rpms/nfs-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

gssd: Look for user creds in user defined directory (bz 786993)

Browse Source 
Signed-off-by: Steve Dickson <steved@redhat.com>
This commit is contained in:
Steve Dickson 2012-03-22 14:55:49 -04:00
parent a6650d33ff
commit 9ac8d5daed
2 changed files with 102 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

96
nfs-utils-1.2.5-gssd-usercreds.patch Normal file
View File

@ -0,0 +1,96 @@
commit 245fad6be5a32866b2cefad55b3e2d50f6b197af
Author: Steve Dickson <steved@redhat.com>
Date: Thu Mar 22 11:02:46 2012 -0400
gssd: Look for user creds in user defined directory
The user credential cache currently is kept in /tmp.
In upcoming Kerberos release that will be moved to
/run/user/<username>/. This patch enables gssd to
look in both the old and new caches
Signed-off-by: Steve Dickson <steved@redhat.com>
diff -up nfs-utils-1.2.5/utils/gssd/gssd.c.orig nfs-utils-1.2.5/utils/gssd/gssd.c
--- nfs-utils-1.2.5/utils/gssd/gssd.c.orig 2011-09-24 07:55:15.000000000 -0400
+++ nfs-utils-1.2.5/utils/gssd/gssd.c 2012-03-22 11:12:47.441219000 -0400
@@ -57,7 +57,7 @@
char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
-char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR;
+char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR ":" GSSD_USER_CRED_DIR;
char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
int use_memcache = 0;
int root_uses_machine_creds = 1;
diff -up nfs-utils-1.2.5/utils/gssd/gssd.h.orig nfs-utils-1.2.5/utils/gssd/gssd.h
--- nfs-utils-1.2.5/utils/gssd/gssd.h.orig 2011-09-24 07:55:15.000000000 -0400
+++ nfs-utils-1.2.5/utils/gssd/gssd.h 2012-03-22 11:12:47.447222000 -0400
@@ -45,6 +45,7 @@
#define DNOTIFY_SIGNAL (SIGRTMIN + 3)
#define GSSD_DEFAULT_CRED_DIR "/tmp"
+#define GSSD_USER_CRED_DIR "/run/user"
#define GSSD_DEFAULT_CRED_PREFIX "krb5cc_"
#define GSSD_DEFAULT_MACHINE_CRED_SUFFIX "machine"
#define GSSD_DEFAULT_KEYTAB_FILE "/etc/krb5.keytab"
diff -up nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig nfs-utils-1.2.5/utils/gssd/gssd_proc.c
--- nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig 2011-09-24 07:55:15.000000000 -0400
+++ nfs-utils-1.2.5/utils/gssd/gssd_proc.c 2012-03-22 11:12:47.455220000 -0400
@@ -949,6 +949,23 @@ int create_auth_rpc_client(struct clnt_i
goto out;
}
+static char *
+user_cachedir(char *dirname, uid_t uid)
+{
+ struct passwd *pw;
+ char *ptr;
+
+ if ((pw = getpwuid(uid)) == NULL) {
+ printerr(0, "user_cachedir: Failed to find '%d' uid"
+ " for cache directory\n");
+ return NULL;
+ }
+ ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2);
+ if (ptr)
+ sprintf(ptr, "%s/%s", dirname, pw->pw_name);
+
+ return ptr;
+}
/*
* this code uses the userland rpcsec gss library to create a krb5
* context on behalf of the kernel
@@ -963,7 +980,7 @@ process_krb5_upcall(struct clnt_info *cl
gss_buffer_desc token;
char **credlist = NULL;
char **ccname;
- char **dirname;
+ char **dirname, *dir, *userdir;
int create_resp = -1;
int err, downcall_err = -EACCES;
@@ -1006,7 +1023,22 @@ process_krb5_upcall(struct clnt_info *cl
service == NULL)) {
/* Tell krb5 gss which credentials cache to use */
for (dirname = ccachesearch; *dirname != NULL; dirname++) {
- err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
+ /* See if the user name is needed */
+ if (strncmp(*dirname, GSSD_USER_CRED_DIR,
+ strlen(GSSD_USER_CRED_DIR)) == 0) {
+ userdir = user_cachedir(*dirname, uid);
+ if (userdir == NULL)
+ continue;
+ dir = userdir;
+ } else
+ dir = *dirname;
+
+ err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir);
+
+ if (userdir) {
+ free(userdir);
+ userdir = NULL;
+ }
if (err == -EKEYEXPIRED)
downcall_err = -EKEYEXPIRED;
else if (!err)

7
nfs-utils.spec
View File

@ -2,7 +2,7 @@ Summary: NFS utilities and supporting clients and daemons for the kernel NFS ser
Name: nfs-utils Name: nfs-utils
URL: http://sourceforge.net/projects/nfs URL: http://sourceforge.net/projects/nfs
Version: 1.2.5 Version: 1.2.5
Release: 13%{?dist} Release: 14%{?dist}
Epoch: 1 Epoch: 1
# group all 32bit related archs # group all 32bit related archs
@ -32,6 +32,7 @@ Patch001: nfs-utils-1.2.6-rc6.patch
Patch002: nfs-utils-1.2.4-mountshortcut.patch Patch002: nfs-utils-1.2.4-mountshortcut.patch
Patch003: nfs-utils-1.2.5-libidmap-hide-syms.patch Patch003: nfs-utils-1.2.5-libidmap-hide-syms.patch
Patch004: nfs-utils-1.2.5-nfsd-new-default.patch Patch004: nfs-utils-1.2.5-nfsd-new-default.patch
Patch005: nfs-utils-1.2.5-gssd-usercreds.patch
Patch100: nfs-utils-1.2.1-statdpath-man.patch Patch100: nfs-utils-1.2.1-statdpath-man.patch
Patch101: nfs-utils-1.2.1-exp-subtree-warn-off.patch Patch101: nfs-utils-1.2.1-exp-subtree-warn-off.patch
@ -92,6 +93,7 @@ This package also contains the mount.nfs and umount.nfs program.
%patch002 -p1 %patch002 -p1
%patch003 -p1 %patch003 -p1
%patch004 -p1 %patch004 -p1
%patch005 -p1
%patch100 -p1 %patch100 -p1
%patch101 -p1 %patch101 -p1
@ -281,6 +283,9 @@ fi
%attr(4755,root,root) /sbin/umount.nfs4 %attr(4755,root,root) /sbin/umount.nfs4
%changelog %changelog
* Thu Mar 22 2012 Steve Dickson <steved@redhat.com> 1.2.5-14
- gssd: Look for user creds in user defined directory (bz 786993)
* Fri Mar 16 2012 Steve Dickson <steved@redhat.com> 1.2.5-13 * Fri Mar 16 2012 Steve Dickson <steved@redhat.com> 1.2.5-13
- Make sure statd is start before NFS mounts (bz 786050) - Make sure statd is start before NFS mounts (bz 786050)
- rpc.idmap: Hide global symbols from libidmap plugins (bz 797332) - rpc.idmap: Hide global symbols from libidmap plugins (bz 797332)