Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <3a95b0a2-5833-d517-ff62-a5fa94a7c4ce@redhat.com>
Date:   Tue, 6 Dec 2022 08:32:42 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.5.0
Subject: Re: [PATCH] auth-rpcgss-module.service: Don't fail inside linux
 container.
Content-Language: en-US
To:     Joachim Falk <joachim.falk@gmx.de>, linux-nfs@vger.kernel.org
Cc:     NeilBrown <neilb@suse.com>,
        Salvatore Bonaccorso <carnil@debian.org>
References: <20221126095550.174062-1-joachim.falk@gmx.de>
From:   Steve Dickson <steved@redhat.com>
In-Reply-To: <20221126095550.174062-1-joachim.falk@gmx.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 11/26/22 4:55 AM, Joachim Falk wrote:
> Only try to load the auth_rpcgss kernel module if we are not executing
> inside a Linux container. Otherwise, the auth-rpcgss-module service will
> fail inside a Linux container as the loading of kernel modules is
> forbidden for the container. Thus, the "/sbin/modprobe -q auth_rpcgss"
> call will fail even if the auth_rpcgss kernel module is already loaded.
> This situation occurs when the container host has already loaded the
> auth_rpcgss kernel module to enable kerberized NFS service for its
> containers. This behavior has been tested with kmod up to version
> 30+20220630-3 (current in bookworm as of 2022-09-20).
> 
> Bug-Debian: http://bugs.debian.org/985000
> Discussion-Debian: https://salsa.debian.org/kernel-team/nfs-utils/-/merge_requests/7
> 
> Signed-off-by: Joachim Falk <joachim.falk@gmx.de>
Committed... (tag: nfs-utils-2-6-3-rc5)

steved.
> ---
>   systemd/auth-rpcgss-module.service | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service
> index 45482833..25c9de80 100644
> --- a/systemd/auth-rpcgss-module.service
> +++ b/systemd/auth-rpcgss-module.service
> @@ -10,6 +10,7 @@ DefaultDependencies=no
>   Before=gssproxy.service rpc-svcgssd.service rpc-gssd.service
>   Wants=gssproxy.service rpc-svcgssd.service rpc-gssd.service
>   ConditionPathExists=/etc/krb5.keytab
> +ConditionVirtualization=!container
> 
>   [Service]
>   Type=oneshot
> --
> 2.35.1
>