Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
+++ This bug was initially created as a clone of Bug #1116281 +++
Description of problem:
TCP_WRAPPERS SUPPORT does not work well:
In man page rpc.mountd(8) said:
TCP_WRAPPERS SUPPORT
You can protect your rpc.mountd listeners using the tcp_wrapper library or iptables(8).
Note that the tcp_wrapper library supports only IPv4 networking.
but after do: echo -e "mountd:ALL\nstatd:ALL\n" > $Deny
mount still success.
Version-Release number of selected component (if applicable):
all version in RHEL-5.11 RHEL-6.6 RHEL-7.0
How reproducible:
always
Steps to Reproduce:
1. servcie nfs restart
2. echo -e "mountd:ALL\nstatd:ALL\n" > $Deny #Deny=/etc/hosts.deny
3. mount -o vers=$V $IP4:$exportDir $nfsmp #expect fail
Actual results:
--------------------------------------------------------------------------------
[03:03:36 root@ ~~]# echo -e "mountd:ALL\nstatd:ALL\n" > $Deny
:: [ PASS ] :: Running 'echo -e "mountd:ALL\nstatd:ALL\n" > $Deny' (Expected 0, got 0)
--------------------------------------------------------------------------------
[03:03:36 root@ ~~]# mount -o vers=$V $IP4:$exportDir $nfsmp
:: [ FAIL ] :: Mounting via nfs exported disk locally - should FAIL (Expected 1-255, got 0)
Expected results:
mount should fail when write mountd:ALL in /etc/hosts.deny
Additional info:
J:686197 nfs-utils(1)-S-:/Regression/bz493631-malfunction-reverse-dns-lookups.0@2014-07-04_14:42:39..
The problem here is mountd is used differently with v4 mounts and v3/v2 mounts.
With v4 the kernel makes a upcall to get the export information
mountd: v4root_create: path '/' flags 0x12405
mountd: Version 1.2.3 starting
mountd: auth_unix_ip: inbuf 'nfsd 10.19.60.73'
mountd: auth_unix_ip: client 0x7f98660c2a50 '*'
mountd: nfsd_fh: inbuf '* 1 \x00000000'
mountd: nfsd_fh: found 0x7f98660cdcc0 path /
mountd: nfsd_export: inbuf '* /home'
mountd: nfsd_export: found 0x7f98660ccf50 path /home
mountd: nfsd_fh: inbuf '* 6 \x809b7df9c858431299acc5a3403cca8d'
mountd: nfsd_fh: found 0x7f98660ccf60 path /home
With v3/v2 mounts the client make RPC calls to mountd directly.
Those calls are covered by the tcp wrapper calls. \
mountd: from_local: updating local if addr list
mountd: from_local: checked 7 local if addrs; incoming address not found
mountd: connect from 10.19.60.73 denied: request from unauthorized host
mountd: check_default: access by 10.19.60.73 DENIED
which does work... So the question is do we want to expand the tcp wrapper
to v4 mounts or change the documentation so it explains the tcp wrappers
are only in effect with v3/v2 mounts... I say the latter...
(In reply to Jan Chaloupka from comment #6)
> Hi, Steve,
>
> can you review the patch? Just used your sentence.
>
> Jan
Looks fine... Can you please post this upstream at linux-nfs.org
with the proper Signed-off-by: line and description?
tia!