€•º?      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ2/translations/zh_CN/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ2/translations/zh_TW/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ2/translations/it_IT/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ2/translations/ja_JP/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ2/translations/ko_KR/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ2/translations/sp_SP/filesystems/nfs/rpc-server-gss”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ)rpcsec_gss support for kernel RPC servers”h]”hŒ)rpcsec_gss support for kernel RPC servers”…””}”(hh¨hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hh£hžhhŸŒL/var/lib/git/docbuild/linux/Documentation/filesystems/nfs/rpc-server-gss.rst”h KubhŒ	paragraph”“”)”}”(hX4  This document gives references to the standards and protocols used to
implement RPCGSS authentication in kernel RPC servers such as the NFS
server and the NFS client's NFSv4.0 callback server.  (But note that
NFSv4.1 and higher don't require the client to act as a server for the
purposes of authentication.)”h]”hX8  This document gives references to the standards and protocols used to
implement RPCGSS authentication in kernel RPC servers such as the NFS
server and the NFS clientâ€™s NFSv4.0 callback server.  (But note that
NFSv4.1 and higher donâ€™t require the client to act as a server for the
purposes of authentication.)”…””}”(hh¹hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubh¸)”}”(hŒ,RPCGSS is specified in a few IETF documents:”h]”hŒ,RPCGSS is specified in a few IETF documents:”…””}”(hhÇhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubhŒblock_quote”“”)”}”(hŒj- RFC2203 v1: https://tools.ietf.org/rfc/rfc2203.txt
- RFC5403 v2: https://tools.ietf.org/rfc/rfc5403.txt
”h]”hŒbullet_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hŒ2RFC2203 v1: https://tools.ietf.org/rfc/rfc2203.txt”h]”h¸)”}”(hhäh]”(hŒRFC2203 v1: ”…””}”(hhæhžhhŸNh NubhŒ	reference”“”)”}”(hŒ&https://tools.ietf.org/rfc/rfc2203.txt”h]”hŒ&https://tools.ietf.org/rfc/rfc2203.txt”…””}”(hhïhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”hñuh1híhhæubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khhâubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhhÝubhá)”}”(hŒ3RFC5403 v2: https://tools.ietf.org/rfc/rfc5403.txt
”h]”h¸)”}”(hŒ2RFC5403 v2: https://tools.ietf.org/rfc/rfc5403.txt”h]”(hŒRFC5403 v2: ”…””}”(hj  hžhhŸNh Nubhî)”}”(hŒ&https://tools.ietf.org/rfc/rfc5403.txt”h]”hŒ&https://tools.ietf.org/rfc/rfc5403.txt”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j  uh1híhj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khj
  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhhÝubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ-”uh1hÛhŸh¶h Khh×ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÕhŸh¶h Khh£hžhubh¸)”}”(hŒ;There is a third version that we don't currently implement:”h]”hŒ=There is a third version that we donâ€™t currently implement:”…””}”(hj?  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubhÖ)”}”(hŒ5- RFC7861 v3: https://tools.ietf.org/rfc/rfc7861.txt
”h]”hÜ)”}”(hhh]”há)”}”(hŒ3RFC7861 v3: https://tools.ietf.org/rfc/rfc7861.txt
”h]”h¸)”}”(hŒ2RFC7861 v3: https://tools.ietf.org/rfc/rfc7861.txt”h]”(hŒRFC7861 v3: ”…””}”(hjX  hžhhŸNh Nubhî)”}”(hŒ&https://tools.ietf.org/rfc/rfc7861.txt”h]”hŒ&https://tools.ietf.org/rfc/rfc7861.txt”…””}”(hj`  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”jb  uh1híhjX  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KhjT  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhjQ  ubah}”(h]”h ]”h"]”h$]”h&]”j7  j8  uh1hÛhŸh¶h KhjM  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÕhŸh¶h Khh£hžhubh¢)”}”(hhh]”(h§)”}”(hŒ
Background”h]”hŒ
Background”…””}”(hjŠ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj‡  hžhhŸh¶h Kubh¸)”}”(hŒßThe RPCGSS Authentication method describes a way to perform GSSAPI
Authentication for NFS.  Although GSSAPI is itself completely mechanism
agnostic, in many cases only the KRB5 mechanism is supported by NFS
implementations.”h]”hŒßThe RPCGSS Authentication method describes a way to perform GSSAPI
Authentication for NFS.  Although GSSAPI is itself completely mechanism
agnostic, in many cases only the KRB5 mechanism is supported by NFS
implementations.”…””}”(hj˜  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khj‡  hžhubh¸)”}”(hŒ{The Linux kernel, at the moment, supports only the KRB5 mechanism, and
depends on GSSAPI extensions that are KRB5 specific.”h]”hŒ{The Linux kernel, at the moment, supports only the KRB5 mechanism, and
depends on GSSAPI extensions that are KRB5 specific.”…””}”(hj¦  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khj‡  hžhubh¸)”}”(hŒ—GSSAPI is a complex library, and implementing it completely in kernel is
unwarranted. However GSSAPI operations are fundamentally separable in 2
parts:”h]”hŒ—GSSAPI is a complex library, and implementing it completely in kernel is
unwarranted. However GSSAPI operations are fundamentally separable in 2
parts:”…””}”(hj´  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khj‡  hžhubhÜ)”}”(hhh]”(há)”}”(hŒinitial context establishment”h]”h¸)”}”(hjÇ  h]”hŒinitial context establishment”…””}”(hjÉ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K#hjÅ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhjÂ  hžhhŸh¶h Nubhá)”}”(hŒLintegrity/privacy protection (signing and encrypting of individual
packets)
”h]”h¸)”}”(hŒKintegrity/privacy protection (signing and encrypting of individual
packets)”h]”hŒKintegrity/privacy protection (signing and encrypting of individual
packets)”…””}”(hjà  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K$hjÜ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhjÂ  hžhhŸh¶h Nubeh}”(h]”h ]”h"]”h$]”h&]”j7  j8  uh1hÛhŸh¶h K#hj‡  hžhubh¸)”}”(hŒ„The former is more complex and policy-independent, but less
performance-sensitive.  The latter is simpler and needs to be very fast.”h]”hŒ„The former is more complex and policy-independent, but less
performance-sensitive.  The latter is simpler and needs to be very fast.”…””}”(hjú  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K'hj‡  hžhubh¸)”}”(hŒÒTherefore, we perform per-packet integrity and privacy protection in the
kernel, but leave the initial context establishment to userspace.  We
need upcalls to request userspace to perform context establishment.”h]”hŒÒTherefore, we perform per-packet integrity and privacy protection in the
kernel, but leave the initial context establishment to userspace.  We
need upcalls to request userspace to perform context establishment.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K*hj‡  hžhubeh}”(h]”Œ
background”ah ]”h"]”Œ
background”ah$]”h&]”uh1h¡hh£hžhhŸh¶h Kubh¢)”}”(hhh]”(h§)”}”(hŒ"NFS Server Legacy Upcall Mechanism”h]”hŒ"NFS Server Legacy Upcall Mechanism”…””}”(hj!  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj  hžhhŸh¶h K/ubh¸)”}”(hŒžThe classic upcall mechanism uses a custom text based upcall mechanism
to talk to a custom daemon called rpc.svcgssd that is provide by the
nfs-utils package.”h]”hŒžThe classic upcall mechanism uses a custom text based upcall mechanism
to talk to a custom daemon called rpc.svcgssd that is provide by the
nfs-utils package.”…””}”(hj/  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K1hj  hžhubh¸)”}”(hŒ(This upcall mechanism has 2 limitations:”h]”hŒ(This upcall mechanism has 2 limitations:”…””}”(hj=  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K5hj  hžhubhŒenumerated_list”“”)”}”(hhh]”há)”}”(hŒ2It can handle tokens that are no bigger than 2KiB
”h]”h¸)”}”(hŒ1It can handle tokens that are no bigger than 2KiB”h]”hŒ1It can handle tokens that are no bigger than 2KiB”…””}”(hjT  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K7hjP  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hàhjM  hžhhŸh¶h Nubah}”(h]”h ]”h"]”h$]”h&]”Œenumtype”Œ
upperalpha”Œprefix”hŒsuffix”Œ)”uh1jK  hj  hžhhŸh¶h K7ubh¸)”}”(hŒøIn some Kerberos deployment GSSAPI tokens can be quite big, up and
beyond 64KiB in size due to various authorization extensions attacked to
the Kerberos tickets, that needs to be sent through the GSS layer in
order to perform context establishment.”h]”hŒøIn some Kerberos deployment GSSAPI tokens can be quite big, up and
beyond 64KiB in size due to various authorization extensions attacked to
the Kerberos tickets, that needs to be sent through the GSS layer in
order to perform context establishment.”…””}”(hjs  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K9hj  hžhubh¸)”}”(hŒíB) It does not properly handle creds where the user is member of more
than a few thousand groups (the current hard limit in the kernel is 65K
groups) due to limitation on the size of the buffer that can be send
back to the kernel (4KiB).”h]”hŒíB) It does not properly handle creds where the user is member of more
than a few thousand groups (the current hard limit in the kernel is 65K
