Re: Summary of nfsd chages.

G. Allen Morris III (gam3@dharma.sehda.com)
Thu, 10 Sep 1998 16:52:48 -0700


>>>H.J. Lu said:
> >
> > ------- Forwarded Message
> >
> > 1) knfsd will allow multiple exports of a single partition. The mounts
> > must be proper subsets of the partition.
> >
> > NOTE: It may be possible to access any file on a partition using
> > the least restrictive export permissions.
>
> What do you mean by this? Could you please give me some examples to
> show the difference between with and without your patch?

I fixed this piece of code in "export.c" line 186.

On a computer with only one filesystem, you can (after the patch) export
/usr and /home where before the patch you would only be able to export one
or the other. Or you could export / and mount /usr and /home (and this
leds us to fix #2 below).

if ((exp = exp_find(clp, dev)) != NULL) {
/* Ensure there's only one export per FS. */
err = -EPERM;
if (exp->ex_ino == ino) {
exp->ex_flags = nxp->ex_flags;
exp->ex_anon_uid = nxp->ex_anon_uid;
exp->ex_anon_gid = nxp->ex_anon_gid;
err = 0;
}
goto out_unlock;
}

>
> >
> > 2) knfsd will allow mounts above the export point. That is if you
> > export / and /usr is in the same partition you can mount /usr.
>
> It works now.

Well it doesn't work for me. And this bit of code from "export.c" line 402
shows why:

int
exp_rootfh(struct svc_client *clp, kdev_t dev, ino_t ino, struct knfs_fh *f)
{
struct svc_export *exp;
struct dentry *dentry;
struct inode *inode;
struct svc_fh fh;

dprintk("nfsd: exp_rootfh(%s:%x/%ld)\n", clp->cl_ident, dev, ino);

exp = exp_get(clp, dev, ino);
if (!exp)
return -EPERM;
...

If there is not an export with the dev _and_ ino of the mount exp_get will
not find it. This is what took the most code to fix.

Also kmountd is broken. It will not call getfh unless it finds an entry
in the xtab that is the same as the mount point.

In "knfsd/util/mountd/auth.c" line 64 we have:

if (!(exp = export_find(hp, path))) {
xlog(L_WARNING, "refused %s request from %s: no export entry",
what, hp->h_name);
return NULL;
}

export_find does a strcmp(path, exp->m_export.e_path) for each entry in
exportlist (see: "knfsd/support/export/export.c" line 123)

>
> >
> > 3) You can now export and mount regular files. (It is not clear if
> > they can be used for swap.)
> >
>
> It works. But the mounting point has to be a directory. I cannot
> get swap to work on any NFS mounted file/directory.
>

In "export.c" line 217 we have this code.

/* We currently export only dirs. */
err = -ENOTDIR;
if (!S_ISDIR(inode->i_mode))
goto finish;

I changed it to allow for S_ISREG. It seems to work.

>
> > 4) knfsd does not return EACCESS when you try to access a `covered'
> > directory. Instead knfsd allows nfs to access these directories.
> > (I believe that this is what SunOS 4 does.)
> >
>

In "vfs.c" line 173 we have this bit of code.

/*
* Make sure we haven't crossed a mount point ...
*/
if (dchild->d_sb != dparent->d_sb) {
#ifdef NFSD_PARANOIA
printk("nfsd_lookup: %s/%s crossed mount point!\n", dparent->d_name.name, name);
#endif
[return nfserr_acces]
}

It cause mount to fail. so if /usr/src is on a different filesytem than
/usr and you want to have the complete /usr tree mounted on a remote computer
the `mount x:/usr /usr' works, but `mount x:/usr/src /usr/src' fails.

This patch seems to be the most controversial. I think it is the best
solution. For several reasons.

I hope this makes the changes more clear.

Allen

---------------------------------
G. Allen Morris III

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/faq.html