Bug 1439117 - [RFE][Future Feature] [rhel8] NFS-Ganesha in RHGS - Run as non-root user
Summary: [RFE][Future Feature] [rhel8] NFS-Ganesha in RHGS - Run as non-root user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Gluster Storage
Classification: Red Hat Storage
Component: nfs-ganesha
Version: rhgs-3.5
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
: RHGS 3.5.z Batch Update 4
Assignee: Patric Uebele
QA Contact: Upasana
URL:
Whiteboard:
Depends On: 1926133 1934536
Blocks: 1657798 1695079 1934533
TreeView+ depends on / blocked
 
Reported: 2017-04-05 09:32 UTC by Marcel Hergaarden
Modified: 2023-10-06 17:36 UTC (History)
17 users (show)

Fixed In Version: nfs-ganesha-3.4-2.el8rhgs (rhgs-3.5.4)
Doc Type: Enhancement
Doc Text:
With this update,`ganesha.nfsd` can be run as a non-root user. Running as a non- root user, ensures less vulnerability to privilege escalation attacks. Additionally container frameworks prefer to run daemons as non-root.
Clone Of:
: 1441131 1695079 1934533 (view as bug list)
Environment:
Last Closed: 2021-04-29 07:21:23 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1441131 0 unspecified CLOSED [Doc RFE] Document steps needed to setup and run NFS-Ganesha in RHGS as non-root user 2023-10-06 17:36:52 UTC
Red Hat Knowledge Base (Solution) 2993711 0 None None None 2017-04-06 14:32:15 UTC
Red Hat Product Errata RHBA-2021:1463 0 None None None 2021-04-29 07:22:01 UTC

Internal Links: 1441131

Description Marcel Hergaarden 2017-04-05 09:32:02 UTC
Description of problem:
Need to run Ganesha NFS as non-root user, due to company internal security policies. 

Version-Release number of selected component (if applicable):
RHGS 3.2

How reproducible:
Run NFS-Ganesha processes as a non-root user, see addl info.

Steps to Reproduce:
1.Run NFS-Ganesha as non-root
2.Write a file, success
3.Write another file -> zero bytes error (happens randomly)

Actual results:
Sometimes normal file write, sometimes zero bytes file error

Expected results:
Normal file write

Additional info:

What is tried to accomplish is having Ganesha running as a non-root user (in this case, opted for the "hacluster" user). 
Outside the experienced write errors, all other items seem to be working quite fine. All Ganesha related processes report to be running fine, all pacemaker/corosync resources are up/running (failover works fine as well).

Modifications to have Ganesha running withour root rights:
Ganesha system service file to include a: user=hacluster
The pid file and logfile location in an alternate directory, and therefor also modify a pacemaker probe script which had a hardcoded location for the ganesha.pid file.

The RQUOTA port defaults to 875, and therefore needed be > 1024  (set to 1875).

Inside /etc/dbus-1/system.d/org.ganesha.nfsd.conf, the policy user needed to be updates with hacluster instead of root.
Several directories needed to be chowned to match the hacluster user such as:
/var/run/gluster/shared_storage/nfs-ganesha  (recursive)
<brick_path>/<ganesha volume mountpoint>

Apart from the Ganesha logs and brick logs, no other error are seen.

This is RHGS 3.2 on RHEL 7.3.
SELinux is on (Enforcing), (no issues with SElinux spotted)

NFS Ganesha running as non-root and
clients experiences write errors / permission denied. 

Files written to a NFS-ganesha share, mounted on a client, get a write error/permission denied. Sometimes no error is returned, but no data is actually written (a zero byte file)

Sometimes, writes do actually complete correctly, sometimes they do not...

A correctly written file :
[glustadm@tlrvglusterclient02 XFB_LV]$ id > FILE_2 ; ls -l FILE_2
-rw-rw-r--. 1 glustadm glustadm 125 Mar 23 17:17 FILE_2

1 second later, a failure:
[glustadm@tlrvglusterclient02 XFB_LV]$ id > FILE_3 ; ls -l FILE_3
id: write error: Permission denied
-rw-rw-r--. 1 glustadm glustadm 0 Mar 23 17:17 FILE_3

Repeating it (to the same file as previously failed), gets first a few additional failures, then completes:
[glustadm@tlrvglusterclient02 XFB_LV]$ id > FILE_3 ; ls -l FILE_3
-rw-rw-r--. 1 glustadm glustadm 0 Mar 23 17:17 FILE_3

[glustadm@tlrvglusterclient02 XFB_LV]$ id > FILE_3 ; ls -l FILE_3
-rw-rw-r--. 1 glustadm glustadm 125 Mar 23 17:20 FILE_3

Comment 2 Niels de Vos 2017-04-05 11:45:33 UTC
One of the configuration options that should make it a little easier to run NFS-Ganesha as non-root, would be to have it provide only NFSv4. The need for any NFSv3 side-band protocols, or registering at rpcbind is then not needed. Only port 2049 is used in that case, which should not be a problem for an unprivileged process.

Comment 61 errata-xmlrpc 2021-04-29 07:21:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (nfs-ganesha bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1463


Note You need to log in before you can comment on or make changes to this bug.