Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: kerberized NFSv4 client reporting operation not permitted when
 mounting with sec=sys
To:     Felix Rubio <felix@kngnt.org>, linux-nfs@vger.kernel.org
References: <0593b4af8ca3fafbec59655bbb39d2b4@kngnt.org>
 <724CB91C-76AC-425B-BAE3-04887ED5DE73@redhat.com>
 <6d998611c9205d6a0a8bf3806c297011@kngnt.org>
 <87BD58D0-7A14-42BB-BA8F-54E6C78B2755@redhat.com>
 <b0bcd3e608d6fbc05c0751380f6a0e7b@kngnt.org>
 <7B337925-F225-4DD7-A8CF-ECBBE1AC7082@redhat.com>
 <9e25861022acb796c35d3adb392bf4c4@kngnt.org>
From:   Dai Ngo <dai.ngo@oracle.com>
Message-ID: <c058f370-9f7c-146d-e7e6-a3f88b62cbc4@oracle.com>
Date:   Thu, 2 Jul 2020 09:52:30 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
 Gecko/20100101 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <9e25861022acb796c35d3adb392bf4c4@kngnt.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

Hi Felix,

My guess is since '/export' is exported with 'krb5:krb5i:krb5p' and the
exports with 'sys' are underneath it, this might cause the problem when
the mount path of the 'sys' export is traversed on the server. You can
try to move 'smop' and 'sratch' to another subdir.

-Dai

On 7/2/20 6:41 AM, Felix Rubio wrote:
> Hi everybody
>
>     I am resuscitating a call for help that I issued on February. 
> Maybe somebody can give me a hand? On a NFSv4 server, with kerberos 
> authentication enabled and working, I have generated a separated 
> export that I want to export with only sys authentication. I am stuck 
> exactly at the same point where I was :-/.
>
> This is what I have done, so far:
>
> [root@nfs-server etc]# exportfs -v
> /export 
> 10.0.0.0/8(sync,wdelay,hide,crossmnt,no_subtree_check,fsid=0,sec=krb5:krb5i:krb5p,rw,secure,root_squash,no_all_squash)
> /export/home 
> 10.0.0.0/8(sync,wdelay,hide,no_subtree_check,sec=krb5:krb5i:krb5p,rw,secure,root_squash,no_all_squash)
> /export/smop 
> 10.0.0.0/8(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,root_squash,no_all_squash)
> /export/scratch 
> 10.0.0.0/8(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,root_squash,no_all_squash)
>
> and I still get the same error on the client (here with nfs mount 
> debugging enabled):
> Jul 02 15:13:44 lfd8-Lx kernel: NFS: nfs mount 
> opts='hard,sec=sys,vers=4.1,addr=10.0.2.9,clientaddr=10.1.0.33'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS:   parsing nfs mount option 'hard'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS:   parsing nfs mount option 'sec=sys'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS: parsing sec=sys option
> Jul 02 15:13:44 lfd8-Lx kernel: NFS:   parsing nfs mount option 
> 'vers=4.1'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS:   parsing nfs mount option 
> 'addr=10.0.2.9'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS:   parsing nfs mount option 
> 'clientaddr=10.1.0.33'
> Jul 02 15:13:44 lfd8-Lx kernel: NFS: MNTPATH: '/smop'
> Jul 02 15:13:44 lfd8-Lx kernel: --> nfs4_try_mount()
> Jul 02 15:13:44 lfd8-Lx mount[30152]: mount.nfs4: Operation not permitted
> Jul 02 15:13:44 lfd8-Lx kernel: <-- nfs4_try_mount() = -1 [error]
>
> getting a trace on the server with 'tshark -i eth0 -p -w 
> /tmp/nfs_mount.cap host 10.1.0.33 and port nfs' while running the 
> mount, I get:
> Running as user "root" and group "root". This could be dangerous.
>   1 0.000000000    10.1.0.33 -> 10.0.2.9     NFS 246 V4 Call GETATTR 
> FH: 0x4bfbf778
>   2 0.000097402     10.0.2.9 -> 10.1.0.33    NFS 246 V4 Reply (Call In 
> 1) GETATTR
>   3 0.000790512    10.1.0.33 -> 10.0.2.9     TCP 54 956 > nfs [ACK] 
> Seq=193 Ack=193 Win=4565 Len=0
>   4 0.416074043    10.1.0.33 -> 10.0.2.9     NFS 206 V4 Call PUTROOTFH 
> | GETATTR
>   5 0.416209445     10.0.2.9 -> 10.1.0.33    NFS 146 V4 Reply (Call In 
> 4) PUTROOTFH Status: NFS4ERR_WRONGSEC
>   6 0.416853354    10.1.0.33 -> 10.0.2.9     TCP 54 956 > nfs [ACK] 
> Seq=345 Ack=285 Win=4565 Len=0
>
> And when displaying the frame #4, I get that it is requesting the 
> 'sys' authentication
>     Credentials
>         Flavor: AUTH_UNIX (1)
>         Length: 36
>         Stamp: 0x00419352
>         Machine Name: lfd8-Lx
>             length: 13
>             contents: lfd8-Lx
>             fill bytes: opaque data
> but then, in frame #5, it returns NFS4ERR_WRONGSEC.
>
> This is running a CentOS 7.6 (kernel 3.10.0-1127.13.1.el7.x86_64), 
> just updated and rebooted. SElinux is not enforced.
>
> ---
> Felix Rubio
> "Don't believe what you're told. Double check."