^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) =============
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) NFS ID Mapper
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) =============
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) Id mapper is used by NFS to translate user and group ids into names, and to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) translate user and group names into ids. Part of this translation involves
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) performing an upcall to userspace to request the information. There are two
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) ways NFS could obtain this information: placing a call to /sbin/request-key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) or by placing a call to the rpc.idmap daemon.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) NFS will attempt to call /sbin/request-key first. If this succeeds, the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) result will be cached using the generic request-key cache. This call should
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) only fail if /etc/request-key.conf is not configured for the id_resolver key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) type, see the "Configuring" section below if you wish to use the request-key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) method.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) If the call to /sbin/request-key fails (if /etc/request-key.conf is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) configured with the id_resolver key type), then the idmapper will ask the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) legacy rpc.idmap daemon for the id mapping. This result will be stored
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) in a custom NFS idmap cache.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) Configuring
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) ===========
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) The file /etc/request-key.conf will need to be modified so /sbin/request-key can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) direct the upcall. The following line should be added:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) ``#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) ``#====== ======= =============== =============== ===============================``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) ``create id_resolver * * /usr/sbin/nfs.idmap %k %d 600``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) This will direct all id_resolver requests to the program /usr/sbin/nfs.idmap.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) The last parameter, 600, defines how many seconds into the future the key will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) expire. This parameter is optional for /usr/sbin/nfs.idmap. When the timeout
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) is not specified, nfs.idmap will default to 600 seconds.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) id mapper uses for key descriptions::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) uid: Find the UID for the given user
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) gid: Find the GID for the given group
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) user: Find the user name for the given UID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) group: Find the group name for the given GID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) You can handle any of these individually, rather than using the generic upcall
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) program. If you would like to use your own program for a uid lookup then you
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) would edit your request-key.conf so it look similar to this:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) ``#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) ``#====== ======= =============== =============== ===============================``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) ``create id_resolver uid:* * /some/other/program %k %d 600``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) ``create id_resolver * * /usr/sbin/nfs.idmap %k %d 600``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) Notice that the new line was added above the line for the generic program.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) request-key will find the first matching line and corresponding program. In
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) this case, /some/other/program will handle all uid lookups and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) /usr/sbin/nfs.idmap will handle gid, user, and group lookups.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) See Documentation/security/keys/request-key.rst for more information
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) about the request-key function.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) nfs.idmap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) =========
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) nfs.idmap is designed to be called by request-key, and should not be run "by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) hand". This program takes two arguments, a serialized key and a key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) description. The serialized key is first converted into a key_serial_t, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) then passed as an argument to keyctl_instantiate (both are part of keyutils.h).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) The actual lookups are performed by functions found in nfsidmap.h. nfs.idmap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) determines the correct function to call by looking at the first part of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) description string. For example, a uid lookup description will appear as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) "uid:user@domain".
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) nfs.idmap will return 0 if the key was instantiated, and non-zero otherwise.
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags