Documentation: nfs: idmapper: convert to ReST
Convert idmapper.txt to ReST and move it to admin-guide. Content remains mostly unchanged otherwise. Signed-off-by: Daniel W. S. Almeida <dwlsalmeida@gmail.com> Link: https://lore.kernel.org/r/069e40cd551ea778538f8fe9ad15ee26e45fc748.1578697871.git.dwlsalmeida@gmail.com Signed-off-by: Jonathan Corbet <corbet@lwn.net>
This commit is contained in:
parent
0f3456ba9f
commit
fbdcd0b8e5
|
@ -9,3 +9,4 @@ NFS
|
|||
nfsroot
|
||||
nfs-rdma
|
||||
nfsd-admin-interfaces
|
||||
nfs-idmapper
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
=============
|
||||
NFS ID Mapper
|
||||
=============
|
||||
|
||||
=========
|
||||
ID Mapper
|
||||
=========
|
||||
Id mapper is used by NFS to translate user and group ids into names, and to
|
||||
translate user and group names into ids. Part of this translation involves
|
||||
performing an upcall to userspace to request the information. There are two
|
||||
|
@ -20,22 +20,24 @@ legacy rpc.idmap daemon for the id mapping. This result will be stored
|
|||
in a custom NFS idmap cache.
|
||||
|
||||
|
||||
===========
|
||||
Configuring
|
||||
===========
|
||||
|
||||
The file /etc/request-key.conf will need to be modified so /sbin/request-key can
|
||||
direct the upcall. The following line should be added:
|
||||
|
||||
#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
|
||||
#====== ======= =============== =============== ===============================
|
||||
create id_resolver * * /usr/sbin/nfs.idmap %k %d 600
|
||||
``#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...``
|
||||
``#====== ======= =============== =============== ===============================``
|
||||
``create id_resolver * * /usr/sbin/nfs.idmap %k %d 600``
|
||||
|
||||
|
||||
This will direct all id_resolver requests to the program /usr/sbin/nfs.idmap.
|
||||
The last parameter, 600, defines how many seconds into the future the key will
|
||||
expire. This parameter is optional for /usr/sbin/nfs.idmap. When the timeout
|
||||
is not specified, nfs.idmap will default to 600 seconds.
|
||||
|
||||
id mapper uses for key descriptions:
|
||||
id mapper uses for key descriptions::
|
||||
|
||||
uid: Find the UID for the given user
|
||||
gid: Find the GID for the given group
|
||||
user: Find the user name for the given UID
|
||||
|
@ -45,23 +47,24 @@ You can handle any of these individually, rather than using the generic upcall
|
|||
program. If you would like to use your own program for a uid lookup then you
|
||||
would edit your request-key.conf so it look similar to this:
|
||||
|
||||
#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
|
||||
#====== ======= =============== =============== ===============================
|
||||
create id_resolver uid:* * /some/other/program %k %d 600
|
||||
create id_resolver * * /usr/sbin/nfs.idmap %k %d 600
|
||||
``#OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...``
|
||||
``#====== ======= =============== =============== ===============================``
|
||||
``create id_resolver uid:* * /some/other/program %k %d 600``
|
||||
``create id_resolver * * /usr/sbin/nfs.idmap %k %d 600``
|
||||
|
||||
|
||||
Notice that the new line was added above the line for the generic program.
|
||||
request-key will find the first matching line and corresponding program. In
|
||||
this case, /some/other/program will handle all uid lookups and
|
||||
/usr/sbin/nfs.idmap will handle gid, user, and group lookups.
|
||||
|
||||
See <file:Documentation/security/keys/request-key.rst> for more information
|
||||
See Documentation/security/keys/request-key.rst for more information
|
||||
about the request-key function.
|
||||
|
||||
|
||||
=========
|
||||
nfs.idmap
|
||||
=========
|
||||
|
||||
nfs.idmap is designed to be called by request-key, and should not be run "by
|
||||
hand". This program takes two arguments, a serialized key and a key
|
||||
description. The serialized key is first converted into a key_serial_t, and
|
Loading…
Reference in a new issue