Bug 1631564
| Summary: | rpc.gssd memory use grows unbounded when user accesses krb5 mount without having kerberos credentials | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Robbie Harwood <rharwood> |
| Component: | gssproxy | Assignee: | Robbie Harwood <rharwood> |
| Status: | CLOSED ERRATA | QA Contact: | anuja <amore> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.0 | CC: | amore, dpal, dwysocha, fsorenso, fs-qe, ipa-qe, ksiddiqu, xzhou, yoyang |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| URL: | https://pagure.io/gssproxy/pull-request/233 | ||
| Whiteboard: | |||
| Fixed In Version: | gssproxy-0.8.0-7.el8 | Doc Type: | Bug Fix |
| Doc Text: |
(see rhel-7.7)
|
Story Points: | --- |
| Clone Of: | 1618375 | Environment: | |
| Last Closed: | 2019-11-05 21:29:38 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1682281 | ||
| Bug Blocks: | 1618375, 1679810, 1689138, 1701002 | ||
|
Description
Robbie Harwood
2018-09-20 22:06:17 UTC
Verified using steps : https://bugzilla.redhat.com/show_bug.cgi?id=1618375#c14 ========================================================================== on master : ========================================================================== [root@vm-idm-010 ~]# rpm -qa gssproxy gssproxy-0.8.0-14.el8.x86_64 [root@vm-idm-010 ~]# echo Secret123 | kinit admin Password for admin: [root@vm-idm-010 ~]# hostname vm-idm-010.gssp.test [root@vm-idm-010 ~]# export MASTER=`hostname`; export CLIENT=vm-idm-001.gssp.test [root@vm-idm-010 ~]# ipa service-add nfs/$MASTER -------------------------------------------------- Added service "nfs/vm-idm-010.gssp.test" -------------------------------------------------- Principal name: nfs/vm-idm-010.gssp.test Principal alias: nfs/vm-idm-010.gssp.test Managed by: vm-idm-010.gssp.test [root@vm-idm-010 ~]# ipa service-add nfs/$CLIENT -------------------------------------------------- Added service "nfs/vm-idm-001.gssp.test" -------------------------------------------------- Principal name: nfs/vm-idm-001.gssp.test Principal alias: nfs/vm-idm-001.gssp.test Managed by: vm-idm-001.gssp.test [root@vm-idm-010 ~]# ipa-getkeytab -k /etc/krb5.keytab -s $(hostname) -p nfs/$MASTER Keytab successfully retrieved and stored in: /etc/krb5.keytab [root@vm-idm-010 ~]# klist -kt /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 2 07/04/2019 20:00:50 host/vm-idm-010.gssp.test 1 07/05/2019 10:45:45 nfs/vm-idm-010.gssp.test 1 07/05/2019 10:45:45 nfs/vm-idm-010.gssp.test [root@vm-idm-010 ~]# cat /etc/gssproxy/gssproxy.conf [gssproxy] [service/nfs-server] mechs = krb5 socket = /run/gssproxy.sock cred_store = keytab:/etc/krb5.keytab trusted = yes kernel_nfsd = yes euid = 0 [root@vm-idm-010 ~]# mkdir /export ; echo "test" > /export/test.txt ; echo "/export gss/krb5p(rw,sync)" > /etc/exports [root@vm-idm-010 ~]# [root@vm-idm-010 ~]# service nfs-server restart; service rpc-gssd.service restart; service gssproxy restart Redirecting to /bin/systemctl restart nfs-server.service Redirecting to /bin/systemctl restart rpc-gssd.service Redirecting to /bin/systemctl restart gssproxy.service [root@vm-idm-010 ~]# exportfs -a ========================================================================== on