Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch: * rebase over rev. 8ca18752 (current master) * remove man pages from the patch (will be sent separately) * add new contact details for plugin author * code style * remove sss_nfs_make_request() wrapper * fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec
Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c
Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin --- src/sss_client/nfs/sss_nfs_client.c | 571 ++++++++++++++++++++++++++++++++++++ 1 file changed, 571 insertions(+) create mode 100644 src/sss_client/nfs/sss_nfs_client.c
diff --git a/src/sss_client/nfs/sss_nfs_client.c b/src/sss_client/nfs/sss_nfs_client.c new file mode 100644 index 0000000..64cb67a --- /dev/null +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -0,0 +1,571 @@ +/* + SSSD + + NFS Client + + Copyright (C) Noam Meltzer noam@primarydata.com 2013-2014 + Copyright (C) Noam Meltzer tsnoam@gmail.com 2014- + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see http://www.gnu.org/licenses/. +*/ + +#define _GNU_SOURCE + +#include <stddef.h> +#include <stdlib.h> +#include <sys/types.h> +#include <errno.h> +#include <string.h> + +#include <nfsidmap.h> +#include "nfsidmap_internal.h" + +#include "sss_client/sss_cli.h" +#include "sss_client/nss_mc.h" + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +#define PLUGIN_NAME "sss_nfs" +#define CONF_SECTION "sss_nfs" +#define CONF_USE_MC "memcache" +#define REPLY_ID_OFFSET (8) +#define REPLY_NAME_OFFSET (REPLY_ID_OFFSET + 8) +#define BUF_LEN (4096) +#define USE_MC_DEFAULT true + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +static char sss_nfs_plugin_name[] = PLUGIN_NAME; +static char nfs_conf_sect[] = CONF_SECTION; +static char nfs_conf_use_mc[] = CONF_USE_MC; + +static bool nfs_use_mc = USE_MC_DEFAULT; + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* Forward declarations */ +static int send_recv(uint8_t **repp, size_t *rep_lenp, enum sss_cli_command cmd, + const void *req, size_t req_len); +static int reply_to_id(id_t *idp, uint8_t *rep, size_t rep_len); +static int reply_to_name(char *name, size_t len, uint8_t *rep, size_t rep_len); + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* get from memcache functions */ +static int get_uid_from_mc(id_t *uid, const char *name) +{ + int rc = 0; + struct passwd pwd; + char *buf = NULL; + char *p = NULL; + size_t buflen = 0; + size_t len = 0; + + if (!nfs_use_mc) { + return -1; + } + + sss_strnlen(name, SSS_NAME_MAX, &len); + + do { + buflen += BUF_LEN; + if ((p = realloc(buf, buflen)) == NULL) { + rc = ENOMEM; + goto done; + } + buf = p; + rc = sss_nss_mc_getpwnam(name, len, &pwd, buf, buflen); + } while (rc == ERANGE); + + if (rc == 0) { + IDMAP_LOG(1, ("found user %s in memcache", name)); + *uid = pwd.pw_uid; + } else { + IDMAP_LOG(1, ("user %s not in memcache", name)); + } + +done: + free(buf); + return rc; +} + +static int get_gid_from_mc(id_t *gid, const char *name) +{ + int rc = 0; + struct group grp; + char *buf = NULL; + char *p = NULL; + size_t buflen = 0; + size_t len; + + if (!nfs_use_mc) { + return -1; + } + + sss_strnlen(name, SSS_NAME_MAX, &len); + + do { + buflen += BUF_LEN; + if ((p = realloc(buf, buflen)) == NULL) { + rc = ENOMEM; + goto done; + } + buf = p; + rc = sss_nss_mc_getgrnam(name, len, &grp, buf, buflen); + } while (rc == ERANGE); + + if (rc == 0) { + IDMAP_LOG(1, ("found group %s in memcache", name)); + *gid = grp.gr_gid; + } else { + IDMAP_LOG(1, ("group %s not in memcache", name)); + } + +done: + free(buf); + return rc; +} + +static int get_user_from_mc(char *name, size_t len, uid_t uid) +{ + int rc; + struct passwd pwd; + char *buf = NULL; + char *p = NULL; + size_t buflen = 0; + size_t pw_name_len; + + if (!nfs_use_mc) { + return -1; + } + + do { + buflen += BUF_LEN; + if ((p = realloc(buf, buflen)) == NULL) { + rc = ENOMEM; + goto done; + } + buf = p; + rc = sss_nss_mc_getpwuid(uid, &pwd, buf, BUF_LEN); + } while (rc == ERANGE); + + if (rc == 0) { + pw_name_len = strlen(pwd.pw_name) + 1; + if (pw_name_len > len) { + IDMAP_LOG(0, ("%s: reply too long; pw_name_len=%lu, len=%lu", + __func__, pw_name_len, len)); + rc = ENOBUFS; + } + IDMAP_LOG(1, ("found uid %i in memcache", uid)); + memcpy(name, pwd.pw_name, pw_name_len); + } else { + IDMAP_LOG(1, ("uid %i not in memcache", uid)); + } + +done: + free(buf); + return rc; +} + +static int get_group_from_mc(char *name, size_t len, id_t gid) +{ + int rc; + struct group grp; + char *buf = NULL; + char *p = NULL; + size_t buflen = 0; + size_t gr_name_len; + + if (!nfs_use_mc) { + return -1; + } + + do { + buflen += BUF_LEN; + if ((p = realloc(buf, buflen)) == NULL) { + rc = ENOMEM; + goto done; + } + buf = p; + rc = sss_nss_mc_getgrgid(gid, &grp, buf, BUF_LEN); + } while (rc == ERANGE); + + if (rc == 0) { + gr_name_len = strlen(grp.gr_name) + 1; + if (gr_name_len > len) { + IDMAP_LOG(0, ("%s: reply too long; gr_name_len=%lu, len=%lu", + __func__, gr_name_len, len)); + rc = ENOBUFS; + } + IDMAP_LOG(1, ("found gid %i in memcache", gid)); + memcpy(name, grp.gr_name, gr_name_len); + } else { + IDMAP_LOG(1, ("gid %i not in memcache", gid)); + } + +done: + free(buf); + return rc; +} + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +static int name_to_id(const char *name, id_t *id, enum sss_cli_command cmd) +{ + int rc; + uint8_t *rep = NULL; + size_t rep_len = 0; + size_t name_len; + + sss_strnlen(name, SSS_NAME_MAX, &name_len); + + rc = send_recv(&rep, &rep_len, cmd, name, name_len + 1); + if (rc == 0) { + rc = reply_to_id(id, rep, rep_len); + } + + free(rep); + + return rc; +} + +static int id_to_name(char *name, size_t len, id_t id, + enum sss_cli_command cmd) +{ + int rc; + size_t rep_len = 0; + size_t req_len = sizeof(id_t); + uint8_t *rep = NULL; + uint8_t req[req_len]; + + memcpy(req, &id, req_len); + rc = send_recv(&rep, &rep_len, cmd, &req, req_len); + if (rc == 0) { + rc = reply_to_name(name, len, rep, rep_len); + } + + free(rep); + + return rc; +} + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +static int send_recv(uint8_t **rep, size_t *rep_len, enum sss_cli_command cmd, + const void *req, size_t req_len) +{ + int err = 0; + enum nss_status req_rc; + struct sss_cli_req_data rd; + + rd.data = req; + rd.len = req_len; + + sss_nss_lock(); + req_rc = sss_nss_make_request(cmd, &rd, rep, rep_len, &err); + sss_nss_unlock(); + + if (req_rc == NSS_STATUS_NOTFOUND) { + return ENOENT; + } + if (req_rc != NSS_STATUS_SUCCESS) { + IDMAP_LOG(0, ("no-make-request; err=%i", err)); + return EPIPE; + } + + return 0; +} + +static int reply_to_id(id_t *idp, uint8_t *rep, size_t rep_len) +{ + int rc = 0; + id_t id; + uint32_t num_results = 0; + + if (rep_len < sizeof(uint32_t)) { + IDMAP_LOG(0, ("%s: reply too small; rep_len=%lu", __func__, rep_len)); + rc = EBADMSG; + goto done; + } + + SAFEALIGN_COPY_UINT32(&num_results, rep, NULL); + if (num_results > 1) { + IDMAP_LOG(0, ("%s: too many results (%lu)", __func__, num_results)); + rc = EBADMSG; + goto done; + } + if (num_results == 0) { + rc = ENOENT; + goto done; + } + if (rep_len < sizeof(uint32_t) + REPLY_ID_OFFSET) { + IDMAP_LOG(0, ("%s: reply too small(2); rep_len=%lu", __func__, + rep_len)); + rc = EBADMSG; + goto done; + } + + SAFEALIGN_COPY_UINT32(&id, rep + REPLY_ID_OFFSET, NULL); + *idp = id; + +done: + return rc; +} + +static int reply_to_name(char *name, size_t len, uint8_t *rep, size_t rep_len) +{ + int rc = 0; + uint32_t num_results = 0; + const char *buf; + size_t buf_len; + size_t offset; + + if (rep_len < sizeof(uint32_t)) { + IDMAP_LOG(0, ("%s: reply too small; rep_len=%lu", __func__, rep_len)); + rc = EBADMSG; + goto done; + } + + SAFEALIGN_COPY_UINT32(&num_results, rep, NULL); + if (num_results > 1) { + IDMAP_LOG(0, ("%s: too many results (%lu)", __func__, num_results)); + rc = EBADMSG; + goto done; + } + if (num_results == 0) { + rc = ENOENT; + goto done; + } + if (rep_len < sizeof(uint32_t) + REPLY_NAME_OFFSET) { + IDMAP_LOG(0, ("%s: reply too small(2); rep_len=%lu", __func__, + rep_len)); + rc = EBADMSG; + goto done; + } + + buf = (const char *)(rep + REPLY_NAME_OFFSET); + buf_len = rep_len - REPLY_NAME_OFFSET; + offset = 0; + rc = sss_readrep_copy_string(buf, &offset, &buf_len, &len, &name, NULL); + if (rc != 0) { + rc = -rc; + } + +done: + return rc; +} + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* configuration parsing aids */ +static bool str_equal(const char *s1, const char *s2) +{ + bool res = false; + size_t len1; + size_t len2; + + len1 = strlen(s1); + len2 = strlen(s2); + + if (len1 == len2) { + res = (strncasecmp(s1, s2, len1) == 0); + } + + return res; +} + +static int nfs_conf_get_bool(char *sect, char *attr, int def) +{ + int res; + char *val; + + res = def; + val = conf_get_str(sect, attr); + if (val) { + res = (str_equal("1", val) || + str_equal("yes", val) || + str_equal("true", val) || + str_equal("on", val)); + } + + return res; +} + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* libnfsidmap return-code aids */ + +/* + * we only want to return 0 or ENOENT; otherwise libnfsidmap will stop + * translation instead of proceeding to the next translation plugin + */ +int normalise_rc(int rc) { + int res; + + res = rc; + if (res != 0 && res != ENOENT) { + res = ENOENT; + } + + return res; +} + +/* log the actual rc from our code (to be used before normalising the rc) */ +void log_actual_rc(const char *trans_name, int rc) { + char tmp[80]; + IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc, + strerror_r(rc, tmp, sizeof(tmp)))); +} + + +/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* The external interface */ +static int sss_nfs_init(void) +{ + nfs_use_mc = nfs_conf_get_bool(nfs_conf_sect, nfs_conf_use_mc, + USE_MC_DEFAULT); + IDMAP_LOG(1, ("%s: use memcache: %i", __func__, nfs_use_mc)); + + return 0; +} + +static int sss_nfs_princ_to_ids(char *secname, char *princ, uid_t *uid, + gid_t *gid, extra_mapping_params **ex) +{ + IDMAP_LOG(0, ("%s: not implemented", __func__)); + return -ENOENT; +} + +static int sss_nfs_name_to_uid(char *name, uid_t *uid) +{ + int rc; + size_t name_len = 0; + + if (name == NULL) { + IDMAP_LOG(0, ("%s: name is null", __func__)); + return -EINVAL; + } + if (uid == NULL) { + IDMAP_LOG(0, ("%s: uid is null", __func__)); + return -EINVAL; + } + + rc = sss_strnlen(name, SSS_NAME_MAX, &name_len); + if (rc != 0) { + IDMAP_LOG(0, ("%s: no-strnlen; rc=%i", __func__, rc)); + return -rc; + } + + rc = get_uid_from_mc(uid, name); + if (rc != 0) { + rc = name_to_id(name, uid, SSS_NSS_GETPWNAM); + } + + log_actual_rc(__func__, rc); + rc = normalise_rc(rc); + + return -rc; +} + +static int sss_nfs_name_to_gid(char *name, gid_t *gid) +{ + int rc; + size_t name_len = 0; + + if (name == NULL) { + IDMAP_LOG(0, ("%s: name is null", __func__)); + return -EINVAL; + } + if (gid == NULL) { + IDMAP_LOG(0, ("%s: gid is null", __func__)); + return -EINVAL; + } + + rc = sss_strnlen(name, SSS_NAME_MAX, &name_len); + if (rc != 0) { + IDMAP_LOG(0, ("%s: no-strnlen; rc=%i", __func__, rc)); + return -rc; + } + + rc = get_gid_from_mc(gid, name); + if (rc != 0) { + rc = name_to_id(name, gid, SSS_NSS_GETGRNAM); + } + + log_actual_rc(__func__, rc); + rc = normalise_rc(rc); + + return -rc; +} + +static int sss_nfs_uid_to_name(uid_t uid, char *domain, char *name, size_t len) +{ + int rc; + + if (name == NULL) { + IDMAP_LOG(0, ("%s: name is null", __func__)); + return -EINVAL; + } + + rc = get_user_from_mc(name, len, uid); + if (rc != 0) { + rc = id_to_name(name, len, uid, SSS_NSS_GETPWUID); + } + + log_actual_rc(__func__, rc); + rc = normalise_rc(rc); + + return -rc; +} + +static int sss_nfs_gid_to_name(gid_t gid, char *domain, char *name, size_t len) +{ + int rc; + + if (name == NULL) { + IDMAP_LOG(0, ("%s: name is null", __func__)); + return -EINVAL; + } + + rc = get_group_from_mc(name, len, gid); + if (rc != 0) { + rc = id_to_name(name, len, gid, SSS_NSS_GETGRGID); + } + + log_actual_rc(__func__, rc); + rc = normalise_rc(rc); + + return -rc; +} + +static int sss_nfs_gss_princ_to_grouplist( + char *secname, char *princ, gid_t *groups, int *ngroups, + extra_mapping_params **ex) +{ + IDMAP_LOG(0, ("%s: not implemented", __func__)); + return -ENOENT; +} + +static struct trans_func s_sss_nfs_trans = { + .name = sss_nfs_plugin_name, + .init = sss_nfs_init, + .princ_to_ids = sss_nfs_princ_to_ids, + .name_to_uid = sss_nfs_name_to_uid, + .name_to_gid = sss_nfs_name_to_gid, + .uid_to_name = sss_nfs_uid_to_name, + .gid_to_name = sss_nfs_gid_to_name, + .gss_princ_to_grouplist = sss_nfs_gss_princ_to_grouplist, +}; + +struct trans_func *libnfsidmap_plugin_init(void) +{ + return (&s_sss_nfs_trans); +}
On Fri, Jun 27, 2014 at 09:44:35AM +0300, Noam Meltzer wrote:
Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
I've got just one style nitpick and one question, I can fix it before pushing..
src/sss_client/nfs/sss_nfs_client.c | 571 ++++++++++++++++++++++++++++++++++++ 1 file changed, 571 insertions(+) create mode 100644 src/sss_client/nfs/sss_nfs_client.c
diff --git a/src/sss_client/nfs/sss_nfs_client.c b/src/sss_client/nfs/sss_nfs_client.c new file mode 100644 index 0000000..64cb67a --- /dev/null +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -0,0 +1,571 @@ +/*
- SSSD
- NFS Client
- Copyright (C) Noam Meltzer noam@primarydata.com 2013-2014
- Copyright (C) Noam Meltzer tsnoam@gmail.com 2014-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program. If not, see http://www.gnu.org/licenses/.
+*/
[snip]
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* libnfsidmap return-code aids */
+/*
- we only want to return 0 or ENOENT; otherwise libnfsidmap will stop
- translation instead of proceeding to the next translation plugin
- */
+int normalise_rc(int rc) {
Style violation, I'd like the definition to read: int normalise_rc(int rc) { }
instead
- int res;
- res = rc;
- if (res != 0 && res != ENOENT) {
res = ENOENT;
- }
- return res;
+}
+/* log the actual rc from our code (to be used before normalising the rc) */ +void log_actual_rc(const char *trans_name, int rc) {
Same style violation here. I can fix these two myself before pushing provided these are the only changes we'd be doing.
- char tmp[80];
- IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc,
strerror_r(rc, tmp, sizeof(tmp))));
+}
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .*/ +/* The external interface */ +static int sss_nfs_init(void) +{
- nfs_use_mc = nfs_conf_get_bool(nfs_conf_sect, nfs_conf_use_mc,
USE_MC_DEFAULT);
- IDMAP_LOG(1, ("%s: use memcache: %i", __func__, nfs_use_mc));
- return 0;
+}
+static int sss_nfs_princ_to_ids(char *secname, char *princ, uid_t *uid,
gid_t *gid, extra_mapping_params **ex)
+{
- IDMAP_LOG(0, ("%s: not implemented", __func__));
- return -ENOENT;
Is ENOENT the return code NFS expects? Normally for functions that are not implemented I'd use ENOSYS..not a big deal though, I'm mostly asking..
The rest is an ACK from me.
On Mon, Jul 14, 2014 at 7:25 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:35AM +0300, Noam Meltzer wrote:
Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
I've got just one style nitpick and one question, I can fix it before pushing..
src/sss_client/nfs/sss_nfs_client.c | 571
++++++++++++++++++++++++++++++++++++
1 file changed, 571 insertions(+) create mode 100644 src/sss_client/nfs/sss_nfs_client.c
diff --git a/src/sss_client/nfs/sss_nfs_client.c
b/src/sss_client/nfs/sss_nfs_client.c
new file mode 100644 index 0000000..64cb67a --- /dev/null +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -0,0 +1,571 @@ +/*
- SSSD
- NFS Client
- Copyright (C) Noam Meltzer noam@primarydata.com 2013-2014
- Copyright (C) Noam Meltzer tsnoam@gmail.com 2014-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/
. +*/
[snip]
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . .*/
+/* libnfsidmap return-code aids */
+/*
- we only want to return 0 or ENOENT; otherwise libnfsidmap will stop
- translation instead of proceeding to the next translation plugin
- */
+int normalise_rc(int rc) {
Style violation, I'd like the definition to read: int normalise_rc(int rc) { }
instead
- int res;
- res = rc;
- if (res != 0 && res != ENOENT) {
res = ENOENT;
- }
- return res;
+}
+/* log the actual rc from our code (to be used before normalising the
rc) */
+void log_actual_rc(const char *trans_name, int rc) {
Same style violation here. I can fix these two myself before pushing provided these are the only changes we'd be doing.
thanks. (feeling ashamed...)
- char tmp[80];
- IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc,
strerror_r(rc, tmp, sizeof(tmp))));
+}
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . .*/
+/* The external interface */ +static int sss_nfs_init(void) +{
- nfs_use_mc = nfs_conf_get_bool(nfs_conf_sect, nfs_conf_use_mc,
USE_MC_DEFAULT);
- IDMAP_LOG(1, ("%s: use memcache: %i", __func__, nfs_use_mc));
- return 0;
+}
+static int sss_nfs_princ_to_ids(char *secname, char *princ, uid_t *uid,
gid_t *gid, extra_mapping_params **ex)
+{
- IDMAP_LOG(0, ("%s: not implemented", __func__));
- return -ENOENT;
Is ENOENT the return code NFS expects? Normally for functions that are not implemented I'd use ENOSYS..not a big deal though, I'm mostly asking..
for the same reason as normalise_rc() is needed: libnfsidmap will not proceed for the next plugin if the return code is not -ENOENT.
