summaryrefslogtreecommitdiffstats
path: root/usr.sbin/mountd
Commit message (Collapse)AuthorAgeFilesLines
* Implement support for RPCSEC_GSS authentication to both the NFS clientdfr2008-11-032-6/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month
* - more mark-up fixesdanger2008-07-011-8/+6
| | | | Submitted by: ru
* - add some missing wordsdanger2008-06-301-25/+44
| | | | | | | | | - we don't have ne(4), replace it with re(4) - fix markup - bump date Submitted by: ru MFC after: 3 days
* - markup fixesdanger2008-06-271-15/+68
| | | | | | | | | | - advise to use rc script to SIGHUP mountd - add information about possiblity of using /prefix network notation [1] PR: docs/124373 Reviewed by: jhb Obtained from: NetBSD [1] MFC after: 3 days
* Remove hacks which filter out MNT_ROOTFS.rodrigc2008-03-051-15/+1
| | | | | | | They are no longer needed now that we filter out MNT_ROOTFS inside the nmount() call in revision 1.267 of vfs_mount.c. Reviewed by: rink
* Use the correct variable to check for a malloc failing. This fixes asimon2007-10-271-1/+1
| | | | | case where mountd would fail to start with "out of memory" logged to syslog.
* Add the -h <bindip> option to mountd, similar to the one in nfsd(8)matteo2007-10-202-160/+340
| | | | | | | | | | | | | -h bindip Specify specific IP addresses to bind to for TCP and UDP requests. This option may be specified multiple times. If no -h option is specified, mountd will bind to INADDR_ANY. Note that when specifying IP addresses with -h, mountd will automatically add 127.0.0.1 and if IPv6 is enabled, ::1 to the list. PR: bin/114097 Reviewed by: pjd (an eariler version of the patch) MFC after: 1 week
* Fatal error is only when cannot open any of the given exports files.pjd2007-04-131-2/+9
|
* Grr, committed manual page without the last change - make the comment a bitpjd2007-02-031-1/+1
| | | | prettier.
* Add support for multiple exports files. This will be useful for example forpjd2007-02-032-125/+145
| | | | | | | ZFS, where we have automatically generated /etc/zfs/exports file, which should not be edited directly. Discussed with: rwatson
* If nmount() fails to export a directory, in the syslog() error message,rodrigc2007-01-261-2/+4
| | | | add the errmsg string returned by nmount().
* Ignore SIGPIPE, instead of terminating process.rodrigc2006-11-181-0/+1
| | | | | | PR: 81230 Submitted by: Dmitrij Tejblum <tejblum yandex-team ru> MFC after: 1 month
* My previous commit made it impossible to export / over NFS; this smallrink2006-10-191-1/+6
| | | | | | | | | | | change fixes this. Reported by: Lin Jui-Nan Eric < ericlin dot jnlin at gmail dot com > Submitted by: Erik Trulsson < ertr1013 at student dot uu dot se > (commit is inspired by a patch from Erik) Pointyhat to: me Reviewed by: stable@ Approved by: imp (mentor) MFC after: 3 days
* Prevent mountd(8) from resetting mount options when exporting a filesystem.rink2006-10-091-1/+1
| | | | | | Approved by: imp (mentor) Sponsored by: Quality Service Provider BV MFC after: 3 days
* In get_exportlist(), properly loop over mounted filesystems.rodrigc2006-07-081-5/+4
| | | | | PR: bin/99873 Submitted by: Danny Braniss <danny at cs dot huji dot ac dot il>
* For network filesystems (NFS, samba, etc.), do not pass "export" nmount()rodrigc2006-06-061-0/+15
| | | | | | | | parameter to try to delete an NFS export. It won't work, and will log a spurious warning to syslog. Tested by: Arno J. Klaassen <arno at heho dot snv dot jussieu dot fr> MFC after: 3 days
* Do not log "can't delete export" messages if nmount() returns ENOTSUP.rodrigc2006-05-281-1/+1
| | | | | This eliminates spurious log entries for trying to delete exports for filesystems like devfs and procfs.
* Convert to nmount() and remove hardcoded checks for ufs, msdosfs, ntfs,rodrigc2006-05-241-25/+19
| | | | | | and cd9660. PR: bin/97642
* Convert mountd to nmount(). Remove some hardcoded dependenciesrodrigc2006-05-232-69/+142
| | | | on ufs, cd9660, msdosfs, and ntfs, but not all dependencies.
* Note that when -d flag is used, mountd(8) will not detach from thekeramida2006-05-021-1/+4
| | | | | | | | controlling terminal. PR: docs/96660 Submitted by: Jeff Ito <ijk@speakeasy.net> MFC after: 1 week
* Use ".Pa" for path names.jkoshy2006-01-291-12/+12
| | | | MFC after: 3 days
* Pidfiles should be created with permission preventing users from openingpjd2005-09-161-1/+1
| | | | | | | them for reading. When user can open file for reading, he can also flock(2) it, which can lead to confusions. Pointed out by: green
* Use pidfile(3) in mountd(8). There is no need to use /var/run/mountd.lockpjd2005-08-242-17/+16
| | | | anymore.
