gssd: suppress error message if rpc_pipefs dir disappears.

It is possible for a race to cause a name to appear when an rpc_pipefs
dir is scanned but to no longer be present when we try to open it.

So if the error is ENOENT, don't complain.

This is similar to

commit 5ac9bcfd820f09af4d3f87f1f7346d896f70bc9a
Author: David Jeffery <djeffery@redhat.com>
Date:   Wed Jan 16 15:21:55 2013 -0500

    rpc.idmapd: Ignore open failures in dirscancb()

	which addressed a similar issue in idmapd.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
exports.man: quote command to preserve space

Signed-off-by: Jim Rees <rees@umich.edu>
Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: insecure/secure should be a secinfo_flag

The 'insecure' flag is listed in /proc/fs/nfsd/export_features
in newer kernels as being a secinfo_flag, however it is not
displayed by secinfo_show.

This patch fixes that, and sets up a framework which should make
it easy to add new flags to /proc/fs/nfsd/export_features and have
them be displayed properly.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfsiostat: periodically flush stdout

In a shell script, when nfsiostat is run in the background with
stdout redirected to a file, flush stdout periodically to ensure
that we do not lose the buffered output if the nfsiostat process
is killed.

Signed-off-by: Harshula Jayasuriya <harshula@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mountstats: Make mountstats Python 3 compatible

This will make mountstat run on Python 2.6, 2.7 and >= 3.0

Signed-off-by: Bohuslav Kabrda <bkabrda@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfs-iostat: Make Python 3 compatible

This will make nfs-iostat run on Python 2.6, 2.7 and >= 3.0

Signed-off-by: Bohuslav Kabrda <bkabrda@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
gssd: fix strncmp bug causing client removals

From: "J. Bruce Fields" <bfields@redhat.com>

Both dirname and pdir are null-terminated strings, so there's no reason
I can see for the strncmp.

And this gives the wrong result when comparing the "nfsd" and "nfsd4_cb"
directories!  The results were callback clients being removed
immediately after creation, when lack of a client with the corresponding
name under "nfsd" lead gssd to believe it had disappeared from
"nfsd4_cb".

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
gssd: don't use tgtname to find our keytab

From: "J. Bruce Fields" <bfields@redhat.com>

The tgtname is of the form service@hostname.  It's not a hostname, and
attempting to look it up here just causes failure of any upcall with a
"target=" field (currently, any upcall on behalf of an nfsv4.0
callback).

I think the theory was that knowning that target= name might help pick
the right keytab, but I don't really know if that's helpful.  For now,
just stop trying to do this.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
gssd: don't use tgtname to find our keytab

From: "J. Bruce Fields" <bfields@redhat.com>

The tgtname is of the form service@hostname.  It's not a hostname, and
attempting to look it up here just causes failure of any upcall with a
"target=" field (currently, any upcall on behalf of an nfsv4.0
callback).

I think the theory was that knowning that target= name might help pick
the right keytab, but I don't really know if that's helpful.  For now,
just stop trying to do this.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: Fix the default authentication flavour setting

Commit 11ba3b1e01b67b7d19f26fba94fabdb60878e809 (Add a default flavor
to an export's e_secinfo list) breaks the ordering of security flavours
in the secinfo list, by reordering 'sec=sys' to always be the first
secinfo flavour if one fails to set a default 'sec' setting.

An export of the form:

/export -sync,no_subtree_check,mp \
           192.168.1.0/24(sec=krb5p:krb5i:krb5,rw,sec=sys,ro)

ends up getting translated by exportfs into the following entry in
/var/lib/nfs/etab:

/export	192.168.1.0/24(ro,sync,wdelay,hide,nocrossmnt,\
                       secure,root_squash,no_all_squash,\
		       no_subtree_check,secure_locks,acl,\
		       mountpoint,anonuid=65534,anongid=65534,\
		       sec=sys,ro,root_squash,no_all_squash,\
		       sec=krb5p:krb5i:krb5,rw,root_squash,no_all_squash)

Note how the 'sec=sys' is now listed first...