The rest is an ACK from me. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Mon, Jul 14, 2014 at 10:04:50PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:25 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:35AM +0300, Noam Meltzer wrote:
Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
I've got just one style nitpick and one question, I can fix it before pushing..
src/sss_client/nfs/sss_nfs_client.c | 571
++++++++++++++++++++++++++++++++++++
1 file changed, 571 insertions(+) create mode 100644 src/sss_client/nfs/sss_nfs_client.c
diff --git a/src/sss_client/nfs/sss_nfs_client.c
b/src/sss_client/nfs/sss_nfs_client.c
new file mode 100644 index 0000000..64cb67a --- /dev/null +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -0,0 +1,571 @@ +/*
- SSSD
- NFS Client
- Copyright (C) Noam Meltzer noam@primarydata.com 2013-2014
- Copyright (C) Noam Meltzer tsnoam@gmail.com 2014-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/
. +*/
[snip]
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . .*/
+/* libnfsidmap return-code aids */
+/*
- we only want to return 0 or ENOENT; otherwise libnfsidmap will stop
- translation instead of proceeding to the next translation plugin
- */
+int normalise_rc(int rc) {
Style violation, I'd like the definition to read: int normalise_rc(int rc) { }
instead
- int res;
- res = rc;
- if (res != 0 && res != ENOENT) {
res = ENOENT;
- }
- return res;
+}
+/* log the actual rc from our code (to be used before normalising the
rc) */
+void log_actual_rc(const char *trans_name, int rc) {
Same style violation here. I can fix these two myself before pushing provided these are the only changes we'd be doing.
thanks. (feeling ashamed...)
- char tmp[80];
- IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc,
strerror_r(rc, tmp, sizeof(tmp))));
+}
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . .*/
+/* The external interface */ +static int sss_nfs_init(void) +{
- nfs_use_mc = nfs_conf_get_bool(nfs_conf_sect, nfs_conf_use_mc,
USE_MC_DEFAULT);
- IDMAP_LOG(1, ("%s: use memcache: %i", __func__, nfs_use_mc));
- return 0;
+}
+static int sss_nfs_princ_to_ids(char *secname, char *princ, uid_t *uid,
gid_t *gid, extra_mapping_params **ex)
+{
- IDMAP_LOG(0, ("%s: not implemented", __func__));
- return -ENOENT;
Is ENOENT the return code NFS expects? Normally for functions that are not implemented I'd use ENOSYS..not a big deal though, I'm mostly asking..
for the same reason as normalise_rc() is needed: libnfsidmap will not proceed for the next plugin if the return code is not -ENOENT.
Thanks for the explanation, I should have read the comments more carefully.
Here is a diff I'm going to squash in when I push the patches:
diff --git a/src/sss_client/nfs/sss_nfs_client.c b/src/sss_client/nfs/sss_nfs_client.c index 64cb67a8b75ec04c1d6fa03905f5427bbe6c1e82..1f1f992af60a9cde7d1f039dd329d0d52c5fe9a3 100644 --- a/src/sss_client/nfs/sss_nfs_client.c +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -407,7 +407,8 @@ static int nfs_conf_get_bool(char *sect, char *attr, int def) * we only want to return 0 or ENOENT; otherwise libnfsidmap will stop * translation instead of proceeding to the next translation plugin */ -int normalise_rc(int rc) { +int normalise_rc(int rc) +{ int res;
res = rc; @@ -419,7 +420,8 @@ int normalise_rc(int rc) { }
/* log the actual rc from our code (to be used before normalising the rc) */ -void log_actual_rc(const char *trans_name, int rc) { +void log_actual_rc(const char *trans_name, int rc) +{ char tmp[80]; IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc, strerror_r(rc, tmp, sizeof(tmp))));
On Tue, Jul 15, 2014 at 6:17 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Mon, Jul 14, 2014 at 10:04:50PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:25 PM, Jakub Hrozek jhrozek@redhat.com
wrote:
On Fri, Jun 27, 2014 at 09:44:35AM +0300, Noam Meltzer wrote:
Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
I've got just one style nitpick and one question, I can fix it before pushing..
src/sss_client/nfs/sss_nfs_client.c | 571
++++++++++++++++++++++++++++++++++++
1 file changed, 571 insertions(+) create mode 100644 src/sss_client/nfs/sss_nfs_client.c
diff --git a/src/sss_client/nfs/sss_nfs_client.c
b/src/sss_client/nfs/sss_nfs_client.c
new file mode 100644 index 0000000..64cb67a --- /dev/null +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -0,0 +1,571 @@ +/*
- SSSD
- NFS Client
- Copyright (C) Noam Meltzer noam@primarydata.com 2013-2014
- Copyright (C) Noam Meltzer tsnoam@gmail.com 2014-
- This program is free software; you can redistribute it and/or
modify
- it under the terms of the GNU General Public License as
published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <
. +*/
[snip]
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. .
. . .*/
+/* libnfsidmap return-code aids */
+/*
- we only want to return 0 or ENOENT; otherwise libnfsidmap will
stop
- translation instead of proceeding to the next translation plugin
- */
+int normalise_rc(int rc) {
Style violation, I'd like the definition to read: int normalise_rc(int rc) { }
instead
- int res;
- res = rc;
- if (res != 0 && res != ENOENT) {
res = ENOENT;
- }
- return res;
+}
+/* log the actual rc from our code (to be used before normalising
the
rc) */
+void log_actual_rc(const char *trans_name, int rc) {
Same style violation here. I can fix these two myself before pushing provided these are the only changes we'd be doing.
thanks. (feeling ashamed...)
- char tmp[80];
- IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc,
strerror_r(rc, tmp, sizeof(tmp))));
+}
+/*. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. .
. . .*/
+/* The external interface */ +static int sss_nfs_init(void) +{
- nfs_use_mc = nfs_conf_get_bool(nfs_conf_sect, nfs_conf_use_mc,
USE_MC_DEFAULT);
- IDMAP_LOG(1, ("%s: use memcache: %i", __func__, nfs_use_mc));
- return 0;
+}
+static int sss_nfs_princ_to_ids(char *secname, char *princ, uid_t
*uid,
gid_t *gid, extra_mapping_params
**ex)
+{
- IDMAP_LOG(0, ("%s: not implemented", __func__));
- return -ENOENT;
Is ENOENT the return code NFS expects? Normally for functions that are not implemented I'd use ENOSYS..not a big deal though, I'm mostly asking..
for the same reason as normalise_rc() is needed: libnfsidmap will not proceed for the next plugin if the return code is not -ENOENT.
Thanks for the explanation, I should have read the comments more carefully.
Here is a diff I'm going to squash in when I push the patches:
diff --git a/src/sss_client/nfs/sss_nfs_client.c b/src/sss_client/nfs/sss_nfs_client.c index 64cb67a8b75ec04c1d6fa03905f5427bbe6c1e82..1f1f992af60a9cde7d1f039dd329d0d52c5fe9a3 100644 --- a/src/sss_client/nfs/sss_nfs_client.c +++ b/src/sss_client/nfs/sss_nfs_client.c @@ -407,7 +407,8 @@ static int nfs_conf_get_bool(char *sect, char *attr, int def)
- we only want to return 0 or ENOENT; otherwise libnfsidmap will stop
- translation instead of proceeding to the next translation plugin
*/ -int normalise_rc(int rc) { +int normalise_rc(int rc) +{ int res;
res = rc;
@@ -419,7 +420,8 @@ int normalise_rc(int rc) { }
/* log the actual rc from our code (to be used before normalising the rc) */ -void log_actual_rc(const char *trans_name, int rc) { +void log_actual_rc(const char *trans_name, int rc) +{ char tmp[80]; IDMAP_LOG(1, ("%s: rc=%i msg=%s", trans_name, rc, strerror_r(rc, tmp, sizeof(tmp)))); --
ACK
The private headers are needed in order to: nfsidmap_internal.h: * definition of struct trans_func * prototype for logger function cfg.h + queue.h: * prototype(s) for accessing rpc.idmpad configuration file --- src/sss_client/nfs/nfsidmap_internal.h | 78 ++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
diff --git a/src/sss_client/nfs/nfsidmap_internal.h b/src/sss_client/nfs/nfsidmap_internal.h new file mode 100644 index 0000000..a598c10 --- /dev/null +++ b/src/sss_client/nfs/nfsidmap_internal.h @@ -0,0 +1,78 @@ +/* + * nfsidmap_internal.h + * + * nfs idmapping library, primarily for nfs4 client/server kernel idmapping + * and for userland nfs4 idmapping by acl libraries. + * + * Copyright (c) 2004 The Regents of the University of Michigan. + * All rights reserved. + * + * Andy Adamson andros@umich.edu + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the University nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +char *get_default_domain(void); +struct conf_list *get_local_realms(void); + +typedef struct trans_func * (*libnfsidmap_plugin_init_t)(void); + +struct trans_func { + char *name; + int (*init)(void); + int (*princ_to_ids)(char *secname, char *princ, uid_t *uid, gid_t *gid, + extra_mapping_params **ex); + int (*name_to_uid)(char *name, uid_t *uid); + int (*name_to_gid)(char *name, gid_t *gid); + int (*uid_to_name)(uid_t uid, char *domain, char *name, size_t len); + int (*gid_to_name)(gid_t gid, char *domain, char *name, size_t len); + int (*gss_princ_to_grouplist)(char *secname, char *princ, gid_t *groups, + int *ngroups, extra_mapping_params **ex); +}; + +struct mapping_plugin { + void *dl_handle; + struct trans_func *trans; +}; + +typedef enum { + IDTYPE_USER = 1, + IDTYPE_GROUP = 2 +} idtypes; + +extern int idmap_verbosity; +extern nfs4_idmap_log_function_t idmap_log_func; +/* Level zero always prints, others print depending on verbosity level */ +#define IDMAP_LOG(LVL, MSG) \ + do { if (LVL <= idmap_verbosity) (*idmap_log_func)MSG; } while (0) + + +/* + * from libnfsidmap's cfg.h (same license as above) + * Copyright (c) 1998, 1999, 2001 Niklas Hallqvist. All rights reserved. + * Copyright (c) 2000, 2003 H�kan Olsson. All rights reserved. + */ +extern char *conf_get_str(char *, char *);
On Fri, Jun 27, 2014 at 09:44:36AM +0300, Noam Meltzer wrote:
The private headers are needed in order to: nfsidmap_internal.h:
- definition of struct trans_func
- prototype for logger function
cfg.h + queue.h:
- prototype(s) for accessing rpc.idmpad configuration file
ACK although I wish this file was packaged in some -devel RPM..
