commit 71ce07f2c87c450cbc3ca233c520584b897c4761
Author: Steve Dickson <steved@redhat.com>
Date: Sat Sep 26 10:01:11 2015 -0400
Release 1.3.3
Signed-off-by: Steve Dickson <steved@redhat.com>
commit ad50822bf010c5a7917f160b4d4b39e71f15d086
Author: Andy Adamson <andros@netapp.com>
Date: Wed Sep 23 16:01:43 2015 -0400
GSSD: clean up machine credentials
Since we no longer fork for uid 0, gssd_atexit()
is only called when uid != 0, and fails as permissions
on the /tmp/krb5ccmachine_REALM file prohibit the
clean up of machine credentials (as it should).
Move the reaping of machine credentials back into a
SIGINT sighandler so that <Ctrl-C> destroyes
machine credentials.
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 30c37b2dd6decdd65a33b956a5ae4b548de63a6d
Author: Andy Adamson <andros@netapp.com>
Date: Wed Sep 23 15:52:15 2015 -0400
GSSD only fork when uid is not zero
commit f9cac65972da588d5218236de60a7be11247a8aa
added the fork to process_krb5_upcall so that the
child assumes the uid of the principal requesting
service.
When machine credentials are used, a gssd_k5_kt_princ
entry is added to a global list and used by future
upcalls to note when valid machine credentials have
been obtained. When a child process performs this task,
the entry to the global list is lost upon exit, and
all upcalls for machine credentials re-fetch a TGT,
even when a valid TGT is in the machine kerberos
credential cache.
Since forking is not necessary when the principal has
uid=0, solve the gssd_k5_kt_princ_list issue by only
forking when the uid != 0.
Acked-by: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit cbe19a1d34d4d13f41337047da26ec1ef82ed44c
Author: Andy Adamson <andros@netapp.com>
Date: Wed Sep 23 11:00:56 2015 -0400
GSSD: move process_krb5_updcall non machine cred case to helper function
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 1201d5d8aeb0651a6fe195bc8232128ddf6e8b28
Author: Andy Adamson <andros@netapp.com>
Date: Wed Sep 23 10:56:39 2015 -0400
GSSD: move process_krb5_upcall machine cred case to helper function
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit f2efa15ef8c083926791195ed1037fd47a5e4e41
Author: Scott Mayhew <smayhew@redhat.com>
Date: Wed Sep 16 11:19:41 2015 -0400
mountstats.man: Remove a few bogus .R macros
These have no effect on the rendering of the man page, but they do cause
the following error if you try to pipe or redirect the output:
`R' is a string (producing the registered sign), not a macro.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 3a5732152c60f8cefaa804db0b81e424e96ee657
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 11:18:02 2015 -0400
statd: statd_get_socket() should return open fds
Tastky <tastky@gmail.com> reports:
> There appears to be a bug in nfs-utils exposed by musl, which
> makes rpc.statd loop with:
>
> my_svc_run() - select: Bad file descriptor
OpenGroup says getservbyport(3) is supposed to return NULL when
no entry exists for the specified port. But musl's getservbyport(3)
never returns NULL (likely a bug).
Thus statd_get_socket() tries bindresvport(3) 100 times, then gives
up and returns the last socket it created. This should work fine,
but there's a bug in the retry loop:
Rich Felker <dalias@libc.org> says:
> The logic bug is the count-down loop that closes all the temp
> sockets. In the case where the loop terminates via break, it
> leaves the last one open and only closes the extras. But in the
> case where where the loop terminates via the end condition in the
> for statement, the close loop closes all the sockets _including_
> the one it intends to use.
(emphasis mine). The closed socket fd is then passed to select(2).
See also: http://www.openwall.com/lists/musl/2015/08
The fix is to perform the loop termination test before adding sockfd
to the set of fds to be closed. As additional clean ups, remove the
use of the variable-length stack array, and switch to variable names
that better document the purpose of this logic.
Reported-by: Tastky <tastky@gmail.com>
Fixes: eb8229338f06 ("rpc.statd: Fix socket binding loop.")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 78240c41be17bd20d5fb5b70b6f470d8e779adee
Author: Vivek Trivedi <t.vivek@samsung.com>
Date: Wed Sep 16 11:14:03 2015 -0400
mountd: fix mount issue due to comparison with uninitialized uuid
Fix mount issue due to comparison of uninitialized variable
u(uuid) with parsed->fhuuid when uuid_by_path return 0.
/tmp/usb
192.168.1.0/16(ro,no_root_squash,no_subtree_check,fsid=0)
/tmp/usb/sda1 192.168.1.0/16(ro,no_root_squash,no_subtree_check)
/tmp/usb/sdb1 192.168.1.0/16(ro,no_root_squash,no_subtree_check)
mount -t nfs -o nolock,nfsvers=3 192.168.1.2:/tmp/usb/sda1 /tmp/sda1
mount -t nfs -o nolock,nfsvers=3 192.168.1.2:/tmp/usb/sdb1 /tmp/sdb1
results in below mountd error:
mountd: /tmp/usb and /tmp/usb/sdb1 have same filehandle for
192.168.1.0/16, using first
when uuid_by_path returned 0, by chance, garbage value of u was same as
parsed->fhuuid(of sdb1), and comparison of these resulted in above
error.
Signed-off-by: Vivek Trivedi <t.vivek@samsung.com>
Reviewed-by: Amit Sahrawat <a.sahrawat@samsung.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit a4def734f7b9601c9ce89f18841aadf7a1962063
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 11:06:50 2015 -0400
nfsidmap: Clean up other exit status cases
Make it unambiguous where 0 or 1 represent an exit status.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 0b463a7bc09d89e0e141546ea5c5c59d94c5fefe
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 11:03:54 2015 -0400
nfsidmap: Fix error handling in name_lookup()
As near as I can tell, the exit status of nfsidmap is supposed to be
zero (success) or one (failure).
The return value of name_lookup() becomes the exit status, so it
should return only zero or one.
The libnfsidmap calls return a signed integer, either 0 or negative
errno values. These have to be translated to an exit status.
libkeyutils calls return a signed long, either 0 or -1. These also
have to be translated to an exit status.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 49f6c29fcfd924b2b964cce75623463c0d1c0d59
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 11:02:19 2015 -0400
nfsidmap: Fix error handling in id_lookup()
As near as I can tell, the exit status of nfsidmap is supposed to be
zero (success) or one (failure).
The return value of id_lookup() becomes the exit status, so it
should return only zero or one.
The libnfsidmap calls return a signed integer, either 0 or negative
errno values. These have to be translated to an exit status.
libkeyutils calls return a signed long, either 0 or -1. These also
have to be translated to an exit status.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 43bcaca81740cbe78f4f97cf8b0fc39350a17a68
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 11:00:12 2015 -0400
nfsidmap: List cached ID mapping results
User space can see the keys, but not their contents.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 8903d75ed4abd4207873b315885b559abfaa2af8
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 10:19:36 2015 -0400
nfsidmap: Use find_key_by_type_and_desc() if available
Recent versions of libkeyutils have find_key_by_type_and_desc()
which replaces the open-coded keyring search in keyring_clear().
I don't quite understand what's going on in key_invalidate(),
so I didn't touch it.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 5135a70fd0917986a575f9f01d0a29b5c93c4041
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Wed Sep 16 09:41:32 2015 -0400
nfsidmap: Display the effective NFSv4 domain name
Sorry for the extensive man page changes. I added the description
for the new "-d" option, then realized there was no explanation
about what an "NFSv4 domain name" is.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 017164521b94018bd143b879b0e858d98cca83e8
Author: Steve Dickson <steved@redhat.com>
Date: Tue Sep 15 14:16:42 2015 -0400
configure.ac: with-systemd flag not using default directory
The with-systemd config flag was not using the
default directory when a directory was not given
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 67a435bbf5015d8d2f6008744cadab4c4ede7c07
Author: Aurelien Chabot <aurelien@chabot.fr>
Date: Tue Sep 15 14:15:28 2015 -0400
Install only needed systemd unit file
Signed-off-by: Aurelien Chabot <aurelien@chabot.fr>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 34fd18332fd536e2f7a75274576bfa49f0af34e7
Author: Steve Dickson <steved@redhat.com>
Date: Tue Sep 8 10:25:24 2015 -0400
Revert "rpc.gssd: Replace exit(0) by return in process_krb5_upcall"
This reverts commit 21f10369965bb183d1a72df1da0c2811cd2b1d5c
due to child processes not exiting on upcalls.
