On 3/1/21 4:46 PM, Jacob Shivers wrote: > Since commit 2f682f25c642fcfe7c511d04bc9d67e732282348 $HOME has been set to '/' > to avoid a deadlock when accessing Kerberized NFS shares. While this works for > most use cases, users who depend on the use of $HOME/.k5identity files are > negatively impacted by this commit. This patch allows for users to use their > $HOME/.k5identity to access subsequent Kerberized resources based on the > credentials in said file. > > The default set by commit 2f682f25c642fcfe7c511d04bc9d67e732282348 still remains > the same, but a user can pass '-H' to change rpc.gssd behavior to not set $HOME > to '/'. Setting 'set-home=0' in /etc/nfs.conf has the same effect as passing > '-H' directly to rpc.gssd. > > Signed-off-by: Jacob Shivers <jshivers@xxxxxxxxxx> Committed... (tag: nfs-utils-2-5-4-rc1) steved. > --- > nfs.conf | 1 + > systemd/nfs.conf.man | 3 ++- > utils/gssd/gssd.c | 28 ++++++++++++++++++++-------- > utils/gssd/gssd.man | 19 ++++++++++++++++++- > 4 files changed, 41 insertions(+), 10 deletions(-) > > diff --git a/nfs.conf b/nfs.conf > index bebb2e3d1e68..eabe8c7c34c4 100644 > --- a/nfs.conf > +++ b/nfs.conf > @@ -24,6 +24,7 @@ > # keytab-file=/etc/krb5.keytab > # cred-cache-directory= > # preferred-realm= > +# set-home=1 > # > [lockd] > # port=0 > diff --git a/systemd/nfs.conf.man b/systemd/nfs.conf.man > index d2187f8aca1a..7fa35d441eca 100644 > --- a/systemd/nfs.conf.man > +++ b/systemd/nfs.conf.man > @@ -253,7 +253,8 @@ Recognized values: > .BR rpc-timeout , > .BR keytab-file , > .BR cred-cache-directory , > -.BR preferred-realm . > +.BR preferred-realm , > +.BR set-home . > > See > .BR rpc.gssd (8) > diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c > index 85bc4b07bebd..1541d3710b24 100644 > --- a/utils/gssd/gssd.c > +++ b/utils/gssd/gssd.c > @@ -87,6 +87,8 @@ unsigned int context_timeout = 0; > unsigned int rpc_timeout = 5; > char *preferred_realm = NULL; > char *ccachedir = NULL; > +/* set $HOME to "/" by default */ > +static bool set_home = true; > /* Avoid DNS reverse lookups on server names */ > static bool avoid_dns = true; > static bool use_gssproxy = false; > @@ -900,7 +902,7 @@ sig_die(int signal) > static void > usage(char *progname) > { > - fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n", > + fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D] [-H]\n", > progname); > exit(1); > } > @@ -941,6 +943,7 @@ read_gss_conf(void) > preferred_realm = s; > > use_gssproxy = conf_get_bool("gssd", "use-gss-proxy", use_gssproxy); > + set_home = conf_get_bool("gssd", "set-home", set_home); > } > > int > @@ -961,7 +964,7 @@ main(int argc, char *argv[]) > verbosity = conf_get_num("gssd", "verbosity", verbosity); > rpc_verbosity = conf_get_num("gssd", "rpc-verbosity", rpc_verbosity); > > - while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) { > + while ((opt = getopt(argc, argv, "HDfvrlmnMp:k:d:t:T:R:")) != -1) { > switch (opt) { > case 'f': > fg = 1; > @@ -1009,6 +1012,9 @@ main(int argc, char *argv[]) > case 'D': > avoid_dns = false; > break; > + case 'H': > + set_home = false; > + break; > default: > usage(argv[0]); > break; > @@ -1018,13 +1024,19 @@ main(int argc, char *argv[]) > /* > * Some krb5 routines try to scrape info out of files in the user's > * home directory. This can easily deadlock when that homedir is on a > - * kerberized NFS mount. By setting $HOME unconditionally to "/", we > - * prevent this behavior in routines that use $HOME in preference to > - * the results of getpw*. > + * kerberized NFS mount. By setting $HOME to "/" by default, we prevent > + * this behavior in routines that use $HOME in preference to the results > + * of getpw*. > + * > + * Some users do not use Kerberized home dirs and need $HOME to remain > + * unchanged. Those users can leave $HOME unchanged by setting set_home > + * to false. > */ > - if (setenv("HOME", "/", 1)) { > - printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); > - exit(1); > + if (set_home) { > + if (setenv("HOME", "/", 1)) { > + printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno)); > + exit(1); > + } > } > > if (use_gssproxy) { > diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man > index 26095a898293..c93cde6a66e5 100644 > --- a/utils/gssd/gssd.man > +++ b/utils/gssd/gssd.man > @@ -8,7 +8,7 @@ > rpc.gssd \- RPCSEC_GSS daemon > .SH SYNOPSIS > .B rpc.gssd > -.RB [ \-DfMnlvr ] > +.RB [ \-DfMnlvrH ] > .RB [ \-k > .IR keytab ] > .RB [ \-p > @@ -282,6 +282,16 @@ The default timeout is set to 5 seconds. > If you get messages like "WARNING: can't create tcp rpc_clnt to server > %servername% for user with uid %uid%: RPC: Remote system error - > Connection timed out", you should consider an increase of this timeout. > +.TP > +.B -H > +Avoids setting $HOME to "/". This allows rpc.gssd to read per user k5identity > +files versus trying to read /.k5identity for each user. > + > +If > +.B \-H > +is not set, rpc.gssd will use the first match found in > +/var/kerberos/krb5/user/$EUID/client.keytab and will not use a principal based on > +host and/or service parameters listed in $HOME/.k5identity. > .SH CONFIGURATION FILE > Many of the options that can be set on the command line can also be > controlled through values set in the > @@ -347,6 +357,13 @@ section: > .B pipefs-directory > Equivalent to > .BR -p . > +.TP > +.B set-home > +Setting to > +.B false > +is equivalent to providing the > +.B -H > +flag. > > .SH SEE ALSO > .BR rpc.svcgssd (8), >