-<?xml version='1.0' encoding='UTF-8'?>
-<!-- This document was created with Syntext Serna Free. --><chapter xmlns="http://docbook.org/ns/docbook" xmlns:xl="http://www.w3.org/1999/xlink" version="5.0" xml:lang="en-US" xml:id="lustreprogramminginterfaces">
- <title xml:id="lustreprogramminginterfaces.title">Lustre Programming Interfaces</title>
- <para>This chapter describes public programming interfaces to control various aspects of Lustre from userspace. These interfaces are generally not guaranteed to remain unchanged over time, although we will make an effort to notify the user community well in advance of major changes. This chapter includes the following section:</para>
+<?xml version='1.0' encoding='UTF-8'?><chapter xmlns="http://docbook.org/ns/docbook" xmlns:xl="http://www.w3.org/1999/xlink" version="5.0" xml:lang="en-US" xml:id="lustreprogramminginterfaces">
+ <title xml:id="lustreprogramminginterfaces.title">Programming Interfaces</title>
+ <para>This chapter describes public programming interfaces to that can be
+ used to control various aspects of a Lustre file system from userspace.
+ This chapter includes the following sections:</para>
<itemizedlist>
<listitem>
- <para><xref linkend="dbdoclet.50438291_32926"/></para>
+ <para><xref linkend="dbdoclet.identity_upcall"/></para>
</listitem>
<listitem>
- <para><xref linkend="dbdoclet.50438291_73963"/></para>
+ <para><xref linkend="dbdoclet.perm_downcall_data"/></para>
</listitem>
</itemizedlist>
<note>
<para>Lustre programming interface man pages are found in the <literal>lustre/doc</literal> folder.</para>
</note>
- <section xml:id="dbdoclet.50438291_32926">
- <title><indexterm><primary>programming</primary><secondary>upcall</secondary></indexterm>User/Group Cache Upcall</title>
- <para>This section describes user and group upcall.</para>
+ <section xml:id="dbdoclet.identity_upcall">
+ <title><indexterm>
+ <primary>programming</primary>
+ <secondary>upcall</secondary>
+ </indexterm>User/Group Upcall</title>
+ <para>This section describes the supplementary user/group upcall, which
+ allows the MDS to retrieve and verify the supplementary groups to which
+ a particular user is assigned. This avoids the need to pass all the
+ supplementary groups from the client to the MDS with every RPC.</para>
<note>
- <para>For information on a universal UID/GID, see <xref linkend="dbdoclet.50438261_19503"/>.</para>
+ <para>For information about universal UID/GID requirements in a Lustre
+ file system environment, see
+ <xref xmlns:xlink="http://www.w3.org/1999/xlink"
+ linkend="section_rh2_d4w_gk"/>.</para>
</note>
<section remap="h3">
- <title>Name</title>
- <para>Use <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_upcall</literal> to look up a given user's group membership.</para>
+ <title>Synopsis</title>
+ <para>The MDS uses the utility as specified by
+ <literal>lctl get_param mdt.${FSNAME}-MDT{xxxx}.identity_upcall</literal>
+ to look up the supplied UID in order to retrieve the user's supplementary
+ group membership. The result is temporarily cached in the kernel (for
+ five minutes, by default) to avoid the overhead of calling into
+ userspace repeatedly.</para>
</section>
<section remap="h3">
<title>Description</title>
- <para>The group upcall file contains the path to an executable that, when installed, is invoked to resolve a numeric UID to a group membership list. This utility should complete the <literal>mds_grp_downcall_data</literal> data structure (see <xref linkend="dbdoclet.50438291_33759"/>) and write it to the <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_info</literal> pseudo-file.</para>
- <para>For a sample upcall program, see <literal>lustre/utils/l_getgroups.c</literal> in the Lustre source distribution.</para>
+ <para>The <literal>identity_upcall</literal> parameter contains the path
+ to an executable that is run to map a numeric UID to a group membership
+ list. This upcall executable opens the
+ <literal>mdt.${FSNAME}-MDT{xxxx}.identity_info</literal> parameter file
+ and writes the related <literal>identity_downcall_data</literal> data
+ structure (see <xref linkend="dbdoclet.perm_downcall_data"/>). The
+ upcall is configured with
+ <literal>lctl set_param mdt.${FSNAME}-MDT{xxxx}.identity_upcall</literal>.</para>
+ <para>The default identity upcall program installed is
+ <literal>lustre/utils/l_getidentity.c</literal> in the Lustre source
+ distribution.</para>
<section remap="h4">
<title>Primary and Secondary Groups</title>
- <para>The mechanism for the primary/secondary group is as follows:</para>
+ <para>The mechanism for the primary/secondary group is as follows:
+ </para>
<itemizedlist>
<listitem>
- <para>The MDS issues an upcall (set per MDS) to map the numeric UID to the supplementary group(s).</para>
+ <para>The MDS issues an upcall (set per MDS) to map the numeric
+ UID to the supplementary group(s).</para>
</listitem>
<listitem>
- <para>If there is no upcall or if there is an upcall and it fails, supplementary groups will be added as supplied by the client (as they are now).</para>
+ <para>If there is no upcall or if there is an upcall and it fails,
+ one supplementary group at most will be added as supplied by the
+ client.</para>
</listitem>
<listitem>
- <para>The default upcall is <literal>/usr/sbin/l_getidentity</literal>, which can interact with the user/group database to obtain UID/GID/suppgid. The user/group database depends on authentication configuration, and can be local <literal>/etc/passwd</literal>, NIS, LDAP, etc. If necessary, the administrator can use a parse utility to set <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_upcall</literal>. If the upcall interface is set to NONE, then upcall is disabled. The MDS uses the UID/GID/suppgid supplied by the client.</para>
+ <para>The default upcall <literal>/usr/sbin/l_getidentity</literal>
+ can interact with the user/group database on the MDS to map the
+ UID to the GID and supplementary GID. The user/group database
+ depends on how authentication is configured on the MDS, such as
+ local <literal>/etc/passwd</literal>, Network Information Service
+ (NIS), Lightweight Directory Access Protocol (LDAP), or SMB
+ Domain services, as configured. If the upcall interface is set
+ to NONE, then upcall is disabled, and the MDS uses only the UID,
+ GID, and one supplementary GID supplied by the client.</para>
</listitem>
<listitem>
- <para>The default group upcall is set by mkfs.lustre. Use <literal>tunefs.lustre --param</literal> or <literal>echo{path}>/proc/fs/lustre/mds/{mdsname}/group_upcall</literal></para>
+ <para>The MDS will wait a limited time for the group upcall program
+ to complete, to avoid MDS threads and clients hanging due to
+ errors accessing a remote service node. The upcall must finish
+ within 30s before the MDS will continue without the supplementary
+ data. The upcall timeout can be set on the MDS using:
+ <literal>lctl set_param mdt.*.identity_acquire_expire=<replaceable>seconds</replaceable></literal></para>
</listitem>
<listitem>
- <para>The Lustre administrator can specify permissions for a specific UID by configuring <literal>/etc/lustre/perm.conf</literal> on the MDS. As commented in <literal>lustre/utils/l_getidentity.c</literal></para>
+ <para>The default group upcall is set permanently by
+ <literal>mkfs.lustre</literal>. To set a custom upcall for a
+ particular filesystem, use
+ <literal>tunefs.lustre --param</literal> or
+ <literal>lctl set_param -P mdt.<replaceable>FSNAME</replaceable>-MDT<replaceable>xxxx</replaceable>.identity_upcall=<replaceable>path</replaceable></literal></para>