The fix is to defer adding the default flavour until the call to
secinfo_show, when we can see if it is even needed at all.
With the patch, the above export is now correctly entered in
/var/lib/nfs/etab as:

/export	192.168.1.0/24(ro,sync,wdelay,hide,nocrossmnt,\
			secure,root_squash,no_all_squash,\
			no_subtree_check,secure_locks,acl,\
			mountpoint,anonuid=65534,anongid=65534,\
			sec=krb5p:krb5i:krb5,rw,root_squash,no_all_squash,\
			sec=sys,ro,root_squash,no_all_squash)

Cc: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: test_export shouldn't use invalid uid/gid

From: "J. Bruce Fields" <bfields@redhat.com>

Some newer kernels are rejecting -1 uid/gid.  Actually, worse--they're
silently ignoring any attempt to cache such exports, thus preventing
test_export from getting back the errors it needs.

And -1 wasn't a good choice anyway.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: clean up exports.d discussion

From: "J. Bruce Fields" <bfields@redhat.com>

The syntax here is a little convoluted.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfs-utils: remove gss_clnt_send_err and gss_destroy_creds

As Bruce recently pointed out, gss_clnt_send_err basically does an
unsolicited downcall into the kernel to try and destroy a valid GSS
context. That has been broken however since this kernel commit:

    commit 3b68aaeaf54065e5c44583a1d33ffb7793953ba4
    Author: Trond Myklebust <Trond.Myklebust@netapp.com>
    Date:   Thu Jun 7 10:14:15 2007 -0400

        SUNRPC: Always match an upcall message in gss_pipe_downcall()

Downcalls that don't match an in-progress upcall just get back an
-ENOENT error and don't actually do anything. Remove these tools
since they've been useless for the last 6 years.

Reported-by: "J. Bruce Fields" <bfields@fieldses.org>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfsmount.conf: Remove duplicate 'bg' and 'fg' from parsing string.

When the 'Background' and/or 'Foreground' options are set
in multiple sections of the nfsmount.conf file, each instance
gets added to the parsing string. This patch makes the first
instance of either option override the any others.

Signed-off-by: Steve Dickson <steved@redhat.com>
nfsmount.conf: remove duplicate 'timeo' from the parsing string

When the 'timeo' option is specified in multiple sections of
the nfsmount.conf file, each instance is added to the parsing
string. This patch make the first instance override any others.

Signed-off-by: Steve Dickson <steved@redhat.com>
mountstats: fix python2.x support

Commit b703eabe converted mountstats to using python3's print()
function, but this doesn't work in python2.x without
importing the print function from __future__.

Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: Add -s option.

Adds '-s' option which outputs the current exports in a format
suitable for /etc/exports.

Signed-off-by: Tony Asleson <tasleson@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
gssd: have process_krb5_upcall fork before handling upcall

Most krb5 installations use credcache locations that contain %{uid},
which expands to the real UID of the current process. In order for
GSSAPI to find those properly, we need to be able to switch the real UID
of the process to the designated one. That however, opens the door to
allowing gssd to be killed or reniced during the window where we've
switched credentials.

To combat this, change gssd to fork before trying to handle each upcall.
The child will do the work to establish the context and the parent task
will just wait for it to exit. It's still possible for the child to be
killed or reniced, but that would only affect a single upcall instead of
the entire daemon. Also, If the process is killed prematurely, then log
an error to tip off the admin that there was a problem.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
gssd: do a more thorough change of identity after forking

The part of process_krb5_upcall that handles non-machine user creds
first tries to query GSSAPI for credentials. If that fails, it then
falls back to trawling through likely credcache locations to find them
and then points $KRB5CCNAME at it before proceeding. There are a number
of bugs in this code that this patch attempts to address.

The code that queries GSSAPI for credentials does it as root which
almost universally fails to do anything useful unless we happen to be
looking for non-machine root creds. Because of this, gssd almost always
falls back to having to search for credcaches "manually". The code that
handles credential switching is in create_auth_rpc_client, so it's too
late to be of any use here.

Worse yet, for historical reasons the MIT krb5 authors used %{uid} in
the default credcache locations which translates to the real uid. Thus
switching the fsuid or even euid is insufficient. You must switch the
real uid in order to be able to find the proper credcache in most cases.

This patch moves the credential switching to occur much earlier in the
process and has it do a much more thorough job of it. It first drops all
supplimentary groups, then determines a gid to use and switches the gids
and uids to the correct ones. If it can't determine the correct gid to
use, it then tries to look up the one for "nobody" and uses that.

Once the credentials are switched, the forked child now no longer tries
to change them back. It does the downcall with the new credentials and
just exits when it's done.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mount.nfs: print an error message when remount attempt fails

Currently, mount.nfs returns an error code, but doesn't print anything
when this occurs.

Reported-by: Eric Doutreleau <edoutreleau@genoscope.cns.fr>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>