From f28a7a33a8254fc25c8cb348f87a0c133286393f Mon Sep 17 00:00:00 2001 From: Sebastien Buisson Date: Mon, 3 Jun 2024 13:52:20 +0200 Subject: [PATCH] LU-17899 gss: lsvcgss service fix The lsvcgss service can fail to start if the daemon is invoked with the '-k' option whereas no proper Kerberos configuration is in place on the server. The daemon should ignore the '-k' option is such case and try to start the other provided modes if any (SSK, Null). And in case the daemon is started with the '-s' option (SSK), it spawns a temporary additional thread to compute the number of rounds used for Miller-Rabin prime testing. So the lsvcgss_sysd script should support that. Fixes: c6878334a1 ("LU-17741 gss: fix lsvcgss service for systemd") Signed-off-by: Sebastien Buisson Change-Id: Iba632bd0ea9696ccea52bff5982a4d4e490597a7 Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/55293 Tested-by: jenkins Tested-by: Maloo Reviewed-by: James Simmons Reviewed-by: Jian Yu Reviewed-by: Oleg Drokin --- lustre/scripts/lsvcgss_sysd | 2 +- lustre/utils/gss/svcgssd.c | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/lustre/scripts/lsvcgss_sysd b/lustre/scripts/lsvcgss_sysd index 0eec92a..810931a 100644 --- a/lustre/scripts/lsvcgss_sysd +++ b/lustre/scripts/lsvcgss_sysd @@ -17,6 +17,6 @@ LSVCGSSDARGS="-k -s -z" /usr/sbin/lsvcgssd ${LSVCGSSDARGS} RETVAL=$? -[ $RETVAL -eq 0 ] && echo $(pidof lsvcgssd) > $PIDFILE +[ $RETVAL -eq 0 ] && echo $(pidof -s lsvcgssd) > $PIDFILE exit $RETVAL diff --git a/lustre/utils/gss/svcgssd.c b/lustre/utils/gss/svcgssd.c index a2c69fc..4711a49 100644 --- a/lustre/utils/gss/svcgssd.c +++ b/lustre/utils/gss/svcgssd.c @@ -304,13 +304,14 @@ main(int argc, char *argv[]) if (gssd_check_mechs()) { printerr(LL_ERR, "ERROR: problem with gssapi library\n"); - exit(1); + ret = -1; + goto err_krb; } ret = gss_get_realm(realm); if (ret) { printerr(LL_ERR, "ERROR: no Kerberos realm: %s\n", error_message(ret)); - exit(1); + goto err_krb; } printerr(LL_WARN, "Kerberos realm: %s\n", krb5_this_realm); if (get_creds && @@ -320,7 +321,16 @@ main(int argc, char *argv[]) "unable to obtain root (machine) credentials\n"); printerr(LL_ERR, "do you have a keytab entry for /@ in /etc/krb5.keytab?\n"); - exit(1); + ret = -1; + goto err_krb; + } + +err_krb: + if (ret) { + krb_enabled = 0; + printerr(LL_ERR, "ERROR: disabling Kerberos support\n"); + if (!sk_enabled && !krb_enabled && !null_enabled) + exit(EXIT_FAILURE); } } -- 1.8.3.1