Return-Path: Received: from eastrmpop111.cox.net ([68.230.240.53]:37640 "EHLO eastrmpop111.cox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758089Ab0HQSFY (ORCPT ); Tue, 17 Aug 2010 14:05:24 -0400 Message-ID: <4C6ACAE1.6060100@excfb.com> Date: Tue, 17 Aug 2010 12:46:09 -0500 From: Tom Haynes To: Chuck Lever CC: "J. Bruce Fields" , Steve Dickson , Neil Brown , Trond Myklebust , Jim Rees , Daniel.Muntz@emc.com, linux-nfs@vger.kernel.org Subject: Re: numeric UIDs References: <20100803215704.GA15494@merit.edu> <1280873719.14520.17.camel@heimdal.trondhjem.org> <20100803222337.GA9752@fieldses.org> <1280874675.14520.23.camel@heimdal.trondhjem.org> <20100803224245.GB9752@fieldses.org> <1280887336.24669.23.camel@heimdal.trondhjem.org> <20100805153421.GD27141@fieldses.org> <20100812092232.344314b2@notabene> <4C6559FA.5070809@RedHat.com> <20100813163156.GA16863@fieldses.org> <1CE074A1-2371-40E5-B0E5-F80474B02FA2@oracle.com> In-Reply-To: <1CE074A1-2371-40E5-B0E5-F80474B02FA2@oracle.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Sender: linux-nfs-owner@vger.kernel.org List-ID: MIME-Version: 1.0 Chuck Lever wrote: > On Aug 13, 2010, at 12:31 PM, J. Bruce Fields wrote: > > >> On Fri, Aug 13, 2010 at 10:43:06AM -0400, Steve Dickson wrote: >> >>> On 08/11/2010 07:22 PM, Neil Brown wrote: >>> >>>> I agree. And surely it can all be solved in idmapd. >>>> >>>> On the server, tell idmapd to map all users to "NUMERIC_USER:%d" and all >>>> groups to "NUMERIC_GROUP:%d" (or whatever) for some given clients (i.e. stop >>>> ignoring the 'authentication name'. And of course map those names back to >>>> numbers. >>>> >>>> I don't know if the client can easily differentiate based on which server it >>>> is talking to, but there is probably less need there (and maybe it can >>>> anyway). >>>> >>>> It shouldn't take more that half an hour to hack something into >>>> idmapd.c:nfsdcb() for the server side and nfscb for the client side - or >>>> for a quicker hack, just go directly to imconv and ignore the client name on >>>> the server. (all this in nfs-utils of course). >>>> >>> I took a look... and you are right it would not be that difficult to >>> hack something up... but would this only be a Linux to Linux thing? >>> Or am I missing something? >>> >> There are four cases where translation can be done: >> >> Sending id from server to client (ls, stat, getacl): >> 1. server uid -> string >> 2. string -> client uid >> Sending id from client to server (chown, setacl): >> 3. client uid -> string >> 4. string -> client uid >> >> Cases 1 and 2 are uncontroversial. Definitely map ascii-fied integers >> in both of those cases. >> >> Case 4 violates the SHOULD on page 47. Which would make case 3 useless >> if all servers respect that SHOULD. I think we should ignore the SHOULD >> and implement 3 and 4 too, but Trond may not agree. >> > > So how would that happen? If we send "2525" and we can locally map uid 2525 to 'bfields", does that mean the client is attempting to subvert the normal process? Or do we have to send uid 2525 to our id mapper to see if a reverse mapping applies? What if there exists a thud@remote with that uid, but the mapping was really bfields@crimson? We could claim it was a violation, which is why we would want the client to provide the string and not the uid. > Is this something that should be taken up in 3530bis? > > The issue should at least be presented on the working group alias. >> I suppose we could make this all configurable, and then argue about what >> the defaults should be. If we implement all this in idmapd then that's >> easy. >> >> I don't know what other clients and servers do. Probably 1 and 2 at >> least, but maybe it's something to check at the next bakeathon. >> >> Do we actually use an @-less "nobody" as suggested in the last >> paragraph? If not that might be something else to fix. >> >> --b. >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> > > -- > Chuck Lever > chuck[dot]lever[at]oracle[dot]com > > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >