• Simo Sorce's avatar
    SUNRPC: Add RPC based upcall mechanism for RPCGSS auth · 1d658336
    Simo Sorce authored
    This patch implements a sunrpc client to use the services of the gssproxy
    userspace daemon.
    
    In particular it allows to perform calls in user space using an RPC
    call instead of custom hand-coded upcall/downcall messages.
    
    Currently only accept_sec_context is implemented as that is all is needed for
    the server case.
    
    File server modules like NFS and CIFS can use full gssapi services this way,
    once init_sec_context is also implemented.
    
    For the NFS server case this code allow to lift the limit of max 2k krb5
    tickets. This limit is prevents legitimate kerberos deployments from using krb5
    authentication with the Linux NFS server as they have normally ticket that are
    many kilobytes large.
    
    It will also allow to lift the limitation on the size of the credential set
    (uid,gid,gids) passed down from user space for users that have very many groups
    associated. Currently the downcall mechanism used by rpc.svcgssd is limited
    to around 2k secondary groups of the 65k allowed by kernel structures.
    Signed-off-by: default avatarSimo Sorce <simo@redhat.com>
    [bfields: containerization, concurrent upcalls, misc. fixes and cleanup]
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    1d658336
gss_rpc_upcall.c 8.71 KB