Hide Forgot
Description of problem: In a system with Kerberized NFSv4, when the ticket expires, Kerberos tries to renew the ticket, but at the same time so does rpcgssd, it appears. Customer systems are experiencing this race condition and then mount fails. Version-Release number of selected component (if applicable): krb5-auth-dialog-0.13-3.el6.x86_64 krb5-devel-1.10.3-10.el6.x86_64 krb5-libs-1.10.3-10.el6.x86_64 krb5-workstation-1.10.3-10.el6.x86_64 nfs4-acl-tools-0.3.3-6.el6.x86_64 nfs-utils-1.2.3-26.el6.x86_64 nfs-utils-lib-1.1.5-6.el6.x86_64 How reproducible: Uncertain. Steps to Reproduce: Given the very tight timings involved its difficult to trigger at just the right times. Active Directory based domain (no special tunings): 1. start rpcgssd with -vvv debug 2. start rpcdebug -m rpc -s auth 3. allow rpcgssd to renew machine cred 4. trigger nfs mount to krb5 auth share at same moment. 5. review /var/log/messages for rpcdebug/rcpgssd log alternatively you could reproduce by doing this. 1. start rpcgssd with -vvv debug 2. start rpcdebug -m rpc -s auth 3. do a kinit of the machine credentials to /tmp/krb5cc_machine_DOMAIN (same file as rpcgssd uses) 4. at same moment trigger a mount of a krb5 authenticated share. 5. review /var/log/messages for rpcdebug/rcpgssd log For step 5 in either case , if you get the timings just right, you should see a debug trace similar to what i have shown on this case, ie: 1. machine credential refresh starts 2. mount starts 3. rpc errors with a GSS_S_CONTEXT_EXPIRED 0x000c0000 , mount fails with error -5 4. machine credential refresh finishes 5. from this point on mount will work. NOTE: step 1-4 all happen in fractions of a second. Actual results: Race condition experienced, and mount fails. Expected results: Not the above. Additional info:
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux.
This issue is addressed in RHEL7. This is a major change so it can't be ported back.