[LU-14263] Kerberos ticket renewal not processed by lustre

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.14.0
• Affects Version/s: Lustre 2.14.0, Lustre 2.12.6
• Labels: sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Sumary: lustre seems to ignore a kerberos ticket being renewed

1. First testFilesystem access is lost after 200s, ticket renewed at 100s

$ lfs flushctx -k
$ keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}')
$ kinit -l 00:03 -r 00:10
$ keyctl reap
$ date; ls /home | wc -l; sleep 100; date; kinit -R -c /tmp/krb5cc_81265; ls /home | wc -l; sleep 100; date; ls /home | wc -l
Wed Dec 16 16:28:30 CET 2020
73
Wed Dec 16 16:30:10 CET 2020
73
Wed Dec 16 16:31:50 CET 2020
ls: cannot access '/home': Connection refused
0

1. Second test which does regain filesystem access after issuing 'keyctl clear XXX; keyctl reap' right after ticket renewal (we didn't test if this can be done automatically).

$ lfs flushctx -k
$ keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}')
$ kinit -l 00:03 -r 00:10
$ keyctl reap
$ date; ls /home | wc -l; sleep 100; date; kinit -R -c /tmp/krb5cc_81265; echo CLEAR; keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}'); keyctl reap; ls /home | wc -l; sleep 100; date; ls /home | wc -l
Wed Dec 16 16:57:12 CET 2020
73
Wed Dec 16 16:58:52 CET 2020
CLEAR
0 keys reaped
73
Wed Dec 16 17:00:33 CET 2020
73

Comments

[Peter Jones]

Landed for 2.14

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/41047/
Subject: LU-14263 gss: unlink revoked key
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: c246a9ba041d651c4fae324284f7bbd97500998b

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: https://review.whamcloud.com/41047
Subject: LU-14263 gss: unlink revoked key
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 63ca5a63a6a56b1f3fbaf1e2ecd1be2965253b94