commit 21f10369965bb183d1a72df1da0c2811cd2b1d5c
Author: Andy Adamson <andros@netapp.com>
Date: Mon Aug 24 13:50:09 2015 -0400
rpc.gssd: Replace exit(0) by return in process_krb5_upcall
From: Andy Adamson <andros@netapp.com>
exit(0) silenty reaps the gssd_k5_kt_princ struct, the in-memory
rpc.gssd cache which means that rpc.gssd will get a new TGT and TGS for
each upcall, ignoring a valid TGT in the kerberos credential cache.
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 8c7d7fe5577b059130d472d4145a09cf9d4a7ea2
Author: Steve Dickson <steved@redhat.com>
Date: Mon Aug 10 09:58:01 2015 -0400
mountstats.man: fixed typo in man page
Signed-off-by: Steve Dickson <steved@redhat.com>
commit a705076172b274463563416adffe55f129740267
Author: Steve Dickson <steved@redhat.com>
Date: Thu Jul 30 17:06:39 2015 -0400
rpc.gssd: Only clear the retval if it has not been set
In gssd_search_krb5_keytab() an error code can be
cleared by blindly setting retval to zero.
Reported-by: Jianhong Yin <jiyin@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 9bfca466c97ffff94f15923905d39782d0c85249
Author: Steve Dickson <steved@redhat.com>
Date: Tue Jul 14 15:37:25 2015 -0400
Fixed typo in rpc.mount man page
Signed-off-by: Steve Dickson <steved@redhat.com>
commit b13027f442e3bbb5f52a1facaa486f36b6d4d751
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Tue Jul 14 14:03:33 2015 -0400
blkmapd: Skip the SCSI ID if data length is zero
In vmware linux, the iscsi device contains more than one SCSI ID,
and the second one's data length is zero.
If there are two iSCSI devices with the second SCSI ID's data length
is zero, the first iSCSI device will record with an invalid SCSI ID
as zero length, the second one will be treat as the first one for
the SCSI ID is zero length too.
It means the only the first iSCSI device is exist in blkmapd's cache,
the request for the second iSCSI device will failed as,
"blkmapd: Could not find disk for device" and,
"bl_resolve_deviceid failed to decode device: 2".
v2, update comments
v3, add a comment in the code
v4, update comment as Christoph's suggestion
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 2f8a60200f4cc599bb421eb22de3212488d28701
Author: Chuck Lever <chuck.lever@oracle.com>
Date: Tue Jul 14 10:42:16 2015 -0400
rpc.nfsd: Squelch DNS errors when using the --host option
Sean Elble <elbles@sessys.com> says:
> [rpc.nfsd --host] throws an error/warning (where nfs-server is
> defined in /etc/hosts for the IPv4 address of the interface I wish
> for TCP port 2049 to be opened on):
>
> rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name
> or service not known
I think we can simplify the use of getaddrinfo(3) so that only one
call is needed to gather both IPv4 and IPv6 addresses. The call
should fail, and an error should be reported, only when there are
_no_ addresses bound to a hostname.
Reported-by: Sean Elble <elbles@sessys.com>
Reviewed-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit c6b8191374d9ad064eb96423400a6314c2d0102e
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Tue Jun 30 14:12:38 2015 -0400
blkmapd: Fix infinite loop when reading serial
If (dev_id->ids & 0xf) < current_id, must updates pos when continue.
Otherwise an infinite loop.
No other places use the pos value, just move to the top of while.
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 8b3abe3a0ae941f3f52f99bc44388b7beb3d9bb8
Author: Colin Walters <walters@verbum.org>
Date: Fri Jun 26 09:31:16 2015 -0400
systemd: Set var-lib-nfs-rpc_pipefs.mount After= tmpfiles
OSTree is a mechanism for atomic updates of operating systems, with
designs for how system state is managed; in particular, `/var` should
start out empty, and components are responsible for creating content
there at runtime.
rpm-ostree consumes RPMs and commits them to an OSTree repository.
It has some support for automatically synthesizing systemd `tmpfiles.d`
snippets from RPM content in `/var` using systemd-tmpfiles.