</listitem>
- </itemizedlist>
- <screen>
-/*
-* permission file format is like this:
-* {nid} {uid} {perms}
-*
-* '*' nid means any nid
-* '*' uid means any uid
-* the valid values for perms are:
-* setuid/setgid/setgrp/rmtacl -- enable corresponding perm
-* nosetuid/nosetgid/nosetgrp/normtacl -- disable corresponding perm
-* they can be listed together, seperated by ',',
-* when perm and noperm are in the same line (item), noperm is preferential,
-* when they are in different lines (items), the latter is preferential,
-* '*' nid is as default perm, and is not preferential.*/</screen>
- <para>Currently, <literal>rmtacl/normtacl</literal> can be ignored (part of security functionality), and used for remote clients. The /usr/sbin/l_getidentity utility can parse <literal>/etc/lustre/perm.conf</literal> to obtain permission mask for specified UID.</para>
- <itemizedlist>
<listitem>
- <para> To avoid repeated upcalls, the MDS caches supplemental group information. Use <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_expire</literal> to set the cache time (default is 600 seconds). The kernel waits for the upcall to complete (at most, 5 seconds) and takes the "failure" behavior as described. Set the wait time in <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_acquire_expire</literal> (default is 15 seconds). Cached entries are flushed by writing to <literal>/proc/fs/lustre/mdt/${FSNAME}-MDT{xxxx}/identity_flush</literal>.</para>
+ <para>The group downcall data is cached by the kernel to avoid
+ repeated upcalls for the same user slowing down the MDS. This
+ cache is expired from the kernel after 1200s (20 minutes) by
+ default. The cache age can be set on the MDS using:
+ <literal>lctl set_param mdt.*.identity_expire=<replaceable>seconds</replaceable></literal></para>
</listitem>
</itemizedlist>
</section>
</section>
- <section remap="h3">
- <title>Parameters</title>
- <itemizedlist>
- <listitem>
- <para> Name of the MDS service</para>
- </listitem>
- <listitem>
- <para> Numeric UID</para>
- </listitem>
- </itemizedlist>
- </section>
- <section xml:id="dbdoclet.50438291_33759">
+ <section xml:id="dbdoclet.perm_downcall_data">
<title>Data Structures</title>
- <screen>struct identity_downcall_data {
- __u32 idd_magic;
- __u32 idd_err;
- __u32 idd_uid;
- __u32 idd_gid;
- __u32 idd_nperms;
- struct perm_downcall_data idd_perms[N_PERMS_MAX];
- __u32 idd_ngroups;
- __u32 idd_groups[0];
-};</screen>
- </section>
- </section>
- <section xml:id="dbdoclet.50438291_73963">
- <title><indexterm><primary>programming</primary><secondary>l_getgroups</secondary></indexterm><literal>l_getgroups</literal> Utility</title>
- <para>The <literal>l_getgroups</literal> utility handles Lustre user/group cache upcall.</para>
- <section remap="h5">
- <title>Synopsis</title>
- <screen>l_getgroups [-v] [-d|mdsname] uid]
-l_getgroups [-v] -s</screen>
- </section>
- <section remap="h5">
- <title>Description</title>
- <para>The group upcall file contains the path to an executable that, when properly installed, is invoked to resolve a numeric UID to a group membership list. This utility should complete the <literal>mds_grp_downcall_data</literal> data structure (see Data structures) and write it to the <literal>/proc/fs/lustre/mds/mds-service/group_info</literal> pseudo-file.</para>
- <para>l_getgroups is the reference implementation of the user/group cache upcall.</para>
- </section>
- <section remap="h5">
- <title>Files</title>
- <para><literal>/proc/fs/lustre/mds/mds-service/group_upcall</literal></para>
+ <screen>struct perm_downcall_data {
+ __u64 pdd_nid;
+ __u32 pdd_perm;
+ __u32 pdd_padding;
+};
+
+struct identity_downcall_data{
+ __u32 idd_magic;
+ :
+ :</screen>
</section>
</section>
</chapter>
git://git.whamcloud.com / doc / manual.git / blobdiff