From 9ac8d5daed96d91d9c4b53b05a9853b17a62f5af Mon Sep 17 00:00:00 2001 From: Steve Dickson Date: Mar 22 2012 18:56:38 +0000 Subject: gssd: Look for user creds in user defined directory (bz 786993) Signed-off-by: Steve Dickson --- diff --git a/nfs-utils-1.2.5-gssd-usercreds.patch b/nfs-utils-1.2.5-gssd-usercreds.patch new file mode 100644 index 0000000..d9578fc --- /dev/null +++ b/nfs-utils-1.2.5-gssd-usercreds.patch @@ -0,0 +1,96 @@ +commit 245fad6be5a32866b2cefad55b3e2d50f6b197af +Author: Steve Dickson +Date: Thu Mar 22 11:02:46 2012 -0400 + + gssd: Look for user creds in user defined directory + + The user credential cache currently is kept in /tmp. + In upcoming Kerberos release that will be moved to + /run/user//. This patch enables gssd to + look in both the old and new caches + + Signed-off-by: Steve Dickson + +diff -up nfs-utils-1.2.5/utils/gssd/gssd.c.orig nfs-utils-1.2.5/utils/gssd/gssd.c +--- nfs-utils-1.2.5/utils/gssd/gssd.c.orig 2011-09-24 07:55:15.000000000 -0400 ++++ nfs-utils-1.2.5/utils/gssd/gssd.c 2012-03-22 11:12:47.441219000 -0400 +@@ -57,7 +57,7 @@ + + char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR; + char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE; +-char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR; ++char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR ":" GSSD_USER_CRED_DIR; + char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1]; + int use_memcache = 0; + int root_uses_machine_creds = 1; +diff -up nfs-utils-1.2.5/utils/gssd/gssd.h.orig nfs-utils-1.2.5/utils/gssd/gssd.h +--- nfs-utils-1.2.5/utils/gssd/gssd.h.orig 2011-09-24 07:55:15.000000000 -0400 ++++ nfs-utils-1.2.5/utils/gssd/gssd.h 2012-03-22 11:12:47.447222000 -0400 +@@ -45,6 +45,7 @@ + #define DNOTIFY_SIGNAL (SIGRTMIN + 3) + + #define GSSD_DEFAULT_CRED_DIR "/tmp" ++#define GSSD_USER_CRED_DIR "/run/user" + #define GSSD_DEFAULT_CRED_PREFIX "krb5cc_" + #define GSSD_DEFAULT_MACHINE_CRED_SUFFIX "machine" + #define GSSD_DEFAULT_KEYTAB_FILE "/etc/krb5.keytab" +diff -up nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig nfs-utils-1.2.5/utils/gssd/gssd_proc.c +--- nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig 2011-09-24 07:55:15.000000000 -0400 ++++ nfs-utils-1.2.5/utils/gssd/gssd_proc.c 2012-03-22 11:12:47.455220000 -0400 +@@ -949,6 +949,23 @@ int create_auth_rpc_client(struct clnt_i + goto out; + } + ++static char * ++user_cachedir(char *dirname, uid_t uid) ++{ ++ struct passwd *pw; ++ char *ptr; ++ ++ if ((pw = getpwuid(uid)) == NULL) { ++ printerr(0, "user_cachedir: Failed to find '%d' uid" ++ " for cache directory\n"); ++ return NULL; ++ } ++ ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2); ++ if (ptr) ++ sprintf(ptr, "%s/%s", dirname, pw->pw_name); ++ ++ return ptr; ++} + /* + * this code uses the userland rpcsec gss library to create a krb5 + * context on behalf of the kernel +@@ -963,7 +980,7 @@ process_krb5_upcall(struct clnt_info *cl + gss_buffer_desc token; + char **credlist = NULL; + char **ccname; +- char **dirname; ++ char **dirname, *dir, *userdir; + int create_resp = -1; + int err, downcall_err = -EACCES; + +@@ -1006,7 +1023,22 @@ process_krb5_upcall(struct clnt_info *cl + service == NULL)) { + /* Tell krb5 gss which credentials cache to use */ + for (dirname = ccachesearch; *dirname != NULL; dirname++) { +- err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname); ++ /* See if the user name is needed */ ++ if (strncmp(*dirname, GSSD_USER_CRED_DIR, ++ strlen(GSSD_USER_CRED_DIR)) == 0) { ++ userdir = user_cachedir(*dirname, uid); ++ if (userdir == NULL) ++ continue; ++ dir = userdir; ++ } else ++ dir = *dirname; ++ ++ err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir); ++ ++ if (userdir) { ++ free(userdir); ++ userdir = NULL; ++ } + if (err == -EKEYEXPIRED) + downcall_err = -EKEYEXPIRED; + else if (!err) diff --git a/nfs-utils.spec b/nfs-utils.spec index bca7cba..b72e671 100644 --- a/nfs-utils.spec +++ b/nfs-utils.spec @@ -2,7 +2,7 @@ Summary: NFS utilities and supporting clients and daemons for the kernel NFS ser Name: nfs-utils URL: http://sourceforge.net/projects/nfs Version: 1.2.5 -Release: 13%{?dist} +Release: 14%{?dist} Epoch: 1 # group all 32bit related archs @@ -32,6 +32,7 @@ Patch001: nfs-utils-1.2.6-rc6.patch Patch002: nfs-utils-1.2.4-mountshortcut.patch Patch003: nfs-utils-1.2.5-libidmap-hide-syms.patch Patch004: nfs-utils-1.2.5-nfsd-new-default.patch +Patch005: nfs-utils-1.2.5-gssd-usercreds.patch Patch100: nfs-utils-1.2.1-statdpath-man.patch Patch101: nfs-utils-1.2.1-exp-subtree-warn-off.patch @@ -92,6 +93,7 @@ This package also contains the mount.nfs and umount.nfs program. %patch002 -p1 %patch003 -p1 %patch004 -p1 +%patch005 -p1 %patch100 -p1 %patch101 -p1 @@ -281,6 +283,9 @@ fi %attr(4755,root,root) /sbin/umount.nfs4 %changelog +* Thu Mar 22 2012 Steve Dickson 1.2.5-14 +- gssd: Look for user creds in user defined directory (bz 786993) + * Fri Mar 16 2012 Steve Dickson 1.2.5-13 - Make sure statd is start before NFS mounts (bz 786050) - rpc.idmap: Hide global symbols from libidmap plugins (bz 797332)