http://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&feed=atom&action=historyArchitecture - PAG - Revision history2024-03-29T14:17:12ZRevision history for this page on the wikiMediaWiki 1.35.5http://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=10604&oldid=prevDocadmin at 21:20, 22 January 20102010-01-22T21:20:25Z<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 21:20, 22 January 2010</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1" >Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>'''''Note:''''' The content on this page reflects the state of design of a Lustre feature at a particular point in time and may contain outdated information. </div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>'''''Note:<ins class="diffchange diffchange-inline">''</ins>''' ''The content on this page reflects the state of design of a Lustre feature at a particular point in time and may contain outdated information.<ins class="diffchange diffchange-inline">'' </ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Linux Keyring ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Linux Keyring ==</div></td></tr>
</table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=10529&oldid=prevDocadmin: Protected "Architecture - PAG" ([edit=sysop] (indefinite) [move=sysop] (indefinite))2010-01-22T18:51:17Z<p>Protected "<a href="/index.php?title=Architecture_-_PAG" title="Architecture - PAG">Architecture - PAG</a>" ([edit=sysop] (indefinite) [move=sysop] (indefinite))</p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<tr class="diff-title" lang="en">
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 18:51, 22 January 2010</td>
</tr><tr><td colspan="2" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr></table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=10148&oldid=prevDocadmin at 00:18, 19 January 20102010-01-19T00:18:05Z<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 00:18, 19 January 2010</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1" >Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">'''''Note:''''' The content on this page reflects the state of design of a Lustre feature at a particular point in time and may contain outdated information. </ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Linux Keyring ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Linux Keyring ==</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr>
</table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=9934&oldid=prevDocadmin: /* Category */2010-01-14T23:47:12Z<p><span dir="auto"><span class="autocomment">Category</span></span></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 23:47, 14 January 2010</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l108" >Line 108:</td>
<td colspan="2" class="diff-lineno">Line 108:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>- find existing root context for RPC.<br></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>- find existing root context for RPC.<br></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>- server treat it as root access.<br></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>- server treat it as root access.<br></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">== Category ==</del></div></td><td colspan="2"> </td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">[[Category:Architecture|PAG]]</del></div></td><td colspan="2"> </td></tr>
</table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=9857&oldid=prevDocadmin: moved PAG to Architecture - PAG2010-01-14T21:43:34Z<p>moved <a href="/index.php?title=PAG&action=edit&redlink=1" class="new" title="PAG (page does not exist)">PAG</a> to <a href="/index.php?title=Architecture_-_PAG" title="Architecture - PAG">Architecture - PAG</a></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<tr class="diff-title" lang="en">
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 21:43, 14 January 2010</td>
</tr><tr><td colspan="2" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr></table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=9778&oldid=prevDocadmin: 1 revision2010-01-14T21:01:08Z<p>1 revision</p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<tr class="diff-title" lang="en">
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="1" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 21:01, 14 January 2010</td>
</tr><tr><td colspan="2" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr></table>Docadminhttp://wiki.old.lustre.org/index.php?title=Architecture_-_PAG&diff=9777&oldid=prevAdilger: Minor grammar changes2007-12-19T06:40:16Z<p>Minor grammar changes</p>
<p><b>New page</b></p><div>== Linux Keyring ==<br />
<br />
Lustre uses the Linux keyring facility in session based manner, which means a key is accessible only by processes which belong to a single session. Forked process will inherit its parent's keys. If the same user logs in<br />
