* gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted
@ 2020-11-23 18:17 Jacob Shivers
2020-12-07 18:06 ` Steve Dickson
0 siblings, 1 reply; 6+ messages in thread
From: Jacob Shivers @ 2020-11-23 18:17 UTC (permalink / raw)
To: linux-nfs
Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing
behavior to avoid a deadlock for users using Kerberized NFS home dirs.
However, this also prevents users leveraging their own k5identity
files under their home directory and instead rpc.gssd uses a
system-wide /.k5identity file. For users expecting to use their own
k5identity file this is certainly unexpected.
Below is some pseudo code that was proposed and would just add a flag
allowing for the behavior prior to
2f682f25c642fcfe7c511d04bc9d67e732282348:
/* psudo code snippet starts here */
/*
* Some krb5 routines try to scrape info out of files in the user's
* home directory. This can easily deadlock when that homedir is on a
- * kerberized NFS mount. By setting $HOME unconditionally to "/", we
+ * kerberized NFS mount. Some users may not have $HOME on NFS.
+ * By default setting $HOME unconditionally to "/", we
* prevent this behavior in routines that use $HOME in preference to
* the results of getpw*.
+ * Users who have $HOME on krb5-NFS should set
`--home-not-kerberized` in argv
+ * Users who have $HOME on krb5-NFS but want to use their
$HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE
*/
+ if (argv == '--home-not-kerberized') ||
(getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') {
+ log.debug('Not masking $HOME, this breaks on Kerberized $HOME');
+ }
+ else {
+ log.debug('Assuming $HOME requires Kerberos, use
`--home-not-kerberized` to change this behavior');
if (setenv("HOME", "/", 1)) {
printerr(1, "Unable to set $HOME: %s\n", strerror(errn));
exit(1);
}
+ }
/* psudo code snippet ends here */
While acknowledging the use of this flag for Kerberized NFS home dirs
is undesirable and would cause a deadlock, there should be no issue
for users not using Kerberized NFS home dirs.
Does anyone consider adding the above proposed flag as being problematic?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted 2020-11-23 18:17 gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted Jacob Shivers @ 2020-12-07 18:06 ` Steve Dickson 2021-01-04 16:00 ` Jacob Shivers 0 siblings, 1 reply; 6+ messages in thread From: Steve Dickson @ 2020-12-07 18:06 UTC (permalink / raw) To: Jacob Shivers, linux-nfs Hello, Sorry for the delayed response... Trying to burn up some PTO. On 11/23/20 1:17 PM, Jacob Shivers wrote: > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing > behavior to avoid a deadlock for users using Kerberized NFS home dirs. > > However, this also prevents users leveraging their own k5identity > files under their home directory and instead rpc.gssd uses a > system-wide /.k5identity file. For users expecting to use their own > k5identity file this is certainly unexpected. So how is the deadlock not happening when ~/.k5identity is on a NFS home directory? What am I missing? > > Below is some pseudo code that was proposed and would just add a flag > allowing for the behavior prior to > 2f682f25c642fcfe7c511d04bc9d67e732282348: > > /* psudo code snippet starts here */ > /* > * Some krb5 routines try to scrape info out of files in the user's > * home directory. This can easily deadlock when that homedir is on a > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > + * kerberized NFS mount. Some users may not have $HOME on NFS. > + * By default setting $HOME unconditionally to "/", we > * prevent this behavior in routines that use $HOME in preference to > * the results of getpw*. > + * Users who have $HOME on krb5-NFS should set > `--home-not-kerberized` in argv > + * Users who have $HOME on krb5-NFS but want to use their > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE > */ > + if (argv == '--home-not-kerberized') || > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') { > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME'); > + } > + else { > + log.debug('Assuming $HOME requires Kerberos, use > `--home-not-kerberized` to change this behavior'); > if (setenv("HOME", "/", 1)) { > printerr(1, "Unable to set $HOME: %s\n", strerror(errn)); > exit(1); > } > + } > /* psudo code snippet ends here */ In general I'm pretty reluctant to add flags but what is needed to do so is a company single letter flag '-H' and a man page entry describing the flag. > > While acknowledging the use of this flag for Kerberized NFS home dirs > is undesirable and would cause a deadlock, there should be no issue > for users not using Kerberized NFS home dirs. What apps are you using that is seeing this problem? steved. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted 2020-12-07 18:06 ` Steve Dickson @ 2021-01-04 16:00 ` Jacob Shivers 2021-03-01 16:50 ` Jacob Shivers 0 siblings, 1 reply; 6+ messages in thread From: Jacob Shivers @ 2021-01-04 16:00 UTC (permalink / raw) To: Steve Dickson; +Cc: linux-nfs Hello, I completely missed this so please excuse the delay. > On 11/23/20 1:17 PM, Jacob Shivers wrote: > > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing > > behavior to avoid a deadlock for users using Kerberized NFS home dirs. > > > > However, this also prevents users leveraging their own k5identity > > files under their home directory and instead rpc.gssd uses a > > system-wide /.k5identity file. For users expecting to use their own > > k5identity file this is certainly unexpected. > So how is the deadlock not happening when ~/.k5identity is on a NFS > home directory? What am I missing? They are not using NFS for home directories. They are accessing systems with a local fs backing the /home > > Below is some pseudo code that was proposed and would just add a flag > > allowing for the behavior prior to > > 2f682f25c642fcfe7c511d04bc9d67e732282348: > > > > /* psudo code snippet starts here */ > > /* > > * Some krb5 routines try to scrape info out of files in the user's > > * home directory. This can easily deadlock when that homedir is on a > > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > > + * kerberized NFS mount. Some users may not have $HOME on NFS. > > + * By default setting $HOME unconditionally to "/", we > > * prevent this behavior in routines that use $HOME in preference to > > * the results of getpw*. > > + * Users who have $HOME on krb5-NFS should set > > `--home-not-kerberized` in argv > > + * Users who have $HOME on krb5-NFS but want to use their > > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE > > */ > > + if (argv == '--home-not-kerberized') || > > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') { > > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME'); > > + } > > + else { > > + log.debug('Assuming $HOME requires Kerberos, use > > `--home-not-kerberized` to change this behavior'); > > if (setenv("HOME", "/", 1)) { > > printerr(1, "Unable to set $HOME: %s\n", strerror(errn)); > > exit(1); > > } > > + } > > /* psudo code snippet ends here */ > In general I'm pretty reluctant to add flags but what is needed > to do so is a company single letter flag '-H' and a man page > entry describing the flag. Ok. > > > > While acknowledging the use of this flag for Kerberized NFS home dirs > > is undesirable and would cause a deadlock, there should be no issue > > for users not using Kerberized NFS home dirs. > What apps are you using that is seeing this problem? It is just when accessing the Kerberized NFS share. Other Kerberos aware services/applications check for the existence of ~/.k5identify before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd no longer does this and the intent of the patch would be to add granularity to choose the behavior or rpc.gssd with respect to scanning for a k5identity file. If any additional information is required, please inform me. Thanks, Jacob Shivers ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted 2021-01-04 16:00 ` Jacob Shivers @ 2021-03-01 16:50 ` Jacob Shivers 2021-03-01 18:54 ` David Wysochanski 0 siblings, 1 reply; 6+ messages in thread From: Jacob Shivers @ 2021-03-01 16:50 UTC (permalink / raw) To: Steve Dickson; +Cc: linux-nfs [-- Attachment #1: Type: text/plain, Size: 3656 bytes --] Patches that include a '-H' flag and man page entry. The default is to maintain behavior since 2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids $HOME being set to '/'. Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting it to false is equivalent to passing '-H' to rpc.gssd. Regards, Jacob Shivers On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote: > > Hello, > > I completely missed this so please excuse the delay. > > > On 11/23/20 1:17 PM, Jacob Shivers wrote: > > > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing > > > behavior to avoid a deadlock for users using Kerberized NFS home dirs. > > > > > > However, this also prevents users leveraging their own k5identity > > > files under their home directory and instead rpc.gssd uses a > > > system-wide /.k5identity file. For users expecting to use their own > > > k5identity file this is certainly unexpected. > > So how is the deadlock not happening when ~/.k5identity is on a NFS > > home directory? What am I missing? > They are not using NFS for home directories. They are accessing > systems with a local fs backing the /home > > > > Below is some pseudo code that was proposed and would just add a flag > > > allowing for the behavior prior to > > > 2f682f25c642fcfe7c511d04bc9d67e732282348: > > > > > > /* psudo code snippet starts here */ > > > /* > > > * Some krb5 routines try to scrape info out of files in the user's > > > * home directory. This can easily deadlock when that homedir is on a > > > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > > > + * kerberized NFS mount. Some users may not have $HOME on NFS. > > > + * By default setting $HOME unconditionally to "/", we > > > * prevent this behavior in routines that use $HOME in preference to > > > * the results of getpw*. > > > + * Users who have $HOME on krb5-NFS should set > > > `--home-not-kerberized` in argv > > > + * Users who have $HOME on krb5-NFS but want to use their > > > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE > > > */ > > > + if (argv == '--home-not-kerberized') || > > > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') { > > > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME'); > > > + } > > > + else { > > > + log.debug('Assuming $HOME requires Kerberos, use > > > `--home-not-kerberized` to change this behavior'); > > > if (setenv("HOME", "/", 1)) { > > > printerr(1, "Unable to set $HOME: %s\n", strerror(errn)); > > > exit(1); > > > } > > > + } > > > /* psudo code snippet ends here */ > > In general I'm pretty reluctant to add flags but what is needed > > to do so is a company single letter flag '-H' and a man page > > entry describing the flag. > Ok. > > > > > > > While acknowledging the use of this flag for Kerberized NFS home dirs > > > is undesirable and would cause a deadlock, there should be no issue > > > for users not using Kerberized NFS home dirs. > > What apps are you using that is seeing this problem? > It is just when accessing the Kerberized NFS share. Other Kerberos > aware services/applications check for the existence of ~/.k5identify > before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd > no longer does this and the intent of the patch would be to add > granularity to choose the behavior or rpc.gssd with respect to > scanning for a k5identity file. > > If any additional information is required, please inform me. > > Thanks, > > Jacob Shivers [-- Attachment #2: 0001-nfsconf_set-home.patch --] [-- Type: text/x-patch, Size: 224 bytes --] diff --git a/nfs.conf b/nfs.conf index 9fcf1bf..4c41666 100644 --- a/nfs.conf +++ b/nfs.conf @@ -24,6 +24,7 @@ # keytab-file=/etc/krb5.keytab # cred-cache-directory= # preferred-realm= +# set-home=1 # [lockd] # port=0 [-- Attachment #3: 0001-gssd-set_home.patch --] [-- Type: text/x-patch, Size: 2606 bytes --] diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c index 85bc4b07..1541d371 100644 --- a/utils/gssd/gssd.c +++ b/utils/gssd/gssd.c @@ -87,6 +87,8 @@ unsigned int context_timeout = 0; unsigned int rpc_timeout = 5; char *preferred_realm = NULL; char *ccachedir = NULL; +/* set $HOME to "/" by default */ +static bool set_home = true; /* Avoid DNS reverse