Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Joachim Falk <joachim.falk@gmx.de>
To:     linux-nfs@vger.kernel.org
Cc:     Joachim Falk <joachim.falk@gmx.de>,
        Steve Dickson <steved@redhat.com>,
        Salvatore Bonaccorso <carnil@debian.org>
Subject: [PATCH] systemd: Don't degrade system state for nfs-clients when krb5 keytab present but not containing the nfs/<FQDN> principal.
Date:   Wed,  7 Dec 2022 21:28:41 +0100
Message-Id: <20221207202841.525930-1-joachim.falk@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:8CciwcB+Mrw=;cB36i7zchQscovKiZuDPBHbCdxz
 VOGnkIzDNPUCQKjjRzYx1Fp9hueX27VUBKy7HdIY4EnqmYDuS08uWsUs+FkCdzGLBzFECLfnx
 XFZ5Vu0gTTSiWT3Ek9GR1fyrmzg+HX0d9zaYG+xp1pYDLTccmf7PCNaJ9oxNeoUKyzAy/aXtV
 6/Nm8/kCCeZmXrWAgeySav7hv63Xb8F+aQYRB+Txk9acp5WD58c9bMbDrNCpKBJfTdgbhiS9G
 +BacB475Y61Z2kaAeBfLweaN6WWFuF8YD9sPkr3VIhjciWABum9GZ2FbUXh0AzP+NOjppUTh5
 fBKcV5p23eUUuslj4+QsMdqXhRHLg6iqZaZPg+YdBV4jA61Ryy3m1IfUsP7WUE3SsviSdg5Tk
 qI3q+9D+szVNOGYZacKjltO3uOzEO+u0UM08CPJwttIP9/AHGu1rw2l94r4woG+LOvIq4g4cG
 j9gmMOvaY9VqohU25vk4T2hzYSTWjGAo5duwRoKwgV74tvpnDFwZasc7A1VJytv23JLsyM9un
 6lgabDqGPMpHDu+SVjAsUtrLTK64rpcfcaI0lXPVbi0PwXBwWDhvksvpYS1yNVnSLUTy/4Ypv
 nmzjh++2BjDfnno3i/NDGlVDHl6SaGF28gT4cFoRmcYiePK2lnJuDxs1QKkEojiDxxzo06met
 1YrcYbHc7LI3fEeUM5Z5Uc0WWloHpEvMOr1DQFf+YQe13NzyrvYxLQPdrTy92rxEjCy+FmkwI
 KhuP7XmMeIa/DydNdQ7wsR1XhQ6Cz5Wzipf5FQaMLr0oNKinNvQKRX22VIArjjfpiWFJCh8EC
 aw3Wlc8sh+obrcEeJCg4ur6+wEIxRPRzM2V3nW3NfYygPQiMEWNv9BD1Ar29gCV3/ytRJonCX
 ylAWr7PqkU+psgqY+ogaF053z3i2dt8DOL3NndVLH/D1QdaI6dRJVS7Y+2KpyAC95+u2QzEV+
 epOrgg==
Precedence: bulk

The nfs-client.target requires the auth-rpcgss-module.service, which in
turn requires the rpc-svcgssd.service. However, the rpc.svcgssd daemon
is unnecessary for an NFS client, even when using Kerberos security.
Moreover, starting this daemon with its default configuration will fail
when no nfs/<host>@REALM principal is in the Kerberos keytab. Thus,
resulting in a degraded system state for NFS client configurations
without nfs/<host>@REALM principal in the Kerberos keytab. However, this
is a perfectly valid NFS client configuration as the nfs/<host>@REALM
principal is not required for mounting NFS file systems. This is even
the case when Kerberos security is enabled for the mount!

Installing the gssproxy package hides this problem as this disables the
rpc-svcgssd.service.

Link: http://bugs.debian.org/985002
Link: https://salsa.debian.org/kernel-team/nfs-utils/-/merge_requests/23

Signed-off-by: Joachim Falk <joachim.falk@gmx.de>
=2D--
 systemd/auth-rpcgss-module.service | 2 +-
 systemd/nfs-server.service         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-modu=
le.service
index 25c9de80..4a69a7b7 100644
=2D-- a/systemd/auth-rpcgss-module.service
+++ b/systemd/auth-rpcgss-module.service
@@ -8,7 +8,7 @@
 Description=3DKernel Module supporting RPCSEC_GSS
 DefaultDependencies=3Dno
 Before=3Dgssproxy.service rpc-svcgssd.service rpc-gssd.service
-Wants=3Dgssproxy.service rpc-svcgssd.service rpc-gssd.service
+Wants=3Dgssproxy.service rpc-gssd.service
 ConditionPathExists=3D/etc/krb5.keytab
 ConditionVirtualization=3D!container

diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service
index b432f910..2cdd7868 100644
=2D-- a/systemd/nfs-server.service
+++ b/systemd/nfs-server.service
@@ -15,7 +15,7 @@ After=3Dnfsdcld.service
 Before=3Drpc-statd-notify.service

 # GSS services dependencies and ordering
-Wants=3Dauth-rpcgss-module.service
+Wants=3Dauth-rpcgss-module.service rpc-svcgssd.service
 After=3Drpc-gssd.service gssproxy.service rpc-svcgssd.service

 [Service]
=2D-
2.35.1