Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "Steve Dickson" <steved@redhat.com>
Cc:     "Petr Vorel" <pvorel@suse.cz>,
        "linux-nfs" <linux-nfs@vger.kernel.org>,
        "Dave Jones" <davej@codemonkey.org.uk>, bfields@redhat.com
Subject: Re: [PATCH nfs-utils] mountd: don't advertise krb5 for v4root when
 not configured.
In-reply-to: <168169080542.24821.1095959058130927513@noble.neil.brown.name>
References: <168169080542.24821.1095959058130927513@noble.neil.brown.name>
Date:   Wed, 19 Apr 2023 09:54:21 +1000
Message-id: <168186206158.24821.3625716286887021869@noble.neil.brown.name>
Precedence: bulk

On Mon, 17 Apr 2023, NeilBrown wrote:
> If /etc/krb5.keytab does not exist, then krb5 cannot work, so
> advertising it as an option for v4root is pointless.
> Since linux commit 676e4ebd5f2c ("NFSD: SECINFO doesn't handle
> unsupported pseudoflavors correctly") this can result in an unhelpful
> warning if the krb5 code is not built, or built as a module which is not
> installed.
>=20
> [  161.668635] NFS: SECINFO: security flavor 390003 is not supported
> [  161.668655] NFS: SECINFO: security flavor 390004 is not supported
> [  161.668670] NFS: SECINFO: security flavor 390005 is not supported
>=20
> So avoid advertising krb5 security options when krb5.keytab cannot be
> found.
>=20
> Link: https://lore.kernel.org/linux-nfs/20170104190327.v3wbpcbqtfa5jy7d@cod=
emonkey.org.uk/
> Signed-off-by: NeilBrown <neilb@suse.de>
> ---
>  support/export/v4root.c         |  2 ++
>  support/include/pseudoflavors.h |  1 +
>  support/nfs/exports.c           | 14 +++++++-------
>  3 files changed, 10 insertions(+), 7 deletions(-)
>=20
> diff --git a/support/export/v4root.c b/support/export/v4root.c
> index fbb0ad5f5b81..3e049582d7c1 100644
> --- a/support/export/v4root.c
> +++ b/support/export/v4root.c
> @@ -66,6 +66,8 @@ set_pseudofs_security(struct exportent *pseudo)
> =20
>  		if (!flav->fnum)
>  			continue;
> +		if (flav->need_krb5 && !access("/etc/krb5.keytab", F_OK))
> +			continue;

This is "obviously" wrong - thanks to Petr for testing more thoroughly
than I did (hint: you need to "rmmod nfsd" or reboot between tests, as
the messages are only reported once).
access() returns 0 on success, negative on failure.  It doesn't return
bool like the above suggests.

I will repost with a fixed version.

NeilBrown


> =20
>  		i =3D secinfo_addflavor(flav, pseudo);
>  		new =3D &pseudo->e_secinfo[i];
> diff --git a/support/include/pseudoflavors.h b/support/include/pseudoflavor=
s.h
> index deb052b130e6..1f16f3f796f3 100644
> --- a/support/include/pseudoflavors.h
> +++ b/support/include/pseudoflavors.h
> @@ -8,6 +8,7 @@
>  struct flav_info {
>  	char    *flavour;
>  	int     fnum;
> +	int	need_krb5;
>  };
> =20
>  extern struct flav_info flav_map[];
> diff --git a/support/nfs/exports.c b/support/nfs/exports.c
> index 2c8f0752ad9d..010dfe423d6f 100644
> --- a/support/nfs/exports.c
> +++ b/support/nfs/exports.c
> @@ -36,13 +36,13 @@
>    (NFSEXP_READONLY|NFSEXP_ROOTSQUASH|NFSEXP_GATHERED_WRITES|NFSEXP_NOSUBTR=
EECHECK)
> =20
>  struct flav_info flav_map[] =3D {
> -	{ "krb5",	RPC_AUTH_GSS_KRB5	},
> -	{ "krb5i",	RPC_AUTH_GSS_KRB5I	},
> -	{ "krb5p",	RPC_AUTH_GSS_KRB5P	},
> -	{ "unix",	AUTH_UNIX		},
> -	{ "sys",	AUTH_SYS		},
> -	{ "null",	AUTH_NULL		},
> -	{ "none",	AUTH_NONE		},
> +	{ "krb5",	RPC_AUTH_GSS_KRB5,	1},
> +	{ "krb5i",	RPC_AUTH_GSS_KRB5I,	1},
> +	{ "krb5p",	RPC_AUTH_GSS_KRB5P,	1},
> +	{ "unix",	AUTH_UNIX,		0},
> +	{ "sys",	AUTH_SYS,		0},
> +	{ "null",	AUTH_NULL,		0},
> +	{ "none",	AUTH_NONE,		0},
>  };
> =20
>  const int flav_map_size =3D sizeof(flav_map)/sizeof(flav_map[0]);
> --=20
> 2.40.0
>=20
>=20