lookups on server names */ static bool avoid_dns = true; static bool use_gssproxy = false; @@ -900,7 +902,7 @@ sig_die(int signal) static void usage(char *progname) { - fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n", + fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D] [-H]\n", progname); exit(1); } @@ -941,6 +943,7 @@ read_gss_conf(void) preferred_realm = s; use_gssproxy = conf_get_bool("gssd", "use-gss-proxy", use_gssproxy); + set_home = conf_get_bool("gssd", "set-home", set_home); } int @@ -961,7 +964,7 @@ main(int argc, char *argv[]) verbosity = conf_get_num("gssd", "verbosity", verbosity); rpc_verbosity = conf_get_num("gssd", "rpc-verbosity", rpc_verbosity); - while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) { + while ((opt = getopt(argc, argv, "HDfvrlmnMp:k:d:t:T:R:")) != -1) { switch (opt) { case 'f': fg = 1; @@ -1009,6 +1012,9 @@ main(int argc, char *argv[]) case 'D': avoid_dns = false; break; + case 'H': + set_home = false; + break; default: usage(argv[0]); break; @@ -1018,13 +1024,19 @@ main(int argc, char *argv[]) /* * Some krb5 routines try to scrape info out of files in the user's * home directory. This can easily deadlock when that homedir is on a - * kerberized NFS mount. By setting $HOME unconditionally to "/", we - * prevent this behavior in routines that use $HOME in preference to - * the results of getpw*. + * kerberized NFS mount. By setting $HOME to "/" by default, we prevent + * this behavior in routines that use $HOME in preference to the results + * of getpw*. + * + * Some users do not use Kerberized home dirs and need $HOME to remain + * unchanged. Those users can leave $HOME unchanged by setting set_home + * to false. */ - if (setenv("HOME", "/", 1)) { - printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); - exit(1); + if (set_home) { + if (setenv("HOME", "/", 1)) { + printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); + exit(1); + } } if (use_gssproxy) { [-- Attachment #4: 0001-manpage-nfs.conf_update_for_set-home.patch --] [-- Type: text/x-patch, Size: 333 bytes --] diff --git a/systemd/nfs.conf.man b/systemd/nfs.conf.man index 16e0ec4..ee54041 100644 --- a/systemd/nfs.conf.man +++ b/systemd/nfs.conf.man @@ -243,7 +243,8 @@ Recognized values: .BR rpc-timeout , .BR keytab-file , .BR cred-cache-directory , -.BR preferred-realm . +.BR preferred-realm , +.BR set-home . See .BR rpc.gssd (8) [-- Attachment #5: 0001-manpage-rpc.gssd_update_for_set-home.patch --] [-- Type: text/x-patch, Size: 1252 bytes --] diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man index 26095a8..b6444ab 100644 --- a/utils/gssd/gssd.man +++ b/utils/gssd/gssd.man @@ -8,7 +8,7 @@ rpc.gssd \- RPCSEC_GSS daemon .SH SYNOPSIS .B rpc.gssd -.RB [ \-DfMnlvr ] +.RB [ \-DfMnlvrH ] .RB [ \-k .IR keytab ] .RB [ \-p @@ -282,6 +282,16 @@ The default timeout is set to 5 seconds. If you get messages like "WARNING: can't create tcp rpc_clnt to server %servername% for user with uid %uid%: RPC: Remote system error - Connection timed out", you should consider an increase of this timeout. +.TP +.B -H +Avoids setting $HOME to "/". This allows rpc.gssd to read per user k5identity +files versus trying to read /.k5identity for each user. + +If +.B \-H +is not set, rpc.gssd will use the first match found in +/var/kerberos/krb5/user/$EUID/client.keytab and will not use a principal based on +host and/or service parameters listed in $HOME/.k5identity. .SH CONFIGURATION FILE Many of the options that can be set on the command line can also be controlled through values set in the @@ -347,6 +357,13 @@ section: .B pipefs-directory Equivalent to .BR -p . +.TP +.B set-home +Setting to +.B false +is equivalent to providing the +.B -H +flag. .SH SEE ALSO .BR rpc.svcgssd (8), ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted 2021-03-01 16:50 ` Jacob Shivers @ 2021-03-01 18:54 ` David Wysochanski 2021-03-02 21:14 ` Steve Dickson 0 siblings, 1 reply; 6+ messages in thread From: David Wysochanski @ 2021-03-01 18:54 UTC (permalink / raw) To: Jacob Shivers; +Cc: Steve Dickson, linux-nfs I was talking to Jake and I think he will submit this again without