However, in this case nfs-utils wants a mount point directory, and
it's running before systemd-tmpfiles. It should be perfectly fine to
do this mount after tmpfiles has run.
A better fix for this would be to move transient directories to
`/run`; However, that would be an invasive change, which can happen
after this fix.
Signed-off-by: Colin Walters <walters@verbum.org>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit b98f2af15fea1d14a4b6ab1ab2dcdfec8db5dd1b
Author: Steve Dickson <steved@redhat.com>
Date: Thu Jun 25 11:09:38 2015 -0400
nfs-server: Use rpcbind.service instead of rpbind.target
To trigger the systemd socket activation support
in rpcbind, nfs-service needs to Requires/After
rpcbind.service instead of rpbind.target
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 60e1bdd3e3b586dfa30df976d99744d0cfc77b66
Author: Steve Dickson <steved@redhat.com>
Date: Thu Jun 25 10:14:54 2015 -0400
mount.nfs manpage: Add nfsmount.conf
Add nfsmount.conf to both the FILES and SEE ALSO
sections
Signed-off-by: Steve Dickson <steved@redhat.com>
commit e2f63adcecb6b85388bef0e7d76480a3152d826c
Author: Steve Dickson <steved@redhat.com>
Date: Thu Jun 25 10:09:36 2015 -0400
nfs manpage: Add nfsmount.conf
Add nfsmount.conf to both the FILES and SEE ALSO
sections
Signed-off-by: Steve Dickson <steved@redhat.com>
commit c1395ccf1afcf949f873905253494aeb60b632c9
Author: Scott Mayhew <smayhew@redhat.com>
Date: Wed Jun 3 15:02:02 2015 -0400
mountstats: Fix the retrans counter output by the nfsstat command
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit e69eaaf93626e87dd93b345e1c84ffdd6c66ce6c
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 16:17:40 2015 -0400
security information number as, 1 1 0 0
It's caused by commit 4a1ad4aa30,
"mountd: Enable all auth flavors on pseudofs exports"
This patch removes duplicate secinfo and invalid secinfo (zero).
Acked-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit d57c433481c7ee5fc50a186188f9c205d16746c1
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 15:25:12 2015 -0400
mount: Writes signal number to kernel as command line
When mounting nfs with -overs=4,minorversion=2, want getting
nfs mounts with vers=4.2, but got vers=4.0 as,
It's caused by mount.nfs writing bad vers to kernel. This patch
lets mount.nfs writing signal number to kernel as command line.
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit bf5c78cc241a1455462f9f5e1e40b6c820d23bbd
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 15:21:50 2015 -0400
When mounting nfs with -ov4, -overs=4 or -onfsvers=4, fail as,
mount -t nfs -ov4 192.168.31.12:/ /testidr/
mount.nfs: access denied by server while mounting 192.168.31.12:/
Fixes: f980298853 "mount.nfs: configurable minor version defaults"
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 3e28fe73af023bf42e0d654146bfb9314b4d8438
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 15:19:18 2015 -0400
osd_login: add --disable-osdlogin for configure osd_login
Configure using the following command
./configure --prefix=/home/username/installs/tmp
--exec-prefix=/home/username/installs/tmp
When running "make install" most of the packages are put under
/home/username/installs/tmp, but for some reason the install script
tries to put osd_login under /sbin, which results in an error:
Making install in osd_login
make[2]: Entering directory
`/home/username/installs/nfs-utils-1.3.2/utils/osd_login'
make[3]: Entering directory
`/home/username/installs/nfs-utils-1.3.2/utils/osd_login'
/usr/bin/mkdir -p '/sbin'
/usr/bin/install -c osd_login '/sbin'
/usr/bin/install: cannot remove ‘/sbin/osd_login’:
Permission denied
make[3]: *** [install-dist_sbinSCRIPTS] Error 1
Reported-by: Eino Juhani Oltedal <e.j.oltedal@fys.uio.no>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 441a3183399a423a3c86675c7c5395a1514b8a1d
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 15:04:57 2015 -0400
configure.ac: fix configure fail with --disable-mount
Configure fail as,
./configure --disable-mount
:
checking for suitable libblkid version... yes
checking for mnt_context_do_mount in -lmount... no
configure: error: libmount needed
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 51ec5b18dba93ae816973f098d179826f243655e
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed May 6 14:44:44 2015 -0400
configure.ac: fix typo of enable_nfsdcltrack
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 4927109a739edd57a5c7eb4311127e5349dcaba2
Author: Steve Dickson <steved@redhat.com>
Date: Thu Apr 30 14:05:21 2015 -0400
nfsidmap: make sure give arguments are valid
Detect when a given argument is invalid. Log
the error and exit gracefully
Signed-off-by: Steve Dickson <steved@redhat.com>
commit c08f1382e5609bc686c3df95ff1e267804b37a61
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Mon Apr 6 17:00:44 2015 -0400
exportfs: add missing comma for exports ent
When using pnfs with "fsid=0", exportfs prints error as,
$ exportfs -a
exportfs: /var/lib/nfs/etab:1: unknown keyword "no_pnfsfsid=0"
Commit cdd16bef98 ("nfs-utils: add support for the "pnfs" export option")
miss the comma after "pnfs"/"on_pnfs" operation.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit cdd16bef988a36868a7105c14d4665a53c1c5481
Author: Christoph Hellwig <hch@lst.de>
Date: Thu Apr 2 11:49:42 2015 -0400
nfs-utils: add support for the "pnfs" export option
This goes along with the patch just sent to Bruce to make pnfs
support conditional.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit d1f6583a5ff32711a1da1d4a13a29a5700f63504
Author: Ben Hutchings <ben@decadent.org.uk>
Date: Thu Apr 2 11:43:33 2015 -0400
mount.nfs.man, nfs.man: Update distinction between fstypes
From: Ben Hutchings <ben@decadent.org.uk>
this is a resync of the man page updates in the Debian
package with mainline nfs-utils.
Acked-By: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 54bf943f683f3fcea379b94f36a12701e594e7b9
Author: Cyril Brulebois <kibi@debian.org>
Date: Thu Apr 2 11:39:43 2015 -0400
nfs-utils: cross-reference nfsd.7 from nfsd.8 and vice versa
From: Cyril Brulebois <kibi@debian.org>
It'd be nice if one could notice nfsd(7) when reading nfsd(8) and the
other way round, without having to have to resort to dpkg -L $pkg to
figure out what documentation is available.
Acked-By: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 4a1ad4aa3028d26d830d9a9003ff9e3337b0e0d5
Author: Scott Mayhew <smayhew@redhat.com>
Date: Thu Apr 2 11:15:15 2015 -0400
mountd: Enable all auth flavors on pseudofs exports
With the current mountd code it's possible to craft exports in such a
manner that clients will be unable to mount exports that they *should*
be able to mount.
Consider the following example:
/foo *(rw,insecure,no_root_squash,sec=krb5p)
/bar client.example.com(rw,insecure,no_root_squash)
Initially, client.example.com will be able to mount the /foo export
using sec=krb5p, but attempts to mount /bar using sec=sys will return
EPERM. Once the nfsd.export cache entry expires, client.example.com
will then be able to mount /bar using sec=sys but attempts to mount /foo
using sec=krb5p will return EPERM.
The reason this happens is because the initial nfsd.export cache entry
is actually pre-populated by nfsd_fh(), which is the handler for the
nfsd.fh cache, while later cache requests (once the initial entry
expires) are handled by nfsd_export(). These functions have slightly
different logic in how they select a v4root export from the cache --
nfsd_fh() takes last matching v4root export it finds, while
nfsd_export() (actually lookup_export()) takes the first. Either way
it's wrong because the client should be able to mount both exports.
Both rfc3503bis and rfc5661 say:
A common and convenient practice, unless strong security requirements
dictate otherwise, is to make the entire pseudo file system
accessible by all of the valid security mechanisms.
...so lets do that.
Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 5cbb78bf4bd871168ada54b0fd4b42b26c959f3e
Author: NeilBrown <neilb@suse.de>
Date: Thu Mar 26 11:27:27 2015 -0400
mount: improve error message when statd cannot be started.