--- Makefile.am | 24 ++++++++++++++++++++++++ configure.ac | 10 ++++++++++ src/conf_macros.m4 | 30 ++++++++++++++++++++++++++++++ src/external/libnfsidmap.m4 | 17 +++++++++++++++++ 4 files changed, 81 insertions(+) create mode 100644 src/external/libnfsidmap.m4
diff --git a/Makefile.am b/Makefile.am index 83999f3..4645136 100644 --- a/Makefile.am +++ b/Makefile.am @@ -50,6 +50,7 @@ localedir = @localedir@ nsslibdir = @nsslibdir@ pamlibdir = @pammoddir@ autofslibdir = @appmodpath@ +nfslibdir = @nfsidmaplibdir@
dbpath = @dbpath@ pluginpath = @pluginpath@ @@ -566,6 +567,7 @@ dist_noinst_HEADERS = \ src/tests/cmocka/common_mock_sysdb_objects.h \ src/sss_client/ssh/sss_ssh_client.h \ src/sss_client/sudo/sss_sudo.h \ + src/sss_client/nfs/nfsidmap_internal.h \ src/lib/idmap/sss_idmap_private.h \ src/lib/sifp/sss_sifp_private.h
@@ -1920,6 +1922,28 @@ libnss_sss_la_LDFLAGS = \ -version-info 2:0:0 \ -Wl,--version-script,$(srcdir)/src/sss_client/sss_nss.exports
+if BUILD_NFS +nfslib_LTLIBRARIES = sss_nfs.la +sss_nfs_la_SOURCES = \ + src/sss_client/common.c \ + src/sss_client/nss_mc_common.c \ + src/util/io.c \ + src/util/murmurhash3.c \ + src/sss_client/nss_mc_passwd.c \ + src/sss_client/nss_mc_group.c \ + src/sss_client/nfs/sss_nfs_client.c \ + $(NULL) +sss_nfs_la_CFLAGS = $(AM_CFLAGS) +sss_nfs_la_LIBADD = \ + $(CLIENT_LIBS) \ + $(NFSIDMAP_LIBS) \ + $(NULL) +sss_nfs_la_LDFLAGS = \ + -module \ + -avoid-version \ + $(NULL) +endif + pamlib_LTLIBRARIES = pam_sss.la pam_sss_la_SOURCES = \ src/sss_client/pam_sss.c \ diff --git a/configure.ac b/configure.ac index dcf2494..4947a8e 100644 --- a/configure.ac +++ b/configure.ac @@ -85,6 +85,13 @@ AC_ARG_ENABLE([pammoddir], [AS_HELP_STRING([--enable-pammoddir], [pammoddir=$libdir/security]) AC_SUBST(pammoddir)
+#Set the NFSv4 idmapd library install path +AC_ARG_ENABLE([nfsidmaplibdir], [AS_HELP_STRING([--enable-nfsidmaplibdir], + [Where to install libnfsidmap libraries ($libdir/libnfsidmap)])], + [nfsidmaplibdir=$enableval], + [nfsidmaplibdir=$libdir/libnfsidmap]) +AC_SUBST(nfsidmaplibdir) + #Include here cause WITH_INIT_DIR requires $osname set in platform.m4 m4_include([src/external/platform.m4])
@@ -122,6 +129,8 @@ WITH_IFP WITH_CRYPTO WITH_SYSLOG WITH_SAMBA +WITH_NFS +WITH_NFS_LIB_PATH
m4_include([src/external/pkg.m4]) m4_include([src/external/libpopt.m4]) @@ -155,6 +164,7 @@ m4_include([src/external/inotify.m4]) m4_include([src/external/samba.m4]) m4_include([src/external/sasl.m4]) m4_include([src/external/configlib.m4]) +m4_include([src/external/libnfsidmap.m4])
if test x$build_config_lib = xyes; then m4_include([src/external/libaugeas.m4]) diff --git a/src/conf_macros.m4 b/src/conf_macros.m4 index 3a042a8..e8eb59e 100644 --- a/src/conf_macros.m4 +++ b/src/conf_macros.m4 @@ -674,3 +674,33 @@ AC_ARG_ENABLE([dbus-tests], [build_dbus_tests=$enableval], [build_dbus_tests=yes]) AM_CONDITIONAL([BUILD_DBUS_TESTS], [test x$build_dbus_tests = xyes]) + +AC_DEFUN([WITH_NFS], + [ AC_ARG_WITH([nfs], + [AC_HELP_STRING([--with-nfs], + [Whether to build with NFSv4 IDMAP support [yes]] + ) + ], + [with_nfs=$withval], + with_nfs=yes + ) + + if test x"$with_nfs" = xyes; then + AC_DEFINE(BUILD_NFS, 1, [whether to build with NFSv4 IDMAP support]) + fi + AM_CONDITIONAL([BUILD_NFS], [test x"$with_nfs" = xyes]) + ]) + +AC_DEFUN([WITH_NFS_LIB_PATH], + [ AC_ARG_WITH([nfs-lib-path], + [AC_HELP_STRING([--with-nfs-lib-path=<path>], + [Path to the nfs library [${libdir}]] + ) + ] + ) + nfslibpath="${libdir}" + if test x"$with_nfs_lib_path" != x; then + nfslibpath=$with_nfs_lib_path + fi + AC_SUBST(nfslibpath) + ]) diff --git a/src/external/libnfsidmap.m4 b/src/external/libnfsidmap.m4 new file mode 100644 index 0000000..5bb6d86 --- /dev/null +++ b/src/external/libnfsidmap.m4 @@ -0,0 +1,17 @@ +AC_SUBST(NFSIDMAP_OBJ) +AC_SUBST(NFSIDMAP_CFLAGS) +AC_SUBST(NFSIDMAP_LIBS) + +PKG_CHECK_MODULES([NFSIDMAP], [libnfsidmap], [found_nfsidmap=yes], + [found_nfsidmap=no]) + +SSS_AC_EXPAND_LIB_DIR() +AS_IF([test x"$with_nfs" = xyes -a x"$found_nfsidmap" != xyes], + [AC_CHECK_HEADER([nfsidmap.h], + [AC_CHECK_LIB([nfsidmap], + [nfs4_init_name_mapping], + [NFSIDMAP_LIBS="-L$sss_extra_libdir -lnfsidmap"], + [AC_MSG_ERROR([libnfsidmap missing nfs4_init_name_mapping])], + [-L$sss_extra_libdir])], + [AC_MSG_ERROR([libnfsidmap header files are not installed])])] +)
On Fri, Jun 27, 2014 at 09:44:37AM +0300, Noam Meltzer wrote:
Makefile.am | 24 ++++++++++++++++++++++++ configure.ac | 10 ++++++++++ src/conf_macros.m4 | 30 ++++++++++++++++++++++++++++++ src/external/libnfsidmap.m4 | 17 +++++++++++++++++ 4 files changed, 81 insertions(+) create mode 100644 src/external/libnfsidmap.m4
ACK
On 07/14/2014 07:30 PM, Jakub Hrozek wrote:
On Fri, Jun 27, 2014 at 09:44:37AM +0300, Noam Meltzer wrote:
Makefile.am | 24 ++++++++++++++++++++++++ configure.ac | 10 ++++++++++ src/conf_macros.m4 | 30 ++++++++++++++++++++++++++++++ src/external/libnfsidmap.m4 | 17 +++++++++++++++++ 4 files changed, 81 insertions(+) create mode 100644 src/external/libnfsidmap.m4
ACK
This commit fails CI due to missing nfsidmap.h header: http://sssd-ci.duckdns.org/logs/commit/b9/c8ce2bdd4045782c243605a1b999098bed...
A dependency should be added perhaps.
Nick
On (02/09/14 14:50), Nikolai Kondrashov wrote:
On 07/14/2014 07:30 PM, Jakub Hrozek wrote:
On Fri, Jun 27, 2014 at 09:44:37AM +0300, Noam Meltzer wrote:
Makefile.am | 24 ++++++++++++++++++++++++ configure.ac | 10 ++++++++++ src/conf_macros.m4 | 30 ++++++++++++++++++++++++++++++ src/external/libnfsidmap.m4 | 17 +++++++++++++++++ 4 files changed, 81 insertions(+) create mode 100644 src/external/libnfsidmap.m4
ACK
This commit fails CI due to missing nfsidmap.h header: http://sssd-ci.duckdns.org/logs/commit/b9/c8ce2bdd4045782c243605a1b999098bed...
A dependency should be added perhaps.
It is added in next patch "[SSSD] [PATCH v3 4/4] NFSv4 client: add to RPM spec " I don't like it, but it was external contributor. I didn't want to be picky.
LS
On 09/02/2014 02:57 PM, Lukas Slebodnik wrote:
On (02/09/14 14:50), Nikolai Kondrashov wrote:
On 07/14/2014 07:30 PM, Jakub Hrozek wrote:
On Fri, Jun 27, 2014 at 09:44:37AM +0300, Noam Meltzer wrote:
Makefile.am | 24 ++++++++++++++++++++++++ configure.ac | 10 ++++++++++ src/conf_macros.m4 | 30 ++++++++++++++++++++++++++++++ src/external/libnfsidmap.m4 | 17 +++++++++++++++++ 4 files changed, 81 insertions(+) create mode 100644 src/external/libnfsidmap.m4
ACK
This commit fails CI due to missing nfsidmap.h header: http://sssd-ci.duckdns.org/logs/commit/b9/c8ce2bdd4045782c243605a1b999098bed...
A dependency should be added perhaps.
It is added in next patch "[SSSD] [PATCH v3 4/4] NFSv4 client: add to RPM spec"
Ah, yes, was too hasty assuming if it didn't build on Debian, then it was still broken. Will send a Debian CI patch in a moment.
I don't like it, but it was external contributor. I didn't want to be picky.
Sure.
Nick
--- contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \ + --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \ @@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
%{ldb_modulesdir}/memberof.so %{_bindir}/sss_ssh_authorizedkeys
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
Otherwise ACK to your patch.
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
Otherwise ACK to your patch. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
I was wondering for a bit if we should split the plugin to a separate subpackage because of this new Requirement, but I think it's too much pain for little gain. On the vast majority of systems, libnfsidmap would be installed anyway, because it's required by nfs-utils, which provides some quite basic binaries like mount.nfs. Also, the size of the library is only about 100 kB..
On Tue, Jul 15, 2014 at 6:28 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com
wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems
not
to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the
package
that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
I agree. Can you do it while merging the code, or do you want me to send PATCHv4?
I was wondering for a bit if we should split the plugin to a separate subpackage because of this new Requirement, but I think it's too much pain for little gain. On the vast majority of systems, libnfsidmap would be installed anyway, because it's required by nfs-utils, which provides some quite basic binaries like mount.nfs. Also, the size of the library is only about 100 kB..
On Fri, Jul 18, 2014 at 05:11:31PM +0300, Noam Meltzer wrote:
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
I agree. Can you do it while merging the code, or do you want me to send PATCHv4?