twice it will result in two context negotiations with the Lustre server.<br />
<br />
Lustre treats the root user specially - all processes of the root user share a<br />
single key, regardless of session ID.<br />
<br />
<br />
== Setuid in Lustre ==<br />
<br />
Lustre authenticates users based on the real UID instead of fsuid. A process<br />
that changes its fsuid won't need extra authentication, but the server will<br />
detect the setuid attempt and perform according to preset rules. If the real<br />
UID is changed, the new UID has to be authenticated with the server before<br />
any further access is allowed.<br />
<br />
Usually a process has no reason to change its real UID alone (right?).<br />
In the case that a process of A sets its real UID to 0 (with fsuid still be A),<br />
the Lustre server will still treat it as root set fsuid to A.<br />
<br />
== Kerberos credential ==<br />
<br />
There are two possible ways to store Kerberos tickets which affect PAG behavior:<br />
<br />
1) on disk (/tmp/krb5cc_uid)<br />
root is able to read other user's tickets anyway. So root can<br />
impersonate other uses by simply "su", although it will initiate a new<br />
authentication, it can always succeed because it have access to on-disk<br />
kerberos tickets.<br />
<br />
2) in kernel memory<br />
A user can store kerberos ticket only in kernel memory via keyring<br />
facility, and only processes belongs to the same session could have<br />
access, even not root.<br />
<br />
== Use Case ==<br />
<br />
The use cases are based on method (2) above (store kerberos credential in kernel<br />
memory).<br />
<br />
1) root access<br><br />
- root process accesses Lustre for the first time.<br/><br />
- initiate an authentication of root with server.<br/><br />
- finish with success, store context in keyring.<br/><br />
- using the context for following RPCs.<br/><br />
- another root process (from the same session or not) access Lustre.<br/><br />
- find the existing context in kernel, use it for following RPCs.<br />
<br />
2) non-root access<br><br />
- user A logs into the system as session S1.<br><br />
- obtain kerberos TGT and store in kernel keyring.<br><br />
- user A accesses Lustre, which initiate an authentication of A.<br><br />
- the stored kerberos TGT is used in authentication.<br><br />
- upon successful completion, store context for S1.<br><br />
- using the context for following RPCs.<br><br><br />
- a new process forked in S1, which accesses Lustre also.<br><br />
- find the existing context of S1, use it for following RPCs.<br><br><br />
- user A login system from another tty as session S2.<br><br />
- user A in S2 accesses Lustre.<br><br />
- can't find existing context, initiate authentication of A.<br><br />
- can't find kerberos TGT, authentication failed.<br><br />
- access failed<br><br><br />
- in S2, A obtain TGT and store in kernel keyring.<br><br />
- user A in S2 access Lustre again.<br><br />
- can't find existing context, initiate authentication of A.<br><br />
- the stored kerberos TGT is used in authentication.<br><br />
- finish with success, store context for S2.<br><br />
- using the context for following RPCs.<br />
<br><br><br />
<br />
3) root try to act as A<br />
support both root and A have login system and authenticated with Lustre<br />
servers.<br />
<br />
3.1)<br><br />
- root set fsuid to A, access Lustre.<br><br />
- find existing root context for RPC.<br><br />
- server detect root try to setuid to A, grant or deny.<br />
<br />
3.2)<br><br />
- root set real uid to A, access Lustre.<br><br />
- can't find existing context, initiate authentication of A.<br><br />
- can't find kerberos TGT, authentication failed.<br><br />
- access failed.<br />
<br />
3.3)<br><br />
- root do "su - A", start a shell with new session.<br><br />
- access Lustre.<br><br />
- can't find existing context, initiate authentication of A.<br><br />
- can't find kerberos TGT, authentication failed.<br><br />
- access failed.<br />
<br />
4) user A setuid to root <br><br />
support both root and A have login system and authenticated with Lustre<br />
servers.<br />
<br />
4.1)<br><br />
- process of A set fsuid to root, access Lustre.<br><br />
- find existing context of A for this session for RPC.<br><br />
- server detect A try to setuid to root, grant or deny.<br><br />
4.2)<br><br />
- process of A set real uid to root, access Lustre.<br><br />
- find existing root context for RPC.<br><br />
- server treat it as root try to setuid to A, grant or deny.<br><br />
4.3)<br><br />
- process of A set real uid and fsuid to root, access Lustre.<br><br />
- find existing root context for RPC.<br><br />
- server treat it as root access.<br><br />
<br />
== Category ==<br />
[[Category:Architecture|PAG]]</div>Adilger