summaryrefslogtreecommitdiffstats
path: root/fs/nfs/nfs4client.c
diff options
context:
space:
mode:
authorChuck Lever <chuck.lever@oracle.com>2013-03-16 20:56:20 +0100
committerTrond Myklebust <Trond.Myklebust@netapp.com>2013-03-29 20:45:22 +0100
commit4edaa308888b4bd629fa025cc6d5b2bf1a2a51db (patch)
tree0b98de1389a22bea9f12f698f848b7cb63424f1c /fs/nfs/nfs4client.c
parentNFS: Try AUTH_UNIX when PUTROOTFH gets NFS4ERR_WRONGSEC (diff)
downloadlinux-4edaa308888b4bd629fa025cc6d5b2bf1a2a51db.tar.xz
linux-4edaa308888b4bd629fa025cc6d5b2bf1a2a51db.zip
NFS: Use "krb5i" to establish NFSv4 state whenever possible
Currently our client uses AUTH_UNIX for state management on Kerberos NFS mounts in some cases. For example, if the first mount of a server specifies "sec=sys," the SETCLIENTID operation is performed with AUTH_UNIX. Subsequent mounts using stronger security flavors can not change the flavor used for lease establishment. This might be less security than an administrator was expecting. Dave Noveck's migration issues draft recommends the use of an integrity-protecting security flavor for the SETCLIENTID operation. Let's ignore the mount's sec= setting and use krb5i as the default security flavor for SETCLIENTID. If our client can't establish a GSS context (eg. because it doesn't have a keytab or the server doesn't support Kerberos) we fall back to using AUTH_NULL. For an operation that requires a machine credential (which never represents a particular user) AUTH_NULL is as secure as AUTH_UNIX. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs/nfs/nfs4client.c')
-rw-r--r--fs/nfs/nfs4client.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 17b34b2da2df..bb9789ef1d49 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -199,7 +199,7 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
clp->rpc_ops = &nfs_v4_clientops;
__set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
- error = nfs_create_rpc_client(clp, timeparms, authflavour);
+ error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_GSS_KRB5I);
if (error < 0)
goto error;