From: Olga Kornievskaia Date: Mon, 16 Nov 2009 14:44:03 +0000 (-0500) Subject: gssd: process service= attribute in new upcall X-Git-Tag: nfs-utils-1-2-2-rc1 X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=commitdiff_plain;h=dd31301d485b4244b1b35049f6917df907997da9;hp=dd31301d485b4244b1b35049f6917df907997da9 gssd: process service= attribute in new upcall Add processing of the "service=" attribute in the new gssd upcall. If "service" is specified, then the kernel is indicating that we must use machine credentials for this request. (Regardless of the uid value or the setting of root_uses_machine_creds.) If the service value is "*", then any service name can be used. Otherwise, it specifies the service name that should be used. (For now, the values of service will only be "*" or "nfs".) Restricting gssd to use "nfs" service name is needed for when the NFS server is doing a callback to the NFS client. In this case, the NFS server has to authenticate itself as "nfs" -- even if there are other service keys such as "host" or "root" in the keytab. Another case when the kernel may specify the service attribute is when gssd is being asked to create the context for a SETCLIENT_ID operation. In this case, machine credentials must be used for the authentication. However, the service name used for this case is not important. Signed-off-by: Olga Kornievskaia Signed-off-by: Kevin Coffman Signed-off-by: Steve Dickson ---