groups) due to limitation on the size of the buffer that can be send
back to the kernel (4KiB).”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K>hj  hžhubeh}”(h]”Œ"nfs-server-legacy-upcall-mechanism”ah ]”h"]”Œ"nfs server legacy upcall mechanism”ah$]”h&]”uh1h¡hh£hžhhŸh¶h K/ubh¢)”}”(hhh]”(h§)”}”(hŒ#NFS Server New RPC Upcall Mechanism”h]”hŒ#NFS Server New RPC Upcall Mechanism”…””}”(hjš  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj—  hžhhŸh¶h KDubh¸)”}”(hŒˆThe newer upcall mechanism uses RPC over a unix socket to a daemon
called gss-proxy, implemented by a userspace program called Gssproxy.”h]”hŒˆThe newer upcall mechanism uses RPC over a unix socket to a daemon
called gss-proxy, implemented by a userspace program called Gssproxy.”…””}”(hj¨  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KFhj—  hžhubh¸)”}”(hŒ{The gss_proxy RPC protocol is currently documented `here
<https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation>`_.”h]”(hŒ3The gss_proxy RPC protocol is currently documented ”…””}”(hj¶  hžhhŸNh Nubhî)”}”(hŒG`here
<https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation>`_”h]”hŒhere”…””}”(hj¾  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œhere”Œrefuri”Œ=https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation”uh1híhj¶  ubhŒtarget”“”)”}”(hŒ@
<https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation>”h]”h}”(h]”Œhere”ah ]”h"]”Œhere”ah$]”h&]”Œrefuri”jÏ  uh1jÐ  Œ
referenced”Khj¶  ubhŒ.”…””}”(hj¶  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KIhj—  hžhubh¸)”}”(hŒÓThis upcall mechanism uses the kernel rpc client and connects to the gssproxy
userspace program over a regular unix socket. The gssproxy protocol does not
suffer from the size limitations of the legacy protocol.”h]”hŒÓThis upcall mechanism uses the kernel rpc client and connects to the gssproxy
userspace program over a regular unix socket. The gssproxy protocol does not
suffer from the size limitations of the legacy protocol.”…””}”(hjê  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KLhj—  hžhubeh}”(h]”Œ#nfs-server-new-rpc-upcall-mechanism”ah ]”h"]”Œ#nfs server new rpc upcall mechanism”ah$]”h&]”uh1h¡hh£hžhhŸh¶h KDubh¢)”}”(hhh]”(h§)”}”(hŒNegotiating Upcall Mechanisms”h]”hŒNegotiating Upcall Mechanisms”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj   hžhhŸh¶h KQubh¸)”}”(hX  To provide backward compatibility, the kernel defaults to using the
legacy mechanism.  To switch to the new mechanism, gss-proxy must bind
to /var/run/gssproxy.sock and then write "1" to
/proc/net/rpc/use-gss-proxy.  If gss-proxy dies, it must repeat both
steps.”h]”hX
  To provide backward compatibility, the kernel defaults to using the
legacy mechanism.  To switch to the new mechanism, gss-proxy must bind
to /var/run/gssproxy.sock and then write â€œ1â€ to
/proc/net/rpc/use-gss-proxy.  If gss-proxy dies, it must repeat both
steps.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KShj   hžhubh¸)”}”(hX_  Once the upcall mechanism is chosen, it cannot be changed.  To prevent
locking into the legacy mechanisms, the above steps must be performed
before starting nfsd.  Whoever starts nfsd can guarantee this by reading
from /proc/net/rpc/use-gss-proxy and checking that it contains a
"1"--the read will block until gss-proxy has done its write to the file.”h]”hXc  Once the upcall mechanism is chosen, it cannot be changed.  To prevent
locking into the legacy mechanisms, the above steps must be performed
before starting nfsd.  Whoever starts nfsd can guarantee this by reading
from /proc/net/rpc/use-gss-proxy and checking that it contains a
â€œ1â€--the read will block until gss-proxy has done its write to the file.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KYhj   hžhubeh}”(h]”Œnegotiating-upcall-mechanisms”ah ]”h"]”Œnegotiating upcall mechanisms”ah$]”h&]”uh1h¡hh£hžhhŸh¶h KQubeh}”(h]”Œ)rpcsec-gss-support-for-kernel-rpc-servers”ah ]”h"]”Œ)rpcsec_gss support for kernel rpc servers”ah$]”h&]”uh1h¡hhhžhhŸh¶h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h¶uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¦NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j`  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h¶Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(j:  j7  j  j  j”  j‘  jý  jú  jÛ  jØ  j2  j/  uŒ	nametypes”}”(j:  ‰j  ‰j”  ‰jý  ‰jÛ  ˆj2  ‰uh}”(j7  h£j  j‡  j‘  j  jú  j—  jØ  jÒ  j/  j   uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.