If you try to mount and NFSv3 filesystem, and statd is not running
and cannot be started (maybe rpcbind isn't running either), the
error message is:
mount.nfs: rpc.statd is not running but is required for remote locking.
mount.nfs: Either use '-o nolock' to keep locks local, or start statd.
mount.nfs: an incorrect mount option was specified
That last line is incorrect and misleading: no incorret mount option was
specified.
This line comes from mount_error() in error.c. In this case that
function doesn't really need to provide any more information.
So introduce a concention that EALREADY means an error message has
already been printed, and use it to suppress that message.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 81aed045d3057a44b3aabf946bad2894be64dda7
Author: Kinglong Mee <kinglongmee@gmail.com>
Date: Thu Mar 26 11:23:17 2015 -0400
blkmapd: Make sure device root contains valid device id
When testing pnfs in virtual linux based on VirtualBox,
blkmapd gets dev_root->len == 0, which causes it Segmentation fault.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 9128433947479d8eb9ea08fae2b79670d30b5cfa
Author: Steve Dickson <steved@redhat.com>
Date: Thu Mar 19 11:39:25 2015 -0400
nfs-blkmap.service: add EnvironmentFile directive
Fixes: https://bugzilla.linux-nfs.org/show_bug.cgi?id=281
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 8b7bc02a411019fce9ed069a2d18f556c1009150
Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Thu Mar 19 11:37:52 2015 -0400
units: nuke nfs-blkmap.target
It seems that the purpose of nfs-blkmap.target was to enable and
disable nfs-blkmap.service. This can be done directly by adding
an [Install] section in nfs-blkmap.service.
The downside of the previous arrangement, apart from the unnecessary
complexity, was a warning during boot:
[ INFO ] PNFS blkmaping enablement. is not active.
[DEPEND] Dependency failed for pNFS block layout mapping daemon.
https://bugzilla.redhat.com/show_bug.cgi?id=1088665
Signed-off-by: Zbigniew J?drzejewski-Szmek <zbyszek@in.waw.pl>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 997148c3d87d4a59a0e542c4fbe77fefc6489e56
Author: Martin Pitt <martin.pitt@ubuntu.com>
Date: Thu Mar 19 11:33:49 2015 -0400
systemd: Relax dependencies of services
Stop depending on basic.target in the daemons which still do;
i. e. add DefaultDependencies=no. This makes it possible to
run NFS during early boot, and helps if you e. g. have /var
on NFS. We don't require much else than local-fs.
Acked-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 1e41488f428cd36b200b48b84d31446e38dfdc50
Author: Martin Pitt <martin.pitt@ubuntu.com>
Date: Thu Mar 19 11:16:02 2015 -0400
systemd: Order NFS server before client
This makes mounting NFS shares from localhost work reliably,
as you need to start the server before attempting (client)
mounts, and conversely on shutdown need to unmount all
shares before stopping the server to avoid hangs.
Signed-off-by: Steve Dickson <steved@redhat.com>
commit ed3e519daac300973cfc8697113cb41e584bcac4
Author: Steve Dickson <steved@redhat.com>
Date: Tue Mar 3 13:19:29 2015 -0500
systemd: Have rpc-statd-notify.service Require network.target
Its been reported that having the rpc-statd-notify service
depend on network.target instead network-online.target
decrease boot times as much as 10 seconds on some
installs
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1183293
Signed-off-by: Steve Dickson <steved@redhat.com>
Reported-by: Eric Work <work.eric@gmail.com>
commit e24ba8a24d3ebfa6388a74523e61f2cad179c0c2
Author: Scott Mayhew <smayhew@redhat.com>
Date: Wed Mar 4 08:11:35 2015 -0500
mountstats: Normalize the mountpoints passed on the command line.
Normalize the mountpoints passed on the command line so that commands
like 'mountstats /mnt/' succeed rather than fail.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 7e81d45c4f7a4bbbfe16adb715397a2351526eaf
Author: Scott Mayhew <smayhew@redhat.com>
Date: Wed Mar 4 08:09:58 2015 -0500
mountstats: Fix exit code handling
When I changed mountstats to use the argparse module, I neglected to
make the subcommand functions return any values even though main() was
looking for them. Also removed SystemExit from the except clause at
the end of the program since it was causing the program to always exit
with a status of 1.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 578e44bd1778d70f677a3efedb49a072ee3483ec
Author: Aurélien Chabot <aurelien@chabot.fr>
Date: Thu Feb 26 14:30:50 2015 -0500
configure.ac: Fix systemd autotools activation option
The option to activate the install of systemd service files
was never taken into account.
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 484be028e408901bc54e76859c17713a2d5a2252
Author: Scott Mayhew <smayhew@redhat.com>
Date: Thu Feb 26 14:23:53 2015 -0500
mountd: Fix memory leak in getexportent
Valgrind shows that the memory allocated for ee.e_hostname in
getexportent() is being leaked. While there _is_ a call to xfree(), by
the time it gets called the leak's already happened. Moving the xfree()
call so that it occurs before the assignment that overwrites ee fixes
this.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 810423415dd1a2b7275b3abf294e6a69951614a1
Author: Carlos O'Donell <carlos@redhat.com>
Date: Thu Feb 26 14:13:26 2015 -0500
rpc.statd: Avoid passing unregistered socket to svc_getreqset
rpc.statd may crash if it receives both a notification reply and a
client connection at the same time. It crashes because it adds
sockfd to SVC_FDSET and that violates the API contract.
The SVC_FDSET is to be considered read-only and must not be modified
by user code. The daemon modifies it for expediency to avoid
having to maintain two distinct fd lists and select on each one.
It is a practical choice that makes sense.
Thus, if a notification reply arrives by itself everything works,
or if a client connection arrives by itself everything works. Both
must arrive at the same time for sockfd to be set in SVC_FDSET
and to be processed by svc_getreqset because more than one of
readfds is ready.
It is the processing by svc_getreqset that will crash when it finds an
unregistered fd in the list that doesn't correlate to any of the
internal book keeping done by the library. At present the glibc
SunRPC library will crash, but TIRPC does not (it is robust against
invalid API usage in this case). However, future RPC libraries
may be implemented differently, and the questionable API usage
should be fixed.
The simplest fix is for process_reply to *clear* sockfd from the
ready-to-read fds, since it was never registered with xprt_register.
This works because the code always calls process_reply before handing
the fd set to the RPC layer for processing.
Compile-tested on x86_64 against master.
Signed-off-by: Carlos O'Donell <carlos@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 0f1f4e7278c1bc93d54da1026dfe484f27bcd873
Author: NeilBrown <neilb@suse.de>
Date: Thu Feb 26 14:10:35 2015 -0500
exports.man: improve documentation of 'nohide' and 'crossmnt'
- note that 'nohide' is irrelevant for NFSv4
- note that children on a 'crossmnt' filesystem cannot be unexported
- note that 'nocrossmnt' is a valid option, but probably not useful.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 1e4a4c3816ca5a1e1a345117a201d9cc6c468beb
Author: NeilBrown <neilb@suse.de>
Date: Wed Feb 25 16:47:56 2015 -0500
mountd: fix next_mnt handling for "/"
If the (exported) path passed to next_mnt() is simply "/", next_mnt()
will not report any children, as none start with "/" followed by a '/'.
So make a special case for strlen(p)==1. In that case, return all
children.
This gives correct handling if only "/" is exported.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit cb80ee2db749a19814d1851a05c6bfa81f98d71d
Author: Steve Dickson <steved@redhat.com>
Date: Thu Feb 19 16:03:30 2015 -0500
Fixed a few typos in the mountstats(8) manpage
Acked-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
commit 650633d4e956dc6b628da30c868e39fba76a0b29
Author: Steve Dickson <steved@redhat.com>
Date: Mon Feb 9 08:54:54 2015 -0500
rpc-statd-notify: Don't wait for the network to come up
rpc-statd-notify only needs to wait for the network
interface to be configured not to be connected since
it forks into background and will wait 15mins for
the network to come up.
This decrease boot times when networks are not
and will not be connected.
Signed-off-by: Steve Dickson <steved@redhat.com>
Reported-By: Eric Work <work.eric@gmail.com>
commit 17a3e5bffb7110d46de1bf42b64b90713ff5ea50
Author: Chris Mayo <aklhfex@gmail.com>
Date: Sun Feb 1 12:03:46 2015 -0500
statd: Fix test for foreground mode
daemon_init parameter has the opposite sense
to code removed in commit 7addf9d
Signed-off-by: Chris Mayo <aklhfex@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>