No need, I can do the change, this is a trivial fix.
On (15/07/14 17:28), Jakub Hrozek wrote:
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
This requirement is automatically detected by rpm.
sh-4.2$ rpm -q --requires -p sssd-common-1.12.1-0.el6.x86_64.rpm | grep nfs libnfsidmap.so.0()(64bit)
sh-4.2$ rpm -qf /lib64/libnfsidmap.so.0 libnfsidmap-0.25-8.fc20.x86_64
sh-4.2$ rpm -q --provides libnfsidmap config(libnfsidmap) = 0.25-8.fc20 libnfsidmap = 0.25-8.fc20 libnfsidmap(x86-64) = 0.25-8.fc20 libnfsidmap.so.0()(64bit) nfs-utils-lib
I was wondering for a bit if we should split the plugin to a separate subpackage because of this new Requirement, but I think it's too much pain for little gain. On the vast majority of systems, libnfsidmap would be installed anyway, because it's required by nfs-utils, which provides some quite basic binaries like mount.nfs. Also, the size of the library is only about 100 kB..
LS
On Fri, Jul 18, 2014 at 05:02:33PM +0200, Lukas Slebodnik wrote:
On (15/07/14 17:28), Jakub Hrozek wrote:
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
This requirement is automatically detected by rpm.
sh-4.2$ rpm -q --requires -p sssd-common-1.12.1-0.el6.x86_64.rpm | grep nfs libnfsidmap.so.0()(64bit)
sh-4.2$ rpm -qf /lib64/libnfsidmap.so.0 libnfsidmap-0.25-8.fc20.x86_64
sh-4.2$ rpm -q --provides libnfsidmap config(libnfsidmap) = 0.25-8.fc20 libnfsidmap = 0.25-8.fc20 libnfsidmap(x86-64) = 0.25-8.fc20 libnfsidmap.so.0()(64bit) nfs-utils-lib
Yes, but we do depend on a filesystem path. Isn't it safer to explicitly require it?
On (18/07/14 17:07), Jakub Hrozek wrote:
On Fri, Jul 18, 2014 at 05:02:33PM +0200, Lukas Slebodnik wrote:
On (15/07/14 17:28), Jakub Hrozek wrote:
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote:
contrib/sssd.spec.in | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b5e7903..8d2f2be 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -138,6 +138,11 @@ BuildRequires: systemd-devel %if (0%{?with_cifs_utils_plugin} == 1) BuildRequires: cifs-utils-devel %endif +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) +BuildRequires: libnfsidmap-devel +%else +BuildRequires: nfs-utils-lib-devel +%endif
# RHEL 5 is too old to support samba4 and the PAC responder %if !0%{?is_rhel5} @@ -451,6 +456,7 @@ autoreconf -ivf --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \
- --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ --disable-static \ --disable-rpath \ %{?with_ccache} \
@@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT # 3rd party application libraries %{_libdir}/sssd/modules/libsss_autofs.so %{_libdir}/libsss_sudo.so +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
This requirement is automatically detected by rpm.
sh-4.2$ rpm -q --requires -p sssd-common-1.12.1-0.el6.x86_64.rpm | grep nfs libnfsidmap.so.0()(64bit)
sh-4.2$ rpm -qf /lib64/libnfsidmap.so.0 libnfsidmap-0.25-8.fc20.x86_64
sh-4.2$ rpm -q --provides libnfsidmap config(libnfsidmap) = 0.25-8.fc20 libnfsidmap = 0.25-8.fc20 libnfsidmap(x86-64) = 0.25-8.fc20 libnfsidmap.so.0()(64bit) nfs-utils-lib
Yes, but we do depend on a filesystem path. Isn't it safer to explicitly require it?
You would need to addd another if-else in spec file. The similar as with BuildRequires.
bash-4.1# rpm -ql nfs-utils-lib-1.1.5-6.el6.x86_64 /etc/idmapd.conf /usr/lib64/libnfsidmap.so.0 /usr/lib64/libnfsidmap.so.0.3.0 /usr/lib64/libnfsidmap/nsswitch.so /usr/lib64/libnfsidmap/static.so /usr/lib64/libnfsidmap/umich_ldap.so /usr/lib64/librpcsecgss.so.3 /usr/lib64/librpcsecgss.so.3.0.0 /usr/share/doc/nfs-utils-lib-1.1.5 /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24 /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/AUTHORS /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/ChangeLog /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/NEWS /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/README /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18 /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/AUTHORS /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/ChangeLog /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/NEWS /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/README /usr/share/man/man3/nfs4_uid_to_name.3.gz /usr/share/man/man5/idmapd.conf.5.gz
sh-4.2$ rpm -ql libnfsidmap-0.25-8.fc20.x86_64 /etc/idmapd.conf /lib64/libnfsidmap.so.0 /lib64/libnfsidmap.so.0.3.0 /lib64/libnfsidmap/nsswitch.so /lib64/libnfsidmap/static.so /lib64/libnfsidmap/umich_ldap.so /usr/share/doc/libnfsidmap /usr/share/doc/libnfsidmap/AUTHORS /usr/share/doc/libnfsidmap/COPYING /usr/share/doc/libnfsidmap/ChangeLog /usr/share/doc/libnfsidmap/NEWS /usr/share/doc/libnfsidmap/README /usr/share/man/man3/nfs4_uid_to_name.3.gz /usr/share/man/man5/idmapd.conf.5.gz
As you can see in both cases dynamic library $(libdir)/libnfsidmap.so.0 and directory $(libdir)libnfsidmap/ are in the same package.
If you want to add it explicitly please consider rhel6
LS
On Fri, Jul 18, 2014 at 05:20:31PM +0200, Lukas Slebodnik wrote:
On (18/07/14 17:07), Jakub Hrozek wrote:
On Fri, Jul 18, 2014 at 05:02:33PM +0200, Lukas Slebodnik wrote:
On (15/07/14 17:28), Jakub Hrozek wrote:
On Mon, Jul 14, 2014 at 10:10:59PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:30 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:38AM +0300, Noam Meltzer wrote: > --- > contrib/sssd.spec.in | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in > index b5e7903..8d2f2be 100644 > --- a/contrib/sssd.spec.in > +++ b/contrib/sssd.spec.in > @@ -138,6 +138,11 @@ BuildRequires: systemd-devel > %if (0%{?with_cifs_utils_plugin} == 1) > BuildRequires: cifs-utils-devel > %endif > +%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7)) > +BuildRequires: libnfsidmap-devel > +%else > +BuildRequires: nfs-utils-lib-devel > +%endif > > # RHEL 5 is too old to support samba4 and the PAC responder > %if !0%{?is_rhel5} > @@ -451,6 +456,7 @@ autoreconf -ivf > --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ > --enable-nsslibdir=/%{_lib} \ > --enable-pammoddir=/%{_lib}/security \ > + --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \ > --disable-static \ > --disable-rpath \ > %{?with_ccache} \ > @@ -600,6 +606,7 @@ rm -rf $RPM_BUILD_ROOT > # 3rd party application libraries > %{_libdir}/sssd/modules/libsss_autofs.so > %{_libdir}/libsss_sudo.so > +%{_libdir}/libnfsidmap/sss_nfs.so
Here I've got a question, the directory %{_libdir}/libnfsidmap seems not to be owned by any package, at least on Fedora-20, however the individual files are: $ rpm -qf /usr/lib64/libnfsidmap/ file /usr/lib64/libnfsidmap is not owned by any package $ rpm -qf /usr/lib64/libnfsidmap/nsswitch.so libnfsidmap-0.25-8.fc20.x86_64
The reason I'm curious is that initially I wanted to Require the package that owns this directory..
Do you agree this is a packaging bug of libnfsidmap ?
I agree
It's been filed for some time already: https://bugzilla.redhat.com/show_bug.cgi?id=986678
Otherwise ACK to your patch.
Actually, I think we should also add: Requires: libnfsidmap to the spec file.
This requirement is automatically detected by rpm.
sh-4.2$ rpm -q --requires -p sssd-common-1.12.1-0.el6.x86_64.rpm | grep nfs libnfsidmap.so.0()(64bit)
sh-4.2$ rpm -qf /lib64/libnfsidmap.so.0 libnfsidmap-0.25-8.fc20.x86_64
sh-4.2$ rpm -q --provides libnfsidmap config(libnfsidmap) = 0.25-8.fc20 libnfsidmap = 0.25-8.fc20 libnfsidmap(x86-64) = 0.25-8.fc20 libnfsidmap.so.0()(64bit) nfs-utils-lib
Yes, but we do depend on a filesystem path. Isn't it safer to explicitly require it?
You would need to addd another if-else in spec file. The similar as with BuildRequires.
bash-4.1# rpm -ql nfs-utils-lib-1.1.5-6.el6.x86_64 /etc/idmapd.conf /usr/lib64/libnfsidmap.so.0 /usr/lib64/libnfsidmap.so.0.3.0 /usr/lib64/libnfsidmap/nsswitch.so /usr/lib64/libnfsidmap/static.so /usr/lib64/libnfsidmap/umich_ldap.so /usr/lib64/librpcsecgss.so.3 /usr/lib64/librpcsecgss.so.3.0.0 /usr/share/doc/nfs-utils-lib-1.1.5 /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24 /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/AUTHORS /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/ChangeLog /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/NEWS /usr/share/doc/nfs-utils-lib-1.1.5/libnfsidmap-0.24/README /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18 /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/AUTHORS /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/ChangeLog /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/NEWS /usr/share/doc/nfs-utils-lib-1.1.5/librpcsecgss-0.18/README /usr/share/man/man3/nfs4_uid_to_name.3.gz /usr/share/man/man5/idmapd.conf.5.gz
sh-4.2$ rpm -ql libnfsidmap-0.25-8.fc20.x86_64 /etc/idmapd.conf /lib64/libnfsidmap.so.0 /lib64/libnfsidmap.so.0.3.0 /lib64/libnfsidmap/nsswitch.so /lib64/libnfsidmap/static.so /lib64/libnfsidmap/umich_ldap.so /usr/share/doc/libnfsidmap /usr/share/doc/libnfsidmap/AUTHORS /usr/share/doc/libnfsidmap/COPYING /usr/share/doc/libnfsidmap/ChangeLog /usr/share/doc/libnfsidmap/NEWS /usr/share/doc/libnfsidmap/README /usr/share/man/man3/nfs4_uid_to_name.3.gz /usr/share/man/man5/idmapd.conf.5.gz
As you can see in both cases dynamic library $(libdir)/libnfsidmap.so.0 and directory $(libdir)libnfsidmap/ are in the same package.
