2018-06-14 13:32:39

by J. Bruce Fields

Subject: [PATCH] exports: document change to "insecure" export option

From: "J. Bruce Fields" <[email protected]>

We're changing the kernel to allow gss requests from high ports even
when "secure" is set.

If the change gets backported to distro kernels, the kernel version may
be an imperfect predictor of the behavior, but I think it's the best we
can do.

Signed-off-by: J. Bruce Fields <[email protected]>
---
utils/exportfs/exports.man | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/utils/exportfs/exports.man b/utils/exportfs/exports.man
index 4f95f3a2197e..e3a16f6b276a 100644
--- a/utils/exportfs/exports.man
+++ b/utils/exportfs/exports.man
@@ -131,10 +131,12 @@ this way are ro, rw, no_root_squash, root_squash, and all_squash.
understands the following export options:
.TP
.IR secure
-This option requires that requests originate on an Internet port less
-than IPPORT_RESERVED (1024). This option is on by default. To turn it
-off, specify
+This option requires that requests not using gss originate on an
+Internet port less than IPPORT_RESERVED (1024). This option is on by default.
+To turn it off, specify
.IR insecure .
+(NOTE: older kernels (before upstream kernel version 4.17) enforced this
+requirement on gss requests as well.)
.TP
.IR rw
Allow both read and write requests on this NFS volume. The
--
2.17.1

2018-06-19 16:56:40

by Steve Dickson

Subject: Re: [PATCH] exports: document change to "insecure" export option

On 06/14/2018 09:32 AM, J. Bruce Fields wrote:
> From: "J. Bruce Fields" <[email protected]>
>
> We're changing the kernel to allow gss requests from high ports even
> when "secure" is set.
>
> If the change gets backported to distro kernels, the kernel version may
> be an imperfect predictor of the behavior, but I think it's the best we
> can do.
>
> Signed-off-by: J. Bruce Fields <[email protected]>
Committed....

steved.
> ---
> utils/exportfs/exports.man | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/utils/exportfs/exports.man b/utils/exportfs/exports.man
> index 4f95f3a2197e..e3a16f6b276a 100644
> --- a/utils/exportfs/exports.man
> +++ b/utils/exportfs/exports.man
> @@ -131,10 +131,12 @@ this way are ro, rw, no_root_squash, root_squash, and all_squash.
> understands the following export options:
> .TP
> .IR secure
> -This option requires that requests originate on an Internet port less
> -than IPPORT_RESERVED (1024). This option is on by default. To turn it
> -off, specify
> +This option requires that requests not using gss originate on an
> +Internet port less than IPPORT_RESERVED (1024). This option is on by default.
> +To turn it off, specify
> .IR insecure .
> +(NOTE: older kernels (before upstream kernel version 4.17) enforced this
> +requirement on gss requests as well.)
> .TP
> .IR rw
> Allow both read and write requests on this NFS volume. The
>