
--- a/utils/gssd/gssd.c
+++ b/utils/gssd/gssd.c
@@ -87,6 +87,8 @@ unsigned int context_timeout = 0;
unsigned int rpc_timeout = 5;
char *preferred_realm = NULL;
char *ccachedir = NULL;
+/* set $HOME to "/" by default */
+static bool set_home = true;
/* Avoid DNS reverse lookups on server names */
static bool avoid_dns = true;
static bool use_gssproxy = false;
@@ -900,7 +902,7 @@ sig_die(int signal)
static void
usage(char *progname)
{
- fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
+ fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D] [-H]\n",
progname);
exit(1);
}
@@ -941,6 +943,7 @@ read_gss_conf(void)
preferred_realm = s;
use_gssproxy = conf_get_bool("gssd", "use-gss-proxy", use_gssproxy);
+ set_home = conf_get_bool("gssd", "set-home", set_home);
}
int
@@ -961,7 +964,7 @@ main(int argc, char *argv[])
verbosity = conf_get_num("gssd", "verbosity", verbosity);
rpc_verbosity = conf_get_num("gssd", "rpc-verbosity", rpc_verbosity);
- while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) {
+ while ((opt = getopt(argc, argv, "HDfvrlmnMp:k:d:t:T:R:")) != -1) {
switch (opt) {
case 'f':
fg = 1;
@@ -1009,6 +1012,9 @@ main(int argc, char *argv[])
case 'D':
avoid_dns = false;
break;
+ case 'H':
+ set_home = false;
+ break;
default:
usage(argv[0]);
break;
@@ -1018,13 +1024,19 @@ main(int argc, char *argv[])
/*
* Some krb5 routines try to scrape info out of files in the user's
* home directory. This can easily deadlock when that homedir is on a
- * kerberized NFS mount. By setting $HOME unconditionally to "/", we
- * prevent this behavior in routines that use $HOME in preference to
- * the results of getpw*.
+ * kerberized NFS mount. By setting $HOME to "/" by default, we prevent
+ * this behavior in routines that use $HOME in preference to the results
+ * of getpw*.
+ *
+ * Some users do not use Kerberized home dirs and need $HOME to remain
+ * unchanged. Those users can leave $HOME unchanged by setting set_home
+ * to false.
*/
- if (setenv("HOME", "/", 1)) {
- printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno));
- exit(1);
+ if (set_home) {
+ if (setenv("HOME", "/", 1)) {
+ printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno));
+ exit(1);
+ }
}
if (use_gssproxy) {
[-- Attachment #4: 0001-manpage-nfs.conf_update_for_set-home.patch --]
[-- Type: text/x-patch, Size: 333 bytes --]
diff --git a/systemd/nfs.conf.man b/systemd/nfs.conf.man
index 16e0ec4..ee54041 100644
--- a/systemd/nfs.conf.man
+++ b/systemd/nfs.conf.man
@@ -243,7 +243,8 @@ Recognized values:
.BR rpc-timeout ,
.BR keytab-file ,
.BR cred-cache-directory ,
-.BR preferred-realm .
+.BR preferred-realm ,
+.BR set-home .
See
.BR rpc.gssd (8)
[-- Attachment #5: 0001-manpage-rpc.gssd_update_for_set-home.patch --]
[-- Type: text/x-patch, Size: 1252 bytes --]
diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man
index 26095a8..b6444ab 100644
--- a/utils/gssd/gssd.man
+++ b/utils/gssd/gssd.man
@@ -8,7 +8,7 @@
rpc.gssd \- RPCSEC_GSS daemon
.SH SYNOPSIS
.B rpc.gssd
-.RB [ \-DfMnlvr ]
+.RB [ \-DfMnlvrH ]
.RB [ \-k
.IR keytab ]
.RB [ \-p
@@ -282,6 +282,16 @@ The default timeout is set to 5 seconds.
If you get messages like "WARNING: can't create tcp rpc_clnt to server
%servername% for user with uid %uid%: RPC: Remote system error -
Connection timed out", you should consider an increase of this timeout.
+.TP
+.B -H
+Avoids setting $HOME to "/". This allows rpc.gssd to read per user k5identity
+files versus trying to read /.k5identity for each user.
+
+If
+.B \-H
+is not set, rpc.gssd will use the first match found in
+/var/kerberos/krb5/user/$EUID/client.keytab and will not use a principal based on
+host and/or service parameters listed in $HOME/.k5identity.
