On Feb 14, 2013, at 9:24 AM, Veli-Matti Lintu <veli-matti.lintu@xxxxxxxxxx> wrote: > >> I've been using kerberized nfs4 mounts without machine credentials for >> quite some time by running rpc.gssd with the -n option. This has >> resulted rpc.gssd in using ccache in /tmp/krb5cc_0 when doing the mount >> instead of machine credentials. This functionality seems to break when >> using kernel 3.7 or newer. 3.6.11 and earlier work like expected. >> >> The use case for this is diskless workstations that do not have machine >> credentials stored on them as they have no secure storage medium. When a >> user logs in, the home directory is mounted using the user's credentials >> only. >> >> Steps to reproduce the problem: >> >> # kinit user (this creates /tmp/krb5cc_0) >> # rpc.gssd -f -n -vvvv >> # mount -t nfs4 -o sec=krb5 server.example.org:/home /mnt >> >> The mount works when using kernel 3.6.11 or earlier and fails on 3.7-rc1 >> or later. Testing was done on Ubuntu 12.04 and 12.10 using Ubuntu kernels >> and kernel.org kernels (up to 3.8-rc7) with similar results. >> >> nfs-utils versions 1.2.5 and the latest version from git master head >> (git://linux-nfs.org/nfs-utils) behave the same way. > > ... > >> It seems like the kernel now asks rpc.gssd to fetch credentials for >> service '*' instead of NULL like with 3.6 and earlier. > > I got some bisecting help from Tuomas Räsänen who managed to find the > commit that introduces the change. Here's what he found. I haven't > yet figured out what in the commit causes the change in behaviour. > Before that patch the kernel asks rpc.gssd for service <null>, but > with the patch applied, it requests for service '*' when doing the > initial mount with sec=krb5. While I am trying to reproduce this, have a look at commit a56989b6 in nfs-utils 1.2.8-rc1. -- Chuck Lever chuck[dot]lever[at]oracle[dot]com -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