client : ========================================================================== [root@vm-idm-001 ~]# rpm -qa gssproxy gssproxy-0.8.0-14.el8.x86_64 [root@vm-idm-001 ~]# hostname vm-idm-001.gssp.test [root@vm-idm-001 ~]# echo Secret123|kinit admin Password for admin: [root@vm-idm-001 ~]# export CLIENT=vm-idm-001.gssp.test; export MASTER=vm-idm-010.gssp.test [root@vm-idm-001 ~]# ipa-getkeytab -k /etc/krb5.keytab -s $MASTER -p nfs/$CLIENT Keytab successfully retrieved and stored in: /etc/krb5.keytab [root@vm-idm-001 ~]# klist -kt /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 07/04/2019 20:13:00 host/vm-idm-001.gssp.test 1 07/04/2019 20:13:00 host/vm-idm-001.gssp.test 1 07/05/2019 10:49:59 nfs/vm-idm-001.gssp.test 1 07/05/2019 10:49:59 nfs/vm-idm-001.gssp.test [root@vm-idm-001 ~]# cat /etc/gssproxy/gssproxy.conf [gssproxy] [service/nfs-client] mechs = krb5 cred_store = keytab:/etc/krb5.keytab cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab cred_usage = initiate allow_any_uid = yes trusted = yes euid = 0 [root@vm-idm-001 ~]# export GSS_USE_PROXY="yes" [root@vm-idm-001 ~]# service rpc-gssd restart;service rpcbind restart Redirecting to /bin/systemctl restart rpc-gssd.service Redirecting to /bin/systemctl restart rpcbind.service [root@vm-idm-001 ~]# mkdir /nfsdir [root@vm-idm-001 ~]# mount -o sec=krb5p -t nfs4 $MASTER:/export /nfsdir [root@vm-idm-001 ~]# df Filesystem 1K-blocks Used Available Use% Mounted on devtmpfs 1919604 0 1919604 0% /dev tmpfs 1935856 0 1935856 0% /dev/shm tmpfs 1935856 16888 1918968 1% /run tmpfs 1935856 0 1935856 0% /sys/fs/cgroup /dev/mapper/rhel_vm--idm--001-root 36702712 2645348 34057364 8% / /dev/vda1 1038336 170372 867964 17% /boot tmpfs 387168 0 387168 0% /run/user/0 vm-idm-010.gssp.test:/export 36702720 3046400 33656320 9% /nfsdir [root@vm-idm-001 ~]# klist Ticket cache: KCM:0:57938 Default principal: host/vm-idm-001.gssp.test Valid starting Expires Service principal 01/01/1970 05:30:00 01/01/1970 05:30:00 Encrypted/Credentials/v1@X-GSSPROXY: [root@vm-idm-001 ~]# ls /nfsdir/ test.txt [root@vm-idm-001 ~]# su - tuser su: warning: cannot change directory to /home/tuser: No such file or directory [tuser@vm-idm-001 root]$ ls /nfsdir ls: cannot access '/nfsdir': Permission denied [tuser@vm-idm-001 root]$ while true ; do ls /nfsdir ; done ls: cannot access '/nfsdir': Permission denied ls: cannot access '/nfsdir': Permission denied ls: cannot access '/nfsdir': Permission denied ^C [tuser@vm-idm-001 root]$ logout [root@vm-idm-001 ~]# while true ; do echo "$(date): $(ps h -C rpc.gssd -o size,vsize,share,rss,sz,trs)" ; sleep 1 ; done Fri Jul 5 10:55:52 IST 2019: 10296 140128 - 5824 35032 87 Fri Jul 5 10:55:54 IST 2019: 10296 140128 - 5824 35032 87 .................... Fri Jul 5 10:55:57 IST 2019: 10296 140128 - 5824 35032 87 Fri Jul 5 10:56:16 IST 2019: 10296 140128 - 5824 35032 87 .................... Fri Jul 5 10:56:24 IST 2019: 10296 140128 - 5824 35032 87 Fri Jul 5 10:56:26 IST 2019: 10296 140128 - 5824 35032 87 Fri Jul 5 10:56:27 IST 2019: 10296 140128 - 5824 35032 87 Based on this marking bz as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:3515 |