.SH CONFIGURATION FILE
Many of the options that can be set on the command line can also be
controlled through values set in the
@@ -347,6 +357,13 @@ section:
.B pipefs-directory
Equivalent to
.BR -p .
+.TP
+.B set-home
+Setting to
+.B false
+is equivalent to providing the
+.B -H
+flag.
.SH SEE ALSO
.BR rpc.svcgssd (8),
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
2021-03-01 16:50 ` Jacob Shivers
@ 2021-03-01 18:54 ` David Wysochanski
2021-03-02 21:14 ` Steve Dickson
0 siblings, 1 reply; 6+ messages in thread
From: David Wysochanski @ 2021-03-01 18:54 UTC (permalink / raw)
To: Jacob Shivers; +Cc: Steve Dickson, linux-nfs
I was talking to Jake and I think he will submit this again without
attachments so it's a little easier to review.
On Mon, Mar 1, 2021 at 12:07 PM Jacob Shivers <jshivers@redhat.com> wrote:
>
> Patches that include a '-H' flag and man page entry.
>
> The default is to maintain behavior since
> 2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids
> $HOME being set to '/'.
> Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting
> it to false is equivalent to passing '-H' to rpc.gssd.
>
> Regards,
>
> Jacob Shivers
>
> On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote:
> >
> > Hello,
> >
> > I completely missed this so please excuse the delay.
> >
> > > On 11/23/20 1:17 PM, Jacob Shivers wrote:
> > > > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
> > > > behavior to avoid a deadlock for users using Kerberized NFS home dirs.
> > > >
> > > > However, this also prevents users leveraging their own k5identity
> > > > files under their home directory and instead rpc.gssd uses a
> > > > system-wide /.k5identity file. For users expecting to use their own
> > > > k5identity file this is certainly unexpected.
> > > So how is the deadlock not happening when ~/.k5identity is on a NFS
> > > home directory? What am I missing?
> > They are not using NFS for home directories. They are accessing
> > systems with a local fs backing the /home
> >
> > > > Below is some pseudo code that was proposed and would just add a flag
> > > > allowing for the behavior prior to
> > > > 2f682f25c642fcfe7c511d04bc9d67e732282348:
> > > >
> > > > /* psudo code snippet starts here */
> > > > /*
> > > > * Some krb5 routines try to scrape info out of files in the user's
> > > > * home directory. This can easily deadlock when that homedir is on a
> > > > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we
> > > > + * kerberized NFS mount. Some users may not have $HOME on NFS.
> > > > + * By default setting $HOME unconditionally to "/", we
> > > > * prevent this behavior in routines that use $HOME in preference to
> > > > * the results of getpw*.
> > > > + * Users who have $HOME on krb5-NFS should set
> > > > `--home-not-kerberized` in argv
> > > > + * Users who have $HOME on krb5-NFS but want to use their
> > > > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
> > > > */
> > > > + if (argv == '--home-not-kerberized') ||
> > > > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
> > > > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
> > > > + }
> > > > + else {
> > > > + log.debug('Assuming $HOME requires Kerberos, use
> > > > `--home-not-kerberized` to change this behavior');
> > > > if (setenv("HOME", "/", 1)) {
> > > > printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
> > > > exit(1);
> > > > }
> > > > + }
> > > > /* psudo code snippet ends here */
> > > In general I'm pretty reluctant to add flags but what is needed
> > > to do so is a company single letter flag '-H' and a man page
> > > entry describing the flag.
> > Ok.
> >
> > > >
> > > > While acknowledging the use of this flag for Kerberized NFS home dirs
> > > > is undesirable and would cause a deadlock, there should be no issue
> > > > for users not using Kerberized NFS home dirs.
> > > What apps are you using that is seeing this problem?
> > It is just when accessing the Kerberized NFS share. Other Kerberos
> > aware services/applications check for the existence of ~/.k5identify
> > before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd
> > no longer does this and the intent of the patch would be to add
> > granularity to choose the behavior or rpc.gssd with respect to
> > scanning for a k5identity file.
> >
> > If any additional information is required, please inform me.
> >
> > Thanks,
> >
> > Jacob Shivers
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
2021-03-01 18:54 ` David Wysochanski
@ 2021-03-02 21:14 ` Steve Dickson
0 siblings, 0 replies; 6+ messages in thread
From: Steve Dickson @ 2021-03-02 21:14 UTC (permalink / raw)
To: David Wysochanski, Jacob Shivers; +Cc: linux-nfs
On 3/1/21 1:54 PM, David Wysochanski wrote:
> I was talking to Jake and I think he will submit this again without
> attachments so it's a little easier to review.
Thank you!
steved.
>
> On Mon, Mar 1, 2021 at 12:07 PM Jacob Shivers <jshivers@redhat.com> wrote:
>>
>> Patches that include a '-H' flag and man page entry.
>>
>> The default is to maintain behavior since
>> 2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids
>> $HOME being set to '/'.
>> Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting
>> it to false is equivalent to passing '-H' to rpc.gssd.
>>
>> Regards,
>>
>> Jacob Shivers
>>
>> On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote:
>>>
>>> Hello,
>>>
>>> I completely missed this so please excuse the delay.
>>>
>>>> On 11/23/20 1:17 PM, Jacob Shivers wrote:
>>>>> Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
>>>>> behavior to avoid a deadlock for users using Kerberized NFS home dirs.
>>>>>
>>>>> However, this also prevents users leveraging their own k5identity
>>>>> files under their home directory and instead rpc.gssd uses a
>>>>> system-wide /.k5identity file. For users expecting to use their own
>>>>> k5identity file this is certainly unexpected.
>>>> So how is the deadlock not happening when ~/.k5identity is on a NFS
>>>> home directory? What am I missing?
>>> They are not using NFS for home directories. They are accessing
>>> systems with a local fs backing the /home
>>>
>>>>> Below is some pseudo code that was proposed and would just add a flag
>>>>> allowing for the behavior prior to
>>>>> 2f682f25c642fcfe7c511d04bc9d67e732282348:
>>>>>
>>>>> /* psudo code snippet starts here */
>>>>> /*
>>>>> * Some krb5 routines try to scrape info out of files in the user's
>>>>> * home directory. This can easily deadlock when that homedir is on a
>>>>> - * kerberized NFS mount. By setting $HOME unconditionally to "/", we
>>>>> + * kerberized NFS mount. Some users may not have $HOME on NFS.
>>>>> + * By default setting $HOME unconditionally to "/", we
>>>>> * prevent this behavior in routines that use $HOME in preference to
>>>>> * the results of getpw*.
>>>>> + * Users who have $HOME on krb5-NFS should set
>>>>> `--home-not-kerberized` in argv
>>>>> + * Users who have $HOME on krb5-NFS but want to use their
>>>>> $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
>>>>> */
>>>>> + if (argv == '--home-not-kerberized') ||
>>>>> (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
>>>>> + log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
>>>>> + }
>>>>> + else {
>>>>> + log.debug('Assuming $HOME requires Kerberos, use
>>>>> `--home-not-kerberized` to change this behavior');
>>>>> if (setenv("HOME", "/", 1)) {
>>>>> printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
>>>>> exit(1);
>>>>> }
>>>>> + }
>>>>> /* psudo code snippet ends here */
>>>> In general I'm pretty reluctant to add flags but what is needed
>>>> to do so is a company single letter flag '-H' and a man page
>>>> entry describing the flag.
>>> Ok.
>>>
>>>>>
>>>>> While acknowledging the use of this flag for Kerberized NFS home dirs
>>>>> is undesirable and would cause a deadlock, there should be no issue
>>>>> for users not using Kerberized NFS home dirs.
>>>> What apps are you using that is seeing this problem?
>>> It is just when accessing the Kerberized NFS share. Other Kerberos
>>> aware services/applications check for the existence of ~/.k5identify
>>> before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd
>>> no longer does this and the intent of the patch would be to add
>>> granularity to choose the behavior or rpc.gssd with respect to
>>> scanning for a k5identity file.
>>>
>>> If any additional information is required, please inform me.
>>>
>>> Thanks,
>>>
>>> Jacob Shivers
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-03-03 11:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-23 18:17 gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted Jacob Shivers
2020-12-07 18:06 ` Steve Dickson
2021-01-04 16:00 ` Jacob Shivers
2021-03-01 16:50 ` Jacob Shivers
2021-03-01 18:54 ` David Wysochanski
2021-03-02 21:14 ` Steve Dickson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).