Messages in this thread | | | Date | Thu, 17 Nov 2011 14:13:38 +0100 | From | John Hughes <> | Subject | Re: [PATCH] Don't hang user processes if Kerberos ticket for nfs4 mount expires |
| |
On 17/11/11 12:05, John Hughes wrote: > On 17/11/11 02:38, Jeff Layton wrote: >> Note too that the gssd code distinguishes between an expired TGT and a >> non-existent credcache. The latter will give you the error you desire >> here. So one possibility is just to remove the credcache from /tmp in >> this situation. > > Something to scan /tmp for expired credentials and zap em? rpc.gssd > would communicate that to the kernel? > > Whadaya know, that works. Here's a dumb perl script that could be run from, for example, .xsession to automatically destroy expired ticket caches.
Would need a bit of trickery to make it go away on end of session and something in /etc/pm/sleep.d to send it a SIGALRM when the system wakes from suspend or hibernate.
It has a potential race between destroying an expired ticket and a new ticket being granted.
I guess now I'll look at a hack to rpc.gssd for a neater way of doing this.
#! /usr/bin/perl -w
my $ALARMED = 0;
$SIG{ALRM} = sub { ++$ALARMED; };
use POSIX qw(mktime);
# Work out ticket expiry
# Valid starting Expires Service principal # 11/17/11 10:34:23 11/17/11 20:34:23 krbtgt/CALVAEDI.COM@CALVAEDI.COM # renew until 11/18/11 10:34:23 # 11/17/11 10:34:23 11/17/11 20:34:23 nfs/olympic.calvaedi.com@CALVAEDI.COM # renew until 11/18/11 10:34:23 # 11/17/11 11:24:24 11/17/11 20:34:23 host/olympic.calvaedi.com@CALVAEDI.COM # renew until 11/18/11 10:34:23
# Eurgh - non localised, US format dates.
sub expiry { local *KLIST; open KLIST, "/usr/bin/klist | " or return; my $expiry; while (<KLIST>) { if (m((\d+)/(\d+)/(\d+) (\d+):(\d+):(\d+) krbtgt)) { $expiry = mktime ($6, $5, $4, $2, $1 - 1, 100 + $3); last; } }
$expiry; }
for (;;) { my $sleepytime = 60;
my $expiry = expiry (); if (defined $expiry) { my $left = $expiry - time; if ($left <= 0) { # Ticket expired, zap it. Potential race with # new ticket creation. print "Destroy expired ticket\n"; system "/usr/bin/kdestroy"; } else { $sleepytime = $left; } }
if ($ALARMED) { $ALARMED = 0; next; }
# If machine freezes during this sleap how long will # it sleep for? print "Sleeping for $sleepytime seconds\n"; sleep $sleepytime; }
| |