attachments so it's a little easier to review. On Mon, Mar 1, 2021 at 12:07 PM Jacob Shivers <jshivers@redhat.com> wrote: > > Patches that include a '-H' flag and man page entry. > > The default is to maintain behavior since > 2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids > $HOME being set to '/'. > Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting > it to false is equivalent to passing '-H' to rpc.gssd. > > Regards, > > Jacob Shivers > > On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote: > > > > Hello, > > > > I completely missed this so please excuse the delay. > > > > > On 11/23/20 1:17 PM, Jacob Shivers wrote: > > > > Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing > > > > behavior to avoid a deadlock for users using Kerberized NFS home dirs. > > > > > > > > However, this also prevents users leveraging their own k5identity > > > > files under their home directory and instead rpc.gssd uses a > > > > system-wide /.k5identity file. For users expecting to use their own > > > > k5identity file this is certainly unexpected. > > > So how is the deadlock not happening when ~/.k5identity is on a NFS > > > home directory? What am I missing? > > They are not using NFS for home directories. They are accessing > > systems with a local fs backing the /home > > > > > > Below is some pseudo code that was proposed and would just add a flag > > > > allowing for the behavior prior to > > > > 2f682f25c642fcfe7c511d04bc9d67e732282348: > > > > > > > > /* psudo code snippet starts here */ > > > > /* > > > > * Some krb5 routines try to scrape info out of files in the user's > > > > * home directory. This can easily deadlock when that homedir is on a > > > > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > > > > + * kerberized NFS mount. Some users may not have $HOME on NFS. > > > > + * By default setting $HOME unconditionally to "/", we > > > > * prevent this behavior in routines that use $HOME in preference to > > > > * the results of getpw*. > > > > + * Users who have $HOME on krb5-NFS should set > > > > `--home-not-kerberized` in argv > > > > + * Users who have $HOME on krb5-NFS but want to use their > > > > $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE > > > > */ > > > > + if (argv == '--home-not-kerberized') || > > > > (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') { > > > > + log.debug('Not masking $HOME, this breaks on Kerberized $HOME'); > > > > + } > > > > + else { > > > > + log.debug('Assuming $HOME requires Kerberos, use > > > > `--home-not-kerberized` to change this behavior'); > > > > if (setenv("HOME", "/", 1)) { > > > > printerr(1, "Unable to set $HOME: %s\n", strerror(errn)); > > > > exit(1); > > > > } > > > > + } > > > > /* psudo code snippet ends here */ > > > In general I'm pretty reluctant to add flags but what is needed > > > to do so is a company single letter flag '-H' and a man page > > > entry describing the flag. > > Ok. > > > > > > > > > > While acknowledging the use of this flag for Kerberized NFS home dirs > > > > is undesirable and would cause a deadlock, there should be no issue > > > > for users not using Kerberized NFS home dirs. > > > What apps are you using that is seeing this problem? > > It is just when accessing the Kerberized NFS share. Other Kerberos > > aware services/applications check for the existence of ~/.k5identify > > before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd > > no longer does this and the intent of the patch would be to add > > granularity to choose the behavior or rpc.gssd with respect to > > scanning for a k5identity file. > > > > If any additional information is required, please inform me. > > > > Thanks, > > > > Jacob Shivers ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted 2021-03-01 18:54 ` David Wysochanski @ 2021-03-02 21:14 ` Steve Dickson 0 siblings, 0 replies; 6+ messages in thread From: Steve Dickson @ 2021-03-02 21:14 UTC (permalink / raw) To: David Wysochanski, Jacob Shivers; +Cc: linux-nfs On 3/1/21 1:54 PM, David Wysochanski wrote: > I was talking to Jake and I think he will submit this again without > attachments so it's a