Bug 1292607 - Add comment warning inside /etc/sysconfig/nfs stating how to use an alternate keytab rather than the default /etc/krb5.keytab
Add comment warning inside /etc/sysconfig/nfs stating how to use an alternate...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nfs-utils (Show other bugs)
7.2
Unspecified Linux
high Severity medium
: rc
: ---
Assigned To: Steve Dickson
Yongcheng Yang
: Documentation
Depends On:
Blocks: 1203710 1313485 1295577 1364088
  Show dependency treegraph
 
Reported: 2015-12-17 17:13 EST by Ramandeep Arora
Modified: 2016-11-07 22:58 EST (History)
6 users (show)

See Also:
Fixed In Version: nfs-utils-1.3.0-0.24.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-04 01:02:44 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ramandeep Arora 2015-12-17 17:13:27 EST
Description of problem:  (in customer's exact words)

When I set the keytab for rpc.gssd by adding "-k <path to keytab>" to "RPCGSSDARGS=" in /etc/sysconfig/nfs I can no longer start the service rpcgssd. The systemd service file has a hardcoded "ConditionPathExists=/etc/krb5.keytab". If I change this manually to the new path I can start the service. Since I have to reload the nfs config with "systemctl restart nfs-config" it would be nice if this parameter was updated as well (or if it was a variable).


Version-Release number of selected component (if applicable):

Tested on Fully updated RHEL7.2

How reproducible:
100%
Comment 2 Dave Wysochanski 2016-01-12 11:24:32 EST
Since this is reproducible it seems a good candidate for consideration in RHEL7.3
Comment 3 Dave Wysochanski 2016-01-12 12:01:56 EST
Steve D - what do you think?
Comment 4 Steve Dickson 2016-01-13 10:52:20 EST
(In reply to Dave Wysochanski from comment #3)
> Steve D - what do you think?

I just sent email to the systemd-devel mailing list
to see if this is possible.
Comment 6 Steve Dickson 2016-01-23 09:44:44 EST
Here is the thread I started with the systemd folks
   http://lists.freedesktop.org/archives/systemd-devel/2016-January/035559.h

In short, the answer is no, its not possible to add a 
variable to the ConditionPathExists= clause.

any ideas?
Comment 8 Dave Wysochanski 2016-02-08 09:42:17 EST
(In reply to Steve Dickson from comment #6)
> Here is the thread I started with the systemd folks
>    http://lists.freedesktop.org/archives/systemd-devel/2016-January/035559.h
> 
> In short, the answer is no, its not possible to add a 
> variable to the ConditionPathExists= clause.
> 
> any ideas?

Is there some reason you're not using EnvironmentFile in cases where there's an env var inside /etc/sysconfig/nfs?
Comment 9 Steve Dickson 2016-02-10 11:08:04 EST
(In reply to Dave Wysochanski from comment #8)
> (In reply to Steve Dickson from comment #6)
> > Here is the thread I started with the systemd folks
> >    http://lists.freedesktop.org/archives/systemd-devel/2016-January/035559.h
> > 
> > In short, the answer is no, its not possible to add a 
> > variable to the ConditionPathExists= clause.
> > 
> > any ideas?
> 
> Is there some reason you're not using EnvironmentFile in cases where there's
> an env var inside /etc/sysconfig/nfs?
It is being used.... 
rpc-gssd.service:

[Unit]
Description=RPC security service for NFS client and server
DefaultDependencies=no
Conflicts=umount.target
Requires=var-lib-nfs-rpc_pipefs.mount
After=var-lib-nfs-rpc_pipefs.mount

ConditionPathExists=/etc/krb5.keytab 
^^^^^ the problem is this has to be a hard coded path and the 
      systemd people do not want to change that. 

PartOf=nfs-utils.service

Wants=nfs-config.service
After=nfs-config.service

[Service]
EnvironmentFile=-/run/sysconfig/nfs-utils

Type=forking
ExecStart=/usr/sbin/rpc.gssd $GSSDARGS
Comment 10 Joseph Kachuck 2016-04-25 10:17:35 EDT
Hello Steve,
If this wont be able to be fixed. Would we be able to have a warning message added?

Thank You
Joe Kachuck
Comment 11 Steve Dickson 2016-04-26 12:50:27 EDT
(In reply to Joseph Kachuck from comment #10)
> Hello Steve,
> If this wont be able to be fixed. Would we be able to have a warning message
> added?
> 
What would the warning message say?
Comment 12 Joseph Kachuck 2016-04-26 13:20:20 EDT
Hello,
Might put a comment warning inside /etc/sysconfig/nfs. Stating ConditionPathExists=/etc/krb5.keytab can not be changed?

Thank You
Joe Kachuck
Comment 13 Steve Dickson 2016-04-26 13:39:33 EDT
Its not the easiest things to explain :-) but here goes


Warning: The keytab is now statically define in the
         rpc-gssd.service systemd script. The 
         ConditionPathExists= variable in that 
         script must point the existing keytab
         for the rpc-gssd service to start.

Thoughts?
Comment 14 Steve Dickson 2016-04-26 14:25:50 EDT
Here is a better read:

The rpc-gssd service will not start unless the 
file /etc/krb5.keytab exists. If an alternate 
keytab is needed, that separate keytab file 
location may be  defined in the rpc-gssd.service's 
systemd unit file under the ConditionPathExists 
parameter
Comment 17 Yongcheng Yang 2016-04-27 22:41:56 EDT
According to comment 12 and comment 14, only need to add a warning message.

There is no need to generate an automatic case. Will check the Note added or not and verify this bug when available.
Comment 20 Yongcheng Yang 2016-07-05 04:20:01 EDT
Update the description according to comment 12.
Please correct me if there is any concern.
Comment 21 Yongcheng Yang 2016-09-05 04:58:09 EDT
Have checked the warning exists in latest compose.
(Only need to add a warning message according to comment 12 and comment 14)

Move to VERIFIED now.

[root@hp-dl585g7-04 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.3 Beta (Maipo)
[root@hp-dl585g7-04 ~]# rpm -q nfs-utils
nfs-utils-1.3.0-0.33.el7.x86_64
[root@hp-dl585g7-04 ~]# cat /etc/sysconfig/nfs | grep -B8 RPCGSSDARGS
#
# Optional arguments passed to rpc.gssd. See rpc.gssd(8)
# Note: The rpc-gssd service will not start unless the 
#       file /etc/krb5.keytab exists. If an alternate
#       keytab is needed, that separate keytab file
#       location may be defined in the rpc-gssd.service's
#       systemd unit file under the ConditionPathExists
#       parameter
RPCGSSDARGS=""
[root@hp-dl585g7-04 ~]#
Comment 23 errata-xmlrpc 2016-11-04 01:02:44 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2383.html

Note You need to log in before you can comment on or make changes to this bug.