Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #69783 > unrolled thread
| Started by | Joachim Falk <joachim.falk@gmx.de> |
|---|---|
| First post | 2021-03-11 19:40 +0100 |
| Last post | 2022-12-06 17:00 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.kernel
Bug#985000: nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC) Joachim Falk <joachim.falk@gmx.de> - 2021-03-11 19:40 +0100
Bug#985000: nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC) Salvatore Bonaccorso <carnil@debian.org> - 2021-09-14 18:30 +0200
Bug#985000: marked as done (nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC)) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-12-06 17:00 +0100
| From | Joachim Falk <joachim.falk@gmx.de> |
|---|---|
| Date | 2021-03-11 19:40 +0100 |
| Subject | Bug#985000: nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC) |
| Message-ID | <BRyo2-6if-3@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Package: nfs-common
Version: 1:1.3.4-5
Severity: important
Tags: patch
X-Debbugs-Cc: joachim.falk@gmx.de, felix.lechner@lease-up.com
To fix this problem, the auth_rpcgss kernel module must only be loaded
if it is not already loaded. Otherwise, the auth-rpcgss-module service
will fail inside a Linux container as the loading of kernel modules is
forbidden for the container. Thus, the "/sbin/modprobe -q auth_rpcgss"
call will fail even if the auth_rpcgss kernel module was already loaded.
This has been testesd with kmod up to version 28-1 (current in bullseye
as of 2021-03-11). This situation occurs when the container host already
loaded the auth_rpcgss kernel module to enable kerberized NFS service
for its containers.
-- Package-specific info:
-- rpcinfo --
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100005 1 udp 40401 mountd
100005 1 tcp 58455 mountd
100005 2 udp 49124 mountd
100005 2 tcp 60609 mountd
100005 3 udp 47861 mountd
100005 3 tcp 51113 mountd
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 3 tcp 2049
100003 3 udp 2049 nfs
100227 3 udp 2049
100021 1 udp 47640 nlockmgr
100021 3 udp 47640 nlockmgr
100021 4 udp 47640 nlockmgr
100021 1 tcp 33781 nlockmgr
100021 3 tcp 33781 nlockmgr
100021 4 tcp 33781 nlockmgr
-- /etc/default/nfs-common --
SMNOTIFYARGS=""
RPCIDMAPDARGS=""
NEED_STATD=
STATDOPTS=
NEED_IDMAPD=
NEED_GSSD=
RPCGSSDOPTS=
-- /etc/idmapd.conf --
[General]
Verbosity = 0
Pipefs-Directory = /run/rpc_pipefs
Domain = jfalk.de
Local-Realms = JFAD.JFALK.DE
[Mapping]
Nobody-User = nobody
Nobody-Group = nogroup
-- /etc/fstab --
nfs.jfalk.de:/home /home nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
nfs.jfalk.de:/local /local nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
nfs.jfalk.de:/opt /opt nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
nfs.jfalk.de:/bulk-data /bulk-data nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
-- System Information:
Debian Release: bullseye/sid
APT prefers testing
APT policy: (520, 'testing'), (500, 'testing-security')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.19.0-14-amd64 (SMP w/16 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nfs-common depends on:
ii adduser 3.118
ii keyutils 1.6.1-2
ii libc6 2.31-9
ii libcap2 1:2.44-1
ii libcom-err2 1.46.1-1
ii libdevmapper1.02.1 2:1.02.175-2.1
ii libevent-2.1-7 2.1.12-stable-1
ii libgssapi-krb5-2 1.18.3-4
ii libkeyutils1 1.6.1-2
ii libkrb5-3 1.18.3-4
ii libmount1 2.36.1-7
ii libnfsidmap2 0.25-6
ii libtirpc3 1.3.1-1
ii libwrap0 7.6.q-31
ii lsb-base 11.1.0
ii rpcbind 1.2.5-9
ii ucf 3.0043
Versions of packages nfs-common recommends:
pn python <none>
Versions of packages nfs-common suggests:
pn open-iscsi <none>
pn watchdog <none>
Versions of packages nfs-kernel-server depends on:
ii keyutils 1.6.1-2
ii libblkid1 2.36.1-7
ii libc6 2.31-9
ii libcap2 1:2.44-1
ii libsqlite3-0 3.34.1-3
ii libtirpc3 1.3.1-1
ii libwrap0 7.6.q-31
ii lsb-base 11.1.0
ii netbase 6.2
ii ucf 3.0043
-- no debconf information
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2021-09-14 18:30 +0200 |
| Message-ID | <CXjtL-6x4-7@gated-at.bofh.it> |
| In reply to | #69783 |
Hi Joachim, On Thu, Mar 11, 2021 at 07:37:17PM +0100, Joachim Falk wrote: > Package: nfs-common > Version: 1:1.3.4-5 > Severity: important > Tags: patch > X-Debbugs-Cc: joachim.falk@gmx.de, felix.lechner@lease-up.com > > To fix this problem, the auth_rpcgss kernel module must only be loaded > if it is not already loaded. Otherwise, the auth-rpcgss-module service > will fail inside a Linux container as the loading of kernel modules is > forbidden for the container. Thus, the "/sbin/modprobe -q auth_rpcgss" > call will fail even if the auth_rpcgss kernel module was already loaded. > This has been testesd with kmod up to version 28-1 (current in bullseye > as of 2021-03-11). This situation occurs when the container host already > loaded the auth_rpcgss kernel module to enable kerberized NFS service > for its containers. With the nfs-utils upload to experimental happened and rebasing to 2.5.4 we want to as less as needed diverge from upstream. Can you please report your case upstream and make sure the patch is accepted upstream? 1:1.3.4-6 in the end was too much with Debian keep it maintainable and made it hard to upgrade. Regards, Salvatore
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2022-12-06 17:00 +0100 |
| Subject | Bug#985000: marked as done (nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC)) |
| Message-ID | <FzIwq-8Odm-31@gated-at.bofh.it> |
| In reply to | #69783 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Tue, 06 Dec 2022 15:50:49 +0000 with message-id <E1p2aDZ-00DTLB-5H@fasolo.debian.org> and subject line Bug#985000: fixed in nfs-utils 1:2.6.2-3 has caused the Debian Bug report #985000, regarding nfs-common: auth-rpcgss-module.service fails inside Linux containers (LXC) to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 985000: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985000 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web