* NI_WITHSCOPEID cleanup. Neither RFC 2553 nor RFC 3493 definesume2005-05-131-7/+2
| | | | | NI_WITHSCOPEID, and our getaddrinfo(3) does nothing special for it, now.
* Remove unused variables.stefanf2005-04-091-2/+0
|
* Sort sections.ru2005-01-181-3/+3
|
* Also do not send junk mount arguments when removing exports.phk2004-12-111-0/+1
|
* Pass an array of gid_t rather than an array of int to getgroups().stefanf2004-10-021-2/+3
| | | | PR: 56646
* Per letter dated July 22, 1999 remove 3rd clause of Berkeley derived softwareimp2004-08-075-20/+1
| | | | (with permission of addtional copyright holders where appropriate)
* Markup nits.ru2004-06-041-2/+2
|
* Correct typo in the last revision.ceri2004-03-271-1/+1
|
* Note that only one webnfs share is allowed per NFS server.ceri2004-03-221-0/+3
| | | | | | | PR: docs/45371 Submitted by: Mattias Pantzare <pantzer@ludd.luth.se>, Matthew D. Fuller <fullermd@over-yonder.net> MFC after: 2 days
* Make NULL a (void*)0 whereever possible, and fix the warnings(-Werror)markm2004-03-051-1/+1
| | | | | | | | | | | | | | | that this provokes. "Wherever possible" means "In the kernel OR NOT C++" (implying C). There are places where (void *) pointers are not valid, such as for function pointers, but in the special case of (void *)0, agreement settles on it being OK. Most of the fixes were NULL where an integer zero was needed; many of the fixes were NULL where ascii <nul> ('\0') was needed, and a few were just "other". Tested on: i386 sparc64
* Add a new option to mountd(8), -p <port>. This allows the user to specifybms2004-03-042-7/+76
| | | | | | | a known port for use in firewall rulesets; otherwise the port is chosen at run-time by bindresvport(). MFC after: 1 week
* Be consistent in the EXAMPLES formatting.obrien2004-01-011-0/+1
|
* Rename the 'log' variable rather than -fno-builtin-logpeter2003-10-302-8/+7
|
* Use -fno-builtin-log. Fix svc_sendreply() missing required casts.peter2003-10-262-13/+17
| | | | It is now WARNS=2 clean again.
* When reporting errors binding IPv6 TCP sockets, don't call them UDPrwatson2003-07-171-3/+3
| | | | | | | | sockets in the printf. Fix two minor co-located whitespace glitches. Product of: France
* style.Makefile(5)obrien2003-04-041-1/+2
|
* Implement nonblocking tpc-connections. rpcgen -m does stillmbr2003-01-161-2/+7
| | | | | | | | produce backcompatible code. Reviewed by: rwatson Obtained from: NetBSD MFC after: 1 day
* english(4) police.schweikh2002-12-271-1/+1
|
* Uniformly refer to a file system as "file system".ru2002-12-122-23/+23
| | | | Approved by: re
* s/rpc.mountd/mountd/charnier2002-10-161-5/+6
| | | | | Add FBSDID Reorder #if/#endif around sccsid to conform style(9)
* Use the standardized CHAR_BIT constant instead of NBBY in userland.mike2002-09-251-2/+3
|
* Kerberised NFS has never (as far as I can tell) worked outsidemarkm2002-09-201-12/+2
| | | | | | BSD 4.4. Nuke mention of Kerberos from the documentation here. MFC after: 1 week
* Update manpage to match the code, vfsload() isn't usedmux2002-08-111-4/+2
| | | | here since some time, kldload() is used instead.
* use IPV6_V6ONLY instead of non standard IPV6_BINDV6ONLY.ume2002-07-221-2/+2
| | | | MFC after: 1 week
* Try to give a more descriptive error message for the pilot error ofjoerg2002-07-182-25/+81
| | | | | | | | | | | | | | | | | | | | | | | | attempting to export the non-root of a filesystem with -alldirs. This pilot error seems to be very common, and the "could not remount" error message doesn't give much hints about the real reason. See the old PR below for an example. While i was at it, make it possible to entirely omit the often annoying error message in that case by specifying the "quiet" exports flag. This allows to specify something like /cdrom -alldirs,ro,quiet <where to export to> which will silently fail if nothing is mounted under /cdrom, but do the rigth thing as soon as you mount something. While doing this, i've put the embedded example in the exports(5) man page into a subsection of its own as it ought to be. Thanks for Paul Southworth for reminding me about this problem. PR: bin/4448 MFC after: 1 month
* If an RPC fails, try a shorter reply in case the fault lies with thealfred2002-07-151-10/+39
| | | | | | | size of the response. PR: misc/26320 MFC After: 2 weeks
* The .Nm utilitycharnier2002-07-061-2/+3
|
OpenPOWER on IntegriCloud