Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6859c49e-ae96-378c-2b49-1767daa95c8c@redhat.com>
Date:   Wed, 19 Apr 2023 10:48:41 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [nfs-utils PATCH v2] mountd: don't advertise krb5 for v4root when
 not configured.
Content-Language: en-US
To:     NeilBrown <neilb@suse.de>
Cc:     Petr Vorel <pvorel@suse.cz>, linux-nfs <linux-nfs@vger.kernel.org>,
        Bruce Fields <bfields@fieldses.org>
References: <168186226971.24821.9774040849376889413@noble.neil.brown.name>
From:   Steve Dickson <steved@redhat.com>
In-Reply-To: <168186226971.24821.9774040849376889413@noble.neil.brown.name>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 4/18/23 7:57 PM, NeilBrown wrote:
> 
> If /etc/krb5.keytab does not exist, then krb5 cannot work, so
> advertising it as an option for v4root is pointless.
> Since linux commit 676e4ebd5f2c ("NFSD: SECINFO doesn't handle
> unsupported pseudoflavors correctly") this can result in an unhelpful
> warning if the krb5 code is not built, or built as a module which is not
> installed.
> 
> [  161.668635] NFS: SECINFO: security flavor 390003 is not supported
> [  161.668655] NFS: SECINFO: security flavor 390004 is not supported
> [  161.668670] NFS: SECINFO: security flavor 390005 is not supported
> 
> So avoid advertising krb5 security options when krb5.keytab cannot be
> found.
> 
> Note that testing for /etc/krb5.keytab is what we already do in a couple
> of systemd unit file to determine if krb5 is enabled.
> 
> Link: https://lore.kernel.org/linux-nfs/20170104190327.v3wbpcbqtfa5jy7d@codemonkey.org.uk/
> Signed-off-by: NeilBrown <neilb@suse.de>
Committed... (tag: nfs-utils-2-6-3-rc9)

steved.
> ---
>   support/export/v4root.c         |  2 ++
>   support/include/pseudoflavors.h |  1 +
>   support/nfs/exports.c           | 14 +++++++-------
>   3 files changed, 10 insertions(+), 7 deletions(-)
> 
> diff --git a/support/export/v4root.c b/support/export/v4root.c
> index fbb0ad5f5b81..03805dcb4e6d 100644
> --- a/support/export/v4root.c
> +++ b/support/export/v4root.c
> @@ -66,6 +66,8 @@ set_pseudofs_security(struct exportent *pseudo)
>   
>   		if (!flav->fnum)
>   			continue;
> +		if (flav->need_krb5 && access("/etc/krb5.keytab", F_OK) != 0)
> +			continue;
>   
>   		i = secinfo_addflavor(flav, pseudo);
>   		new = &pseudo->e_secinfo[i];
> diff --git a/support/include/pseudoflavors.h b/support/include/pseudoflavors.h
> index deb052b130e6..1f16f3f796f3 100644
> --- a/support/include/pseudoflavors.h
> +++ b/support/include/pseudoflavors.h
> @@ -8,6 +8,7 @@
>   struct flav_info {
>   	char    *flavour;
>   	int     fnum;
> +	int	need_krb5;
>   };
>   
>   extern struct flav_info flav_map[];
> diff --git a/support/nfs/exports.c b/support/nfs/exports.c
> index 2c8f0752ad9d..010dfe423d6f 100644
> --- a/support/nfs/exports.c
> +++ b/support/nfs/exports.c
> @@ -36,13 +36,13 @@
>     (NFSEXP_READONLY|NFSEXP_ROOTSQUASH|NFSEXP_GATHERED_WRITES|NFSEXP_NOSUBTREECHECK)
>   
>   struct flav_info flav_map[] = {
> -	{ "krb5",	RPC_AUTH_GSS_KRB5	},
> -	{ "krb5i",	RPC_AUTH_GSS_KRB5I	},
> -	{ "krb5p",	RPC_AUTH_GSS_KRB5P	},
> -	{ "unix",	AUTH_UNIX		},
> -	{ "sys",	AUTH_SYS		},
> -	{ "null",	AUTH_NULL		},
> -	{ "none",	AUTH_NONE		},
> +	{ "krb5",	RPC_AUTH_GSS_KRB5,	1},
> +	{ "krb5i",	RPC_AUTH_GSS_KRB5I,	1},
> +	{ "krb5p",	RPC_AUTH_GSS_KRB5P,	1},
> +	{ "unix",	AUTH_UNIX,		0},
> +	{ "sys",	AUTH_SYS,		0},
> +	{ "null",	AUTH_NULL,		0},
> +	{ "none",	AUTH_NONE,		0},
>   };
>   
>   const int flav_map_size = sizeof(flav_map)/sizeof(flav_map[0]);