Commit fbdcd0b8 authored by Daniel W. S. Almeida's avatar Daniel W. S. Almeida Committed by Jonathan Corbet
Browse files

Documentation: nfs: idmapper: convert to ReST 



Convert idmapper.txt to ReST and move it to admin-guide.
Content remains mostly unchanged otherwise.

Signed-off-by: default avatarDaniel W. S. Almeida <dwlsalmeida@gmail.com>
Link: https://lore.kernel.org/r/069e40cd551ea778538f8fe9ad15ee26e45fc748.1578697871.git.dwlsalmeida@gmail.com


Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
parent 0f3456ba

Documentation/admin-guide/nfs/index.rst

+1 −0
Original line number Diff line number Diff line
@@ -9,3 +9,4 @@ NFS 
    nfsroot

    nfs-rdma

    nfsd-admin-interfaces

    nfs-idmapper

Documentation/filesystems/nfs/idmapper.txt→Documentation/admin-guide/nfs/nfs-idmapper.rst

+17 −14
Original line number Diff line number Diff line 
=============

NFS ID Mapper

=============



=========

ID Mapper

=========

Id mapper is used by NFS to translate user and group ids into names, and to

translate user and group names into ids.  Part of this translation involves

performing an upcall to userspace to request the information.  There are two
@@ -20,22 +20,24 @@ legacy rpc.idmap daemon for the id mapping. This result will be stored 
in a custom NFS idmap cache.





===========

Configuring

===========



The file /etc/request-key.conf will need to be modified so /sbin/request-key can

direct the upcall.  The following line should be added:



#OP	TYPE	DESCRIPTION	CALLOUT INFO	PROGRAM ARG1 ARG2 ARG3 ...

#======	=======	===============	===============	===============================

create	id_resolver	*	*		/usr/sbin/nfs.idmap %k %d 600

``#OP	TYPE	DESCRIPTION	CALLOUT INFO	PROGRAM ARG1 ARG2 ARG3 ...``

``#======	=======	===============	===============	===============================``

``create	id_resolver	*	*		/usr/sbin/nfs.idmap %k %d 600``





This will direct all id_resolver requests to the program /usr/sbin/nfs.idmap.

The last parameter, 600, defines how many seconds into the future the key will

expire.  This parameter is optional for /usr/sbin/nfs.idmap.  When the timeout

is not specified, nfs.idmap will default to 600 seconds.



id mapper uses for key descriptions:

id mapper uses for key descriptions::



	  uid:  Find the UID for the given user

	  gid:  Find the GID for the given group

	 user:  Find the user  name for the given UID
@@ -45,23 +47,24 @@ You can handle any of these individually, rather than using the generic upcall 
program.  If you would like to use your own program for a uid lookup then you

would edit your request-key.conf so it look similar to this:



#OP	TYPE	DESCRIPTION	CALLOUT INFO	PROGRAM ARG1 ARG2 ARG3 ...

#======	=======	===============	===============	===============================

create	id_resolver	uid:*	*		/some/other