| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667 |
- =========
- ID Mapper
- =========
- Id mapper is used by NFS to translate user and group ids into names, and to
- translate user and group names into ids. Part of this translation involves
- performing an upcall to userspace to request the information. Id mapper will
- user request-key to perform this upcall and cache the result. The program
- /usr/sbin/nfs.idmap should be called by request-key, and will perform the
- translation and initialize a key with the resulting information.
- NFS_USE_NEW_IDMAPPER must be selected when configuring the kernel to use this
- feature.
- ===========
- Configuring
- ===========
- The file /etc/request-key.conf will need to be modified so /sbin/request-key can
- direct the upcall. The following line should be added:
- #OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
- #====== ======= =============== =============== ===============================
- create id_resolver * * /usr/sbin/nfs.idmap %k %d 600
- This will direct all id_resolver requests to the program /usr/sbin/nfs.idmap.
- The last parameter, 600, defines how many seconds into the future the key will
- expire. This parameter is optional for /usr/sbin/nfs.idmap. When the timeout
- is not specified, nfs.idmap will default to 600 seconds.
- id mapper uses for key descriptions:
- uid: Find the UID for the given user
- gid: Find the GID for the given group
- user: Find the user name for the given UID
- group: Find the group name for the given GID
- You can handle any of these individually, rather than using the generic upcall
- program. If you would like to use your own program for a uid lookup then you
- would edit your request-key.conf so it look similar to this:
- #OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
- #====== ======= =============== =============== ===============================
- create id_resolver uid:* * /some/other/program %k %d 600
- create id_resolver * * /usr/sbin/nfs.idmap %k %d 600
- Notice that the new line was added above the line for the generic program.
- request-key will find the first matching line and corresponding program. In
- this case, /some/other/program will handle all uid lookups and
- /usr/sbin/nfs.idmap will handle gid, user, and group lookups.
- See <file:Documentation/security/keys-request-keys.txt> for more information
- about the request-key function.
- =========
- nfs.idmap
- =========
- nfs.idmap is designed to be called by request-key, and should not be run "by
- hand". This program takes two arguments, a serialized key and a key
- description. The serialized key is first converted into a key_serial_t, and
- then passed as an argument to keyctl_instantiate (both are part of keyutils.h).
- The actual lookups are performed by functions found in nfsidmap.h. nfs.idmap
- determines the correct function to call by looking at the first part of the
- description string. For example, a uid lookup description will appear as
- "uid:user@domain".
- nfs.idmap will return 0 if the key was instantiated, and non-zero otherwise.
|