If you want to add it explicitly please consider rhel6
OK, I'm convinced. Given it's extremely unlikely the package that provides libnfsidmap (as detected by RPM) and the one that provides the directory with the plugins will be different, the Requires is not needed.
Thanks!
Hi,
Now that the master branch is ready for 1.12.1, top-posting this patchset.
- Noam
On Fri, Jun 27, 2014 at 9:44 AM, Noam Meltzer tsnoam@gmail.com wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec
Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c
-- 1.9.1
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Thanks for these changes! The patches look good with one nitpick, which I can fix locally before pushing and one packaging question. I'll ask those inline when replying to the patches themselves.
But more importantly, I have a question on testing the patches. I admit my NFS internals knowledge is quite lacking, so maybe these are basic questions..how exactly do I make sure the plugin mapping functions are called? I tried attaching gdb to rpc.idmapd and doing various operations to the file (ls, echo "foo" >> file) etc but still no luck. Disabling the sss nsswitch plugin just yields UIDs and GIDs on the client (which is
For my test, I configured a server and a client. I can mount the shares just fine, I see I'm using NFSv4 in the mount(8) output. I can see the sss plugin was loaded, because journalctl -u nfs-idmap.service says: Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: sss_nfs_init: use memcache: 1 Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: libnfsidmap: loaded plugin /lib64/libnfsidmap/sss_nfs.so for method sss_nfs
My idmapd.conf file looks quite simple: -------------------- [General] Verbosity = 2 Domain = ipa.example.com
[Mapping] Nobody-User = nfsnobody Nobody-Group = nfsnobody
[Translation] Method = sss_nfs
[Static]
[UMICH_SCHEMA] --------------------
I guess I could also ask -- where does the rpc.idmapd daemon hook into the system? When exactly are the translation functions called?
Thank you for your help.
On Mon, Jul 14, 2014 at 7:21 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Thanks for these changes! The patches look good with one nitpick, which I can fix locally before pushing and one packaging question. I'll ask those inline when replying to the patches themselves.
But more importantly, I have a question on testing the patches. I admit my NFS internals knowledge is quite lacking, so maybe these are basic questions..how exactly do I make sure the plugin mapping functions are called? I tried attaching gdb to rpc.idmapd and doing various operations to the file (ls, echo "foo" >> file) etc but still no luck. Disabling the sss nsswitch plugin just yields UIDs and GIDs on the client (which is
For my test, I configured a server and a client. I can mount the shares just fine, I see I'm using NFSv4 in the mount(8) output. I can see the sss plugin was loaded, because journalctl -u nfs-idmap.service says: Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: sss_nfs_init: use memcache: 1 Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: libnfsidmap: loaded plugin /lib64/libnfsidmap/sss_nfs.so for method sss_nfs
My idmapd.conf file looks quite simple:
[General] Verbosity = 2 Domain = ipa.example.com
[Mapping] Nobody-User = nfsnobody Nobody-Group = nfsnobody
[Translation] Method = sss_nfs
[Static]
[UMICH_SCHEMA]
I guess I could also ask -- where does the rpc.idmapd daemon hook into the system? When exactly are the translation functions called?
The idmapd.conf looks good (assuming that your LDAP domain really is ipa.example.com).
Regarding how rpc.idmapd operation: 1. There's the feature wiki: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin I'm not sure that it answers your question though. (so I'll make sure to update it following this email thread)
2. rpc.idmapd listens for events (queries) from the kernel over a named pipe. once such an event arrives, rpc.idmapd will start the mapping process using libnfsidmap. libnfsidmap on its turn will dlopen(3) the relevant plugin (sss_nfs in our case) and call the relevant functions from 'struct trans_func'.
How to test: libnfsidmap.git comes with a small C code named "libtest.c" which allows you to directly test the various function from 'struct trans_func'. I modified this code a bit to match our needs (and attached to this email). compile/link with: gcc -o libtest libtest.c -lnfsidmap
run like this: $ ./libtest noam@localdomain 0 users@localdomain 101
expected output: input: user=noam@localdomain uid=0 group=users@localdomain gid=101 nfs4_name_to_uid: username noam@localdomain has uid 1000 nfs4_name_to_gid: username users@localdomain has gid 100 nfs4_uid_to_name: uid 0 has name root@localdomain nfs4_gid_to_name: gid 101 has name libuuid@localdomain
Unfortunately, I don't have an LDAP environment at the moment to test it myself. So what you see here is the result of the default idmapd.conf running with the "nss" plugin (going to /etc/passwd ...)
Thank you for your help. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Mon, Jul 14, 2014 at 09:58:11PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:21 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Thanks for these changes! The patches look good with one nitpick, which I can fix locally before pushing and one packaging question. I'll ask those inline when replying to the patches themselves.
But more importantly, I have a question on testing the patches. I admit my NFS internals knowledge is quite lacking, so maybe these are basic questions..how exactly do I make sure the plugin mapping functions are called? I tried attaching gdb to rpc.idmapd and doing various operations to the file (ls, echo "foo" >> file) etc but still no luck. Disabling the sss nsswitch plugin just yields UIDs and GIDs on the client (which is
For my test, I configured a server and a client. I can mount the shares just fine, I see I'm using NFSv4 in the mount(8) output. I can see the sss plugin was loaded, because journalctl -u nfs-idmap.service says: Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: sss_nfs_init: use memcache: 1 Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: libnfsidmap: loaded plugin /lib64/libnfsidmap/sss_nfs.so for method sss_nfs
My idmapd.conf file looks quite simple:
[General] Verbosity = 2 Domain = ipa.example.com
[Mapping] Nobody-User = nfsnobody Nobody-Group = nfsnobody
[Translation] Method = sss_nfs
[Static]
[UMICH_SCHEMA]
I guess I could also ask -- where does the rpc.idmapd daemon hook into the system? When exactly are the translation functions called?
The idmapd.conf looks good (assuming that your LDAP domain really is ipa.example.com).
Regarding how rpc.idmapd operation:
- There's the feature wiki:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin I'm not sure that it answers your question though. (so I'll make sure to update it following this email thread)
I'm aware of the design document, but I was more interested in some user-facing documentation. Something we could give to the admins to tell them what are the benefits and how to leverage them.
- rpc.idmapd listens for events (queries) from the kernel over a named
pipe. once such an event arrives, rpc.idmapd will start the mapping process using libnfsidmap.
OK, thanks, that's very helpful, but how/when does the kernel receive the event ? How can I trigger that even as admin or a user using NFS client+server ? For instance, if you run "ls -l", is there anything more than the id->name conversion using getpwuid() ? I realize these might be basic questions, so feel free to point me to docs..
libnfsidmap on its turn will dlopen(3) the relevant plugin (sss_nfs in our case) and call the relevant functions from 'struct trans_func'.
How to test: libnfsidmap.git comes with a small C code named "libtest.c" which allows you to directly test the various function from 'struct trans_func'. I modified this code a bit to match our needs (and attached to this email). compile/link with: gcc -o libtest libtest.c -lnfsidmap
run like this: $ ./libtest noam@localdomain 0 users@localdomain 101
expected output: input: user=noam@localdomain uid=0 group=users@localdomain gid=101 nfs4_name_to_uid: username noam@localdomain has uid 1000 nfs4_name_to_gid: username users@localdomain has gid 100 nfs4_uid_to_name: uid 0 has name root@localdomain nfs4_gid_to_name: gid 101 has name libuuid@localdomain
Thank you, I will test using the program so far.
Unfortunately, I don't have an LDAP environment at the moment to test it myself. So what you see here is the result of the default idmapd.conf running with the "nss" plugin (going to /etc/passwd ...)
np, I can test with your program. Thanks again.
On Tue, Jul 15, 2014 at 06:15:43PM +0200, Jakub Hrozek wrote:
How to test: libnfsidmap.git comes with a small C code named "libtest.c" which allows you to directly test the various function from 'struct trans_func'. I modified this code a bit to match our needs (and attached to this email). compile/link with: gcc -o libtest libtest.c -lnfsidmap
run like this: $ ./libtest noam@localdomain 0 users@localdomain 101
expected output: input: user=noam@localdomain uid=0 group=users@localdomain gid=101 nfs4_name_to_uid: username noam@localdomain has uid 1000 nfs4_name_to_gid: username users@localdomain has gid 100 nfs4_uid_to_name: uid 0 has name root@localdomain nfs4_gid_to_name: gid 101 has name libuuid@localdomain
Thank you, I will test using the program so far.
Unfortunately, I don't have an LDAP environment at the moment to test it myself. So what you see here is the result of the default idmapd.conf running with the "nss" plugin (going to /etc/passwd ...)
np, I can test with your program. Thanks again.
btw this worked with a setup where "sss" was not present in the nsswitch.conf file at all, just sssd was running:
$ ./libtest admin@ipa.example.com 1832200001 admins@ipa.example.com 1832200002 input: user=admin@ipa.example.com uid=1832200001 group=admins@ipa.example.com gid=1832200002 nfs4_name_to_uid: username admin@ipa.example.com has uid 1832200000 nfs4_name_to_gid: username admins@ipa.example.com has gid 1832200000 nfs4_uid_to_name: uid 1832200001 has name tuser nfs4_gid_to_name: gid 1832200002 has name editors $ getent passwd admin@ipa.example.com $ echo $? 2
I also checked with strace that the NSS responder socket was being contacted. So now I know that the plugin does work, great!
On Tue, Jul 15, 2014 at 8:21 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Tue, Jul 15, 2014 at 06:15:43PM +0200, Jakub Hrozek wrote:
How to test: libnfsidmap.git comes with a small C code named "libtest.c" which
allows
you to directly test the various function from 'struct trans_func'. I modified this code a bit to match our needs (and attached to this
email).
compile/link with: gcc -o libtest libtest.c -lnfsidmap
run like this: $ ./libtest noam@localdomain 0 users@localdomain 101
expected output: input: user=noam@localdomain uid=0 group=users@localdomain gid=101 nfs4_name_to_uid: username noam@localdomain has uid 1000 nfs4_name_to_gid: username users@localdomain has gid 100 nfs4_uid_to_name: uid 0 has name root@localdomain nfs4_gid_to_name: gid 101 has name libuuid@localdomain
Thank you, I will test using the program so far.
