Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: if359451d:Fastmail
From:   "Dorian Taylor (Lists)" <lists@doriantaylor.com>
Content-Type: multipart/signed;
        boundary="Apple-Mail=_0D1EC4DB-36DF-4F31-B0F9-1ECB1B6F5C85";
        protocol="application/pgp-signature";
        micalg=pgp-sha512
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
Subject: non-root user mounting NFSv4 with sec=krb5{,i,p}
Message-Id: <A82A8BFA-7B04-4F8E-93D8-9B0111DC0D1A@doriantaylor.com>
Date:   Mon, 17 Oct 2022 16:50:06 -0400
To:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Precedence: bulk


--Apple-Mail=_0D1EC4DB-36DF-4F31-B0F9-1ECB1B6F5C85
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Greetings List,

I have been successfully using a non-root user on a Linux client to =
mount (with an appropriate fstab entry) NFSv4 using Kerberos for about a =
year now, but it only works if I do the following:

* run `rpc.gssd -n` as root
* run `kinit mynonrootuser@REALM` as root (from a login shell, not =
su/sudo)
* also run `kinit` as mynonrootuser (expected).

This "works", for some definition of the term, but I consider it to be =
limping along. Since NFS needs two tickets to authenticate, the main =
failure mode is root's ticket (for the non-root principal) predictably =
doesn't get renewed when the Kerberos infrastructure renews the ordinary =
ticket, seizing up any affected mounts. It=E2=80=99s a =
marginally-tolerable configuration for a personal laptop but altogether =
inappropriate for much else.

I tracked the problem last year down to a mismatched uid in the pipefs =
protocol (see thread =
<https://marc.info/?l=3Dlinux-nfs&m=3D164029845630159&w=3D2>). It seems =
like a simple enough bug to fix but as I mentioned in the previous =
thread, if I knew where it was happening I'd have sent a patch by now. I =
am curious if there has been any attempt to fix this in the last year.

Regards,

--
Dorian Taylor
Make things. Make sense.
https://doriantaylor.com


--Apple-Mail=_0D1EC4DB-36DF-4F31-B0F9-1ECB1B6F5C85
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEQCibkUxMA9OSsNh/irFKO32Nr6MFAmNNv/4ACgkQirFKO32N
r6NT1hAAmQcip8sLC8yDYFdvb9b6dgol2rRLNZv0D6ufPTaEFihQhZZXM6ExLlSW
5OO5hlyB4OPksMJWt1VW5oK3lV1IEUudPeo4imCNv8gJPOoQVgk5K8HTeIxurg+i
dH+8i5l24XPbzpwoUQQr538AqBzr2a0R6OneX6OdT8+L814nCLnOVZzIYq64MCuv
JDd6vdE5gVMecILSCO8K6soLNuLUvRBf1YmF6VFdjNnVeEWhLApKLx4+Mj6sl997
/cnnN8jFGMi5J+cHseMo2JueJVq1+lDAvXicSGnF3a11iQvDQ0x7yIJmtYVot4WG
02Av3UwremcLyn81O0JlNF/PTwue1zJG0lfLHUr+61Vlto1roCW5ITQTqyTDDmF1
fc6gb43JTElZHzCsgQcJdPH/CXSp9/N/HMOhKgBdF4IUVrPTbPXVMQ1t94LHAi3/
ytvh4YLtLET5kJ0ee+o52aTmccEOfkNYCdVM3tL0JT0EeIap8PRafJ4euhuDOiJ7
lVbq11lzvCvc92hGATk5euEXbHlv87BHKwQsqKa0L6RdMMlXrzfjKDMNodOwasq2
IZGO4+Gwhor2hjNX4KNhGdEE9eMuFczU1nZkrjfsi0Pw9p68jkB+b5Z52E0pwTDJ
70qh17Mn1MJA/mi5AdPXX5wZvBMN1awUjBR9UZgXhkrf/YHmYz4=
=7s88
-----END PGP SIGNATURE-----

--Apple-Mail=_0D1EC4DB-36DF-4F31-B0F9-1ECB1B6F5C85--