little easier to review. Thank you! steved. > > On Mon, Mar 1, 2021 at 12:07 PM Jacob Shivers <jshivers@redhat.com> wrote: >> >> Patches that include a '-H' flag and man page entry. >> >> The default is to maintain behavior since >> 2f682f25c642fcfe7c511d04bc9d67e732282348, but passing '-H' avoids >> $HOME being set to '/'. >> Also included a patch for /etc/nfs.conf to add 'set-home=1'. Setting >> it to false is equivalent to passing '-H' to rpc.gssd. >> >> Regards, >> >> Jacob Shivers >> >> On Mon, Jan 4, 2021 at 11:00 AM Jacob Shivers <jshivers@redhat.com> wrote: >>> >>> Hello, >>> >>> I completely missed this so please excuse the delay. >>> >>>> On 11/23/20 1:17 PM, Jacob Shivers wrote: >>>>> Commit 2f682f25c642fcfe7c511d04bc9d67e732282348 changed existing >>>>> behavior to avoid a deadlock for users using Kerberized NFS home dirs. >>>>> >>>>> However, this also prevents users leveraging their own k5identity >>>>> files under their home directory and instead rpc.gssd uses a >>>>> system-wide /.k5identity file. For users expecting to use their own >>>>> k5identity file this is certainly unexpected. >>>> So how is the deadlock not happening when ~/.k5identity is on a NFS >>>> home directory? What am I missing? >>> They are not using NFS for home directories. They are accessing >>> systems with a local fs backing the /home >>> >>>>> Below is some pseudo code that was proposed and would just add a flag >>>>> allowing for the behavior prior to >>>>> 2f682f25c642fcfe7c511d04bc9d67e732282348: >>>>> >>>>> /* psudo code snippet starts here */ >>>>> /* >>>>> * Some krb5 routines try to scrape info out of files in the user's >>>>> * home directory. This can easily deadlock when that homedir is on a >>>>> - * kerberized NFS mount. By setting $HOME unconditionally to "/", we >>>>> + * kerberized NFS mount. Some users may not have $HOME on NFS. >>>>> + * By default setting $HOME unconditionally to "/", we >>>>> * prevent this behavior in routines that use $HOME in preference to >>>>> * the results of getpw*. >>>>> + * Users who have $HOME on krb5-NFS should set >>>>> `--home-not-kerberized` in argv >>>>> + * Users who have $HOME on krb5-NFS but want to use their >>>>> $HOME anyway should set NFS_HOME_ACCESSIBLE=TRUE >>>>> */ >>>>> + if (argv == '--home-not-kerberized') || >>>>> (getenv("NFS_HOME_ACCESSIBLE") == 'TRUE') { >>>>> + log.debug('Not masking $HOME, this breaks on Kerberized $HOME'); >>>>> + } >>>>> + else { >>>>> + log.debug('Assuming $HOME requires Kerberos, use >>>>> `--home-not-kerberized` to change this behavior'); >>>>> if (setenv("HOME", "/", 1)) { >>>>> printerr(1, "Unable to set $HOME: %s\n", strerror(errn)); >>>>> exit(1); >>>>> } >>>>> + } >>>>> /* psudo code snippet ends here */ >>>> In general I'm pretty reluctant to add flags but what is needed >>>> to do so is a company single letter flag '-H' and a man page >>>> entry describing the flag. >>> Ok. >>> >>>>> >>>>> While acknowledging the use of this flag for Kerberized NFS home dirs >>>>> is undesirable and would cause a deadlock, there should be no issue >>>>> for users not using Kerberized NFS home dirs. >>>> What apps are you using that is seeing this problem? >>> It is just when accessing the Kerberized NFS share. Other Kerberos >>> aware services/applications check for the existence of ~/.k5identify >>> before reading /var/kerberos/krb5/user/${EUID}/client.keytab. rpc.gssd >>> no longer does this and the intent of the patch would be to add >>> granularity to choose the behavior or rpc.gssd with respect to >>> scanning for a k5identity file. >>> >>> If any additional information is required, please inform me. >>> >>> Thanks, >>> >>> Jacob Shivers > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-03-03 11:03 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-11-23 18:17 gssd: set $HOME to prevent recursion when home dirs are on kerberized NFS mount revisted Jacob Shivers 2020-12-07 18:06 ` Steve Dickson 2021-01-04 16:00 ` Jacob Shivers 2021-03-01 16:50 ` Jacob Shivers 2021-03-01 18:54 ` David Wysochanski 2021-03-02 21:14 ` Steve Dickson
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).