From patchwork Mon Sep 21 20:50:08 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Adamson X-Patchwork-Id: 7233751 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 1F945BEEC1 for ; Mon, 21 Sep 2015 20:50:52 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5A14D205FE for ; Mon, 21 Sep 2015 20:50:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C479520635 for ; Mon, 21 Sep 2015 20:50:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753884AbbIUUuq (ORCPT ); Mon, 21 Sep 2015 16:50:46 -0400 Received: from mx144.netapp.com ([216.240.21.25]:51454 "EHLO mx144.netapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752306AbbIUUup (ORCPT ); Mon, 21 Sep 2015 16:50:45 -0400 X-IronPort-AV: E=Sophos;i="5.17,569,1437462000"; d="scan'208";a="69361571" Received: from vmwexchts03-prd.hq.netapp.com ([10.122.105.31]) by mx144-out.netapp.com with ESMTP; 21 Sep 2015 13:50:45 -0700 Received: from smtp1.corp.netapp.com (10.57.156.124) by VMWEXCHTS03-PRD.hq.netapp.com (10.122.105.31) with Microsoft SMTP Server id 15.0.1104.5; Mon, 21 Sep 2015 13:50:44 -0700 Received: from andros-new.vpn.netapp.com (andros-new.vpn.netapp.com [10.55.79.9]) by smtp1.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id t8LKofBt003117; Mon, 21 Sep 2015 13:50:44 -0700 (PDT) From: To: CC: , , Andy Adamson Subject: [PATCH 3/4] GSSD only fork when uid is not zeo Date: Mon, 21 Sep 2015 16:50:08 -0400 Message-ID: <1442868609-1812-4-git-send-email-andros@netapp.com> X-Mailer: git-send-email 1.9.3 (Apple Git-50) In-Reply-To: <1442868609-1812-1-git-send-email-andros@netapp.com> References: <1442868609-1812-1-git-send-email-andros@netapp.com> MIME-Version: 1.0 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Andy Adamson commit f9cac65972da588d5218236de60a7be11247a8aa added the fork to process_krb5_upcall so that the child assumes the uid of the principal requesting service. When machine credentials are used, a gssd_k5_kt_princ entry is added to a global list and used by future upcalls to note when valid machine credentials have been obtained. When a child process performs this task, the entry to the global list is lost upon exit, and all upcalls for machine credentials re-fetch a TGT, even when a valid TGT is in the machine kerberos credential cache. Since forking is not necessary when the principal has uid=0, solve the gssd_k5_kt_princ_list issue by only forking when the uid != 0. Signed-off-by: Andy Adamson Signed-off-by: Jeff Layton --- utils/gssd/gssd_proc.c | 67 ++++++++++++++++++++++++++++++++------------------ 1 file changed, 43 insertions(+), 24 deletions(-) diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c index 0e04570..7cf8f0c 100644 --- a/utils/gssd/gssd_proc.c +++ b/utils/gssd/gssd_proc.c @@ -597,33 +597,11 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname, gss_buffer_desc token; int err, downcall_err = -EACCES; OM_uint32 maj_stat, min_stat, lifetime_rec; - pid_t pid; + pid_t pid, childpid = -1; gss_name_t gacceptor = GSS_C_NO_NAME; gss_OID mech; gss_buffer_desc acceptor = {0}; - pid = fork(); - switch(pid) { - case 0: - /* Child: fall through to rest of function */ - break; - case -1: - /* fork() failed! */ - printerr(0, "WARNING: unable to fork() to handle upcall: %s\n", - strerror(errno)); - return; - default: - /* Parent: just wait on child to exit and return */ - do { - pid = wait(&err); - } while(pid == -1 && errno != -ECHILD); - - if (WIFSIGNALED(err)) - printerr(0, "WARNING: forked child was killed with signal %d\n", - WTERMSIG(err)); - return; - } - printerr(1, "handling krb5 upcall (%s)\n", clp->relpath); token.length = 0; @@ -655,6 +633,38 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname, service ? service : ""); if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 && service == NULL)) { + + /* already running as uid 0 */ + if (uid == 0) + goto no_fork; + + printerr(1, "Forking\n"); + pid = fork(); + switch(pid) { + case 0: + /* Child: fall through to rest of function */ + childpid = getpid(); + printerr(1, "CHILD forked pid %d \n", childpid); + break; + case -1: + /* fork() failed! */ + printerr(0, "WARNING: unable to fork() to handle" + "upcall: %s\n", strerror(errno)); + return; + default: + /* Parent: just wait on child to exit and return */ + do { + pid = wait(&err); + } while(pid == -1 && errno != -ECHILD); + + if (WIFSIGNALED(err)) + printerr(0, "WARNING: forked child was killed" + "with signal %d\n", WTERMSIG(err)); + return; + } +no_fork: + + printerr(1, "pid %d calling krb5_not_machine_creds\n", getpid()); auth = krb5_not_machine_creds(clp, uid, tgtname, &downcall_err, &err, &rpc_clnt); if (err) @@ -717,11 +727,20 @@ out: if (pd.pd_ctx_hndl.length != 0 || pd.pd_ctx != 0) authgss_free_private_data(&pd); #endif + printerr(1, "OUT auth %p rpc_clnt %p pid %d\n", auth, rpc_clnt, + getpid()); if (auth) AUTH_DESTROY(auth); if (rpc_clnt) clnt_destroy(rpc_clnt); - exit(0); + pid = getpid(); + if (pid == childpid) { + printerr(1, "pid %d CALLING EXIT\n\n\n", pid); + exit(0); + } else { + printerr(1, "pid %d CALLING RETURN\n\n\n", pid); + return; + } out_return_error: do_error_downcall(fd, uid, downcall_err);