Bug 415625 – net-fs/nfs-utils should install /etc/request-key.d/id_resolver.conf file so idmap works with new in-kernel idmapper

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Maciej S. Szmigiero 2012-05-12 20:56:04 UTC]

When "Use the new idmapper upcall routine" (CONFIG_NFS_USE_NEW_IDMAPPER) is selected in the kernel configuration the NFS routines use key subsystem to resolve and cache name <-> ID mappings.

This requires the /sbin/request-key to dispatch the request to nfsidmap,
which in turn requires the "create    id_resolver    *    *    /usr/sbin/nfsidmap %k %d 600" to be added either to /etc/request-key.conf (as stated in nfsidmap man page), or, better, to a new /etc/request-key.d/id_resolver.conf file.

Currently, net-fs/nfs-utils ebuilds do not do that, which causes chown/chgrp on files on NFS4 mounts to fail with "Invalid argument" on such kernels.

[Comment 1 SpanKY 2012-05-17 05:35:27 UTC]

CONFIG_NFS_USE_NEW_IDMAPPER is dead.  the behavior is automagic now, so configuring keyutils is not required.  see Bug 413173 where this was covered.

[Comment 2 Justus Ranvier 2012-05-17 05:40:42 UTC]

(In reply to comment #1)
> CONFIG_NFS_USE_NEW_IDMAPPER is dead.  the behavior is automagic now, so
> configuring keyutils is not required.  see Bug 413173 where this was covered.

I believe it's still necessary to have a correctly-configured /etc/request-key.conf to use the new upcall behavior, otherwise the kernel will fall back to the old behavior. Everything works correctly if a single missing line is added to /etc/request-key.conf

[Comment 3 SpanKY 2012-05-17 05:42:52 UTC]

yes, the config is needed for the upcall, but the point is that things don't fail if the file isn't there

[Comment 4 Maciej S. Szmigiero 2012-05-18 00:33:21 UTC]

Hello and thanks for quick answer,

First, I see that newly added to the tree ebuild for nfs-utils-1.2.6 installs "/etc/request-key.d/50_id_resolver.conf".

Unfortunately, this does not work as request-key searches for exact name "/etc/request-key.d/<keytype>.conf" (see man 8 request-key) - it can't have any prefix (or postfix, to be exact).

Second, the nfsidmap invocation has actually changed in this very version, and now it needs "create    id_resolver    *    *    /usr/sbin/nfsidmap -t 600 %k %d" (it's minus "t" before 600 now).

[Comment 5 SpanKY 2012-05-18 05:14:54 UTC]

Commit message: Update request-key.d config settings
http://sources.gentoo.org/net-fs/nfs-utils/nfs-utils-1.2.6.ebuild?r1=1.2&r2=1.3