Unfortunately, I don't have an LDAP environment at the moment to test
it
myself. So what you see here is the result of the default idmapd.conf running with the "nss" plugin (going to /etc/passwd ...)
np, I can test with your program. Thanks again.
btw this worked with a setup where "sss" was not present in the nsswitch.conf file at all, just sssd was running:
$ ./libtest admin@ipa.example.com 1832200001 admins@ipa.example.com 1832200002 input: user=admin@ipa.example.com uid=1832200001 group= admins@ipa.example.com gid=1832200002 nfs4_name_to_uid: username admin@ipa.example.com has uid 1832200000 nfs4_name_to_gid: username admins@ipa.example.com has gid 1832200000 nfs4_uid_to_name: uid 1832200001 has name tuser nfs4_gid_to_name: gid 1832200002 has name editors $ getent passwd admin@ipa.example.com $ echo $? 2
I also checked with strace that the NSS responder socket was being contacted. So now I know that the plugin does work, great!
Great! Just a small nitpick: "use_fully_qualified_names" is disabled in your SSSD configuration. It can be seen in the id->name replies (no domain suffix). This setting needs to be on (this is specified in the manpage in the other patchset).
Sorry for the delay in reply. Had a few busy days.
On Tue, Jul 15, 2014 at 7:15 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Mon, Jul 14, 2014 at 09:58:11PM +0300, Noam Meltzer wrote:
On Mon, Jul 14, 2014 at 7:21 PM, Jakub Hrozek jhrozek@redhat.com
wrote:
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Thanks for these changes! The patches look good with one nitpick, which I can fix locally before pushing and one packaging question. I'll ask those inline when replying to the patches themselves.
But more importantly, I have a question on testing the patches. I admit my NFS internals knowledge is quite lacking, so maybe these are basic questions..how exactly do I make sure the plugin mapping functions are called? I tried attaching gdb to rpc.idmapd and doing various
operations
to the file (ls, echo "foo" >> file) etc but still no luck. Disabling the sss nsswitch plugin just yields UIDs and GIDs on the client (which is
For my test, I configured a server and a client. I can mount the shares just fine, I see I'm using NFSv4 in the mount(8) output. I can see the sss plugin was loaded, because journalctl -u nfs-idmap.service says: Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: sss_nfs_init: use memcache: 1 Jul 14 12:01:21 master.ipa.example.com rpc.idmapd[24320]: rpc.idmapd: libnfsidmap: loaded plugin /lib64/libnfsidmap/sss_nfs.so for method sss_nfs
My idmapd.conf file looks quite simple:
[General] Verbosity = 2 Domain = ipa.example.com
[Mapping] Nobody-User = nfsnobody Nobody-Group = nfsnobody
[Translation] Method = sss_nfs
[Static]
[UMICH_SCHEMA] nk --------------------
)>
I guess I could also ask -- where does the rpc.idmapd daemon hook into the system? When exactly are the translation functions called?
The idmapd.conf looks good (assuming that your LDAP domain really is ipa.example.com).
Regarding how rpc.idmapd operation:
- There's the feature wiki:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin I'm not sure that it answers your question though. (so I'll make sure to update it following this email thread)
I'm aware of the design document, but I was more interested in some user-facing documentation. Something we could give to the admins to tell them what are the benefits and how to leverage them.
Oh, sorry. Gotcha now. Here goes: (I think it should also go to the
manpage & wiki page, what do you think?)
The sss_nfs plugin is useful on systems designated as dedicated NFS servers. Background: With NFSv4 it is required to be able to translate between usernames/groupnames sent on the wire to uid/gids and vice versa. The traditional way of achieving this is by having the OS aware of the various NFS users/groups and then retrieve the user<->uid / group<->gid information from the OS. However, that methodology poses a security concern which requires special attention. The sss_nfs plugin overcomes this issue by providing direct communication path between rpc.idmapd (+ libnfsidmap) and sssd.
- rpc.idmapd listens for events (queries) from the kernel over a named
pipe. once such an event arrives, rpc.idmapd will start the mapping
process
using libnfsidmap.
OK, thanks, that's very helpful, but how/when does the kernel receive the event ? How can I trigger that even as admin or a user using NFS client+server ? For instance, if you run "ls -l", is there anything more than the id->name conversion using getpwuid() ? I realize these might be basic questions, so feel free to point me to docs..
These are good questions. Unfortunately (for me) the answer is not well (or maybe not at all) documented. I'll try to provide a good explanation without going too much into details.
Assume a NFSv4 setup: Server = Fedora20, kernel NFS server. Client(s) = Various linuxes, other UNIXes.
On the very basic level: When a client send a GETATTR request on the wire (in a sense, similar to stat(2)), the server will perform the following operations to retrieve the info: * Read the uid/gid from the file on disk * Send a request on a well defined named-pipe requesting uid/gid to username/groupname mapping. * rpc.idmapd will receive the request and perform the mapping using libnfsidmap (and here comes the sss_nfs plugin...) * respond will be sent on a well defined named-pipe to the kernel. * kernel nfs server will send the information (the username/groupname) over the wire as strings.
Once the client receives the information over the wire it will need to translate the username/groupname back to uid/gid. The actual mechanism is out of scope for this email, but if the client is Fedora20, the NFS client will run an upcall to "/usr/sbin/request-key" to perform the translation.
Sounds simple? Now lets make it complicated: * Caching might be available both on client side and server side. * On recent linux kernels (not sure which versions), if sec=sys is used on the NFS export, there will be a short-circuit sending the uid/gid as a string over the wire (check manpage exports(5), section about sec= for more info) thus translation is not performed. * There are different NFS clients & servers: linux vs. UNIX vs. commercial NFS products (NetApp, for example). Each one implementing the NFS protocol a bit differently.
So... How to test a full system with Fedora20 client & server? Having a kerberised NFS setup is one option. However, this might be a pain in the neck to setup (if you don't have one already). A more simpler solution is to use the "sec=sys" and disable the short-circuit described above: echo N > /sys/module/nfsd/parameters/nfs4_disable_idmapping echo N > /sys/module/nfs/parameters/nfs4_disable_idmapping
If when doing "ls -l" on a directory with files, you see the permissions you expected to see, then test was successful.
libnfsidmap on its turn will dlopen(3) the relevant plugin (sss_nfs in
our
case) and call the relevant functions from 'struct trans_func'.
How to test: libnfsidmap.git comes with a small C code named "libtest.c" which allows you to directly test the various function from 'struct trans_func'. I modified this code a bit to match our needs (and attached to this
email).
compile/link with: gcc -o libtest libtest.c -lnfsidmap
run like this: $ ./libtest noam@localdomain 0 users@localdomain 101
expected output: input: user=noam@localdomain uid=0 group=users@localdomain gid=101 nfs4_name_to_uid: username noam@localdomain has uid 1000 nfs4_name_to_gid: username users@localdomain has gid 100 nfs4_uid_to_name: uid 0 has name root@localdomain nfs4_gid_to_name: gid 101 has name libuuid@localdomain
Thank you, I will test using the program so far.
Unfortunately, I don't have an LDAP environment at the moment to test it myself. So what you see here is the result of the default idmapd.conf running with the "nss" plugin (going to /etc/passwd ...)
np, I can test with your program. Thanks again.
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec
Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c
Hi,
I asked Roland Mainz (CC-ed) to help us review the patches. Some of the discussion happened off-list, but I think the final ACK should be given on the list..
On Mon, Sep 01, 2014 at 05:19:46PM +0200, Jakub Hrozek wrote:
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec
Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c
Hi,
I asked Roland Mainz (CC-ed) to help us review the patches. Some of the discussion happened off-list, but I think the final ACK should be given on the list..
It just occured to me I should attach the final version of patches that we discussed -- there were some minor changes (such as option renaming and renaming of the plugin) that happened in my fedorapeople branch.
----- Original Message -----
On Fri, Jun 27, 2014 at 09:44:34AM +0300, Noam Meltzer wrote:
Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
- rebase over rev. 8ca18752 (current master)
- remove man pages from the patch (will be sent separately)
- add new contact details for plugin author
- code style
- remove sss_nfs_make_request() wrapper
- fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec
Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c
I asked Roland Mainz (CC-ed) to help us review the patches. Some of the discussion happened off-list, but I think the final ACK should be given on the list..
Yes... the code seems to be OK... I've tested last weeks code (e.g. prior option rename&co.) in detail in combination with Linux&&Solaris and various NFSv4 server/client setups and it seems to work fine... ... r=rmainz@redhat.com for the patch series...
----
Bye, Roland
On Mon, Sep 01, 2014 at 04:35:13PM -0400, Roland Mainz wrote:
Yes... the code seems to be OK... I've tested last weeks code (e.g. prior option rename&co.) in detail in combination with Linux&&Solaris and various NFSv4 server/client setups and it seems to work fine... ... r=rmainz@redhat.com for the patch series...
Thank you for the review and testing. I pushed the patches to master: 68b608d90c716c1aa475bfcb29141bcc6286fe37 b9c8ce2bdd4045782c243605a1b999098bedcffc 4466604d78e5ffd017e69e6861f7d78242b351fb e9553c2961fa4f25b9d004a6a65b90837a13d8e1
And thanks Noam again for the contribution and patience while the patches were merged.
On Tue, Sep 2, 2014 at 12:01 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Mon, Sep 01, 2014 at 04:35:13PM -0400, Roland Mainz wrote:
Yes... the code seems to be OK... I've tested last weeks code (e.g.
prior option rename&co.) in detail in combination with Linux&&Solaris and various NFSv4 server/client setups and it seems to work fine...
... r=rmainz@redhat.com for the patch series...
Thank you for the review and testing. I pushed the patches to master: 68b608d90c716c1aa475bfcb29141bcc6286fe37 b9c8ce2bdd4045782c243605a1b999098bedcffc 4466604d78e5ffd017e69e6861f7d78242b351fb e9553c2961fa4f25b9d004a6a65b90837a13d8e1
And thanks Noam again for the contribution and patience while the patches were merged.
it's my pleasure to contribute.
now that the code is committed, I believe it's a good time to remind about the man pages for the plugin. it was previously split into a separate commit in order to bypass string commit freeze.
here's a link to the patchset: https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020389.html
----- Original Message -----
From: "Noam Meltzer" tsnoam@gmail.com To: "Development of the System Security Services Daemon" sssd-devel@lists.fedorahosted.org Cc: "Roland Mainz" rmainz@redhat.com Sent: Tuesday, September 2, 2014 12:07:20 PM Subject: Re: [SSSD] [PATCH v3 0/4] NFSv4 rpc.idmapd plugin
On Tue, Sep 2, 2014 at 12:01 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Mon, Sep 01, 2014 at 04:35:13PM -0400, Roland Mainz wrote:
Yes... the code seems to be OK... I've tested last weeks code (e.g.
prior option rename&co.) in detail in combination with Linux&&Solaris and various NFSv4 server/client setups and it seems to work fine...
... r=rmainz@redhat.com for the patch series...
Thank you for the review and testing. I pushed the patches to master: 68b608d90c716c1aa475bfcb29141bcc6286fe37 b9c8ce2bdd4045782c243605a1b999098bedcffc 4466604d78e5ffd017e69e6861f7d78242b351fb e9553c2961fa4f25b9d004a6a65b90837a13d8e1
And thanks Noam again for the contribution and patience while the patches were merged.
it's my pleasure to contribute.
now that the code is committed, I believe it's a good time to remind about the man pages for the plugin. it was previously split into a separate commit in order to bypass string commit freeze.
here's a link to the patchset: https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020389.html
Mhhh... some nitpicking after looking at https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020390.html ... 1. the manpage has an email address: -- snip -- + <refentryinfo> + <productname>sss_nfs</productname> + <orgname>Noam Meltzer, Primary Data Inc. <noam at primarydata.com> (2013-2014)</orgname> + <orgname>Noam Meltzer <tsnoam at gmail.com> (2014-)</orgname> + </refentryinfo> -- snip --
... the <email> tag can't be used within <orgname>, right ? Arguably this looks a bit like an abuse of <orgname> but I don't have an idea yet how to make it better... my DocBook books are 60km away from here...
... my first guess is that this might work (use <authorgroup> to add multiple <authors>): -- snip -- <refentryinfo> <author> <firstname>Noam</firstname> <surname>Melzer</surname> <email>noam@primarydata.com</email> <affiliation>Primary Data Inc.</affiliation> </author> </refentryinfo> -- snip -- If you don't know how to do it then I can try my luck...
2. What about adding the example idmapd.conf file we used for testing to an EXAMPLES section ?
----
Bye, Roland
On Tue, Sep 2, 2014 at 1:53 PM, Roland Mainz rmainz@redhat.com wrote:
----- Original Message -----
From: "Noam Meltzer" tsnoam@gmail.com To: "Development of the System Security Services Daemon" <
sssd-devel@lists.fedorahosted.org>
Cc: "Roland Mainz" rmainz@redhat.com Sent: Tuesday, September 2, 2014 12:07:20 PM Subject: Re: [SSSD] [PATCH v3 0/4] NFSv4 rpc.idmapd plugin
On Tue, Sep 2, 2014 at 12:01 PM, Jakub Hrozek jhrozek@redhat.com
wrote:
On Mon, Sep 01, 2014 at 04:35:13PM -0400, Roland Mainz wrote:
Yes... the code seems to be OK... I've tested last weeks code (e.g.
prior option rename&co.) in detail in combination with Linux&&Solaris
and
various NFSv4 server/client setups and it seems to work fine...
... r=rmainz@redhat.com for the patch series...
Thank you for the review and testing. I pushed the patches to master: 68b608d90c716c1aa475bfcb29141bcc6286fe37 b9c8ce2bdd4045782c243605a1b999098bedcffc 4466604d78e5ffd017e69e6861f7d78242b351fb e9553c2961fa4f25b9d004a6a65b90837a13d8e1
And thanks Noam again for the contribution and patience while the patches were merged.
it's my pleasure to contribute.
now that the code is committed, I believe it's a good time to remind
about
the man pages for the plugin. it was previously split into a separate commit in order to bypass string commit freeze.
here's a link to the patchset:
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020389.html
Mhhh... some nitpicking after looking at https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020390.html ...
- the manpage has an email address:
-- snip --
<refentryinfo>
<productname>sss_nfs</productname>
<orgname>Noam Meltzer, Primary Data Inc. <noam at
primarydata.com> (2013-2014)</orgname>
<orgname>Noam Meltzer <tsnoam at gmail.com>
(2014-)</orgname>
</refentryinfo>
-- snip --
... the <email> tag can't be used within <orgname>, right ? Arguably this looks a bit like an abuse of <orgname> but I don't have an idea yet how to make it better... my DocBook books are 60km away from here...
... my first guess is that this might work (use <authorgroup> to add multiple <authors>): -- snip --
<refentryinfo> <author> <firstname>Noam</firstname> <surname>Melzer</surname> <email>noam@primarydata.com</email> <affiliation>Primary Data Inc.</affiliation> </author> </refentryinfo> -- snip -- If you don't know how to do it then I can try my luck...
about "orgname": I wasn't familiar with DocBook before, so I took example from pam_sss.8.xml Anyhow, my goal is to provide two AUTHORS for the manpage. Since I'm no longer an employee of PrimaryData, I need to provide my current email address. However, it is important to me to give them the due credit.
However2, (to my defense) this DocBook compiles into a valid manpage...
- What about adding the example idmapd.conf file we used for testing to
an EXAMPLES section ?
sure. if you can send me the idmapd.conf you've used for testing, I'll add it to the EXAMPLES section.
Bye, Roland
-- __ . . __ (o.\ / /.o) rmainz@redhat.com __//__/ IPA/Kerberos5 team /O /==\ O\ (;O/ / \O;)
----- Original Message -----
From: "Noam Meltzer" tsnoam@gmail.com To: "Roland Mainz" rmainz@redhat.com Cc: "Development of the System Security Services Daemon" sssd-devel@lists.fedorahosted.org Sent: Tuesday, September 2, 2014 1:07:17 PM Subject: Re: sss.so idmapd plugin manual page... / was: Re: [SSSD] [PATCH v3 0/4] NFSv4 rpc.idmapd plugin
On Tue, Sep 2, 2014 at 1:53 PM, Roland Mainz rmainz@redhat.com wrote:
----- Original Message -----
From: "Noam Meltzer" tsnoam@gmail.com To: "Development of the System Security Services Daemon" <
sssd-devel@lists.fedorahosted.org>
Cc: "Roland Mainz" rmainz@redhat.com Sent: Tuesday, September 2, 2014 12:07:20 PM Subject: Re: [SSSD] [PATCH v3 0/4] NFSv4 rpc.idmapd plugin
On Tue, Sep 2, 2014 at 12:01 PM, Jakub Hrozek jhrozek@redhat.com
wrote:
On Mon, Sep 01, 2014 at 04:35:13PM -0400, Roland Mainz wrote:
Yes... the code seems to be OK... I've tested last weeks code (e.g.
prior option rename&co.) in detail in combination with Linux&&Solaris
and
various NFSv4 server/client setups and it seems to work fine...
... r=rmainz@redhat.com for the patch series...
Thank you for the review and testing. I pushed the patches to master: 68b608d90c716c1aa475bfcb29141bcc6286fe37 b9c8ce2bdd4045782c243605a1b999098bedcffc 4466604d78e5ffd017e69e6861f7d78242b351fb e9553c2961fa4f25b9d004a6a65b90837a13d8e1
And thanks Noam again for the contribution and patience while the patches were merged.
it's my pleasure to contribute.
now that the code is committed, I believe it's a good time to remind
about
the man pages for the plugin. it was previously split into a separate commit in order to bypass string commit freeze.
here's a link to the patchset:
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020389.html
Mhhh... some nitpicking after looking at https://lists.fedorahosted.org/pipermail/sssd-devel/2014-June/020390.html ...
- the manpage has an email address:
-- snip --
<refentryinfo>
<productname>sss_nfs</productname>
<orgname>Noam Meltzer, Primary Data Inc. <noam at
primarydata.com> (2013-2014)</orgname>
<orgname>Noam Meltzer <tsnoam at gmail.com>
(2014-)</orgname>
</refentryinfo>
-- snip --
... the <email> tag can't be used within <orgname>, right ? Arguably this looks a bit like an abuse of <orgname> but I don't have an idea yet how to make it better... my DocBook books are 60km away from here...
... my first guess is that this might work (use <authorgroup> to add multiple <authors>): -- snip --
<refentryinfo> <author> <firstname>Noam</firstname> <surname>Melzer</surname> <email>noam@primarydata.com</email> <affiliation>Primary Data Inc.</affiliation> </author> </refentryinfo> -- snip -- If you don't know how to do it then I can try my luck...
about "orgname": I wasn't familiar with DocBook before, so I took example from pam_sss.8.xml Anyhow, my goal is to provide two AUTHORS for the manpage. Since I'm no longer an employee of PrimaryData, I need to provide my current email address. However, it is important to me to give them the due credit.
However2, (to my defense) this DocBook compiles into a valid manpage...
No need to defent yourself... it needs a lot of time to learn to get it right... ;-/
This should work: -- snip -- <refentryinfo> <authorgroup>
<author> <firstname>Noam</firstname> <surname>Melzer</surname> <email>noam@primarydata.com</email> <affiliation><orgname>Primary Data Inc.</orgname></affiliation> <contrib>Developer (2013-2014)</contrib> </author>
<author> <firstname>Noam</firstname> <surname>Melzer</surname> <email>tsnoam@gmail.com</email> <contrib>Developer (2014-)</contrib> </author>
</authorgroup> </refentryinfo> -- snip --
After a... -- snip -- $/usr/bin/xsltproc /usr/share/xml/docbook/stylesheet/nwalsh5/1.75.1/manpages/docbook.xsl x.xml ; echo $? Note: namesp. add : added namespace before processing SSSD Manual pages Note: Writing sss_rpcidmapd.5 0 -- snip --
... it looks like this:
-- snip -- $ TERM=tty man ./sss_rpcidmapd.5 | grep -C 8 -i -F 'auth'
The attribute “use_fully_qualified_names” must be enabled on all domains (NFSv4 clients expect a fully qualified name to be sent on the wire).
SEE ALSO sssd(8), idmapd.conf(5)
AUTHORS Noam Melzer noam@primarydata.com Primary Data Inc. Developer (2013-2014)
Noam Melzer tsnoam@gmail.com Developer (2014-)
-- snip --
... and "yes" ... I know... I'm cheating... I dumped the date into the wrong tag because lunch is approaching... ;-)
- What about adding the example idmapd.conf file we used for testing to
an EXAMPLES section ?
sure. if you can send me the idmapd.conf you've used for testing, I'll add it to the EXAMPLES section.
Sure... I send it to you off-list once the archived test VM is running again.... ~20mins...
----
Bye, Roland
sssd-devel@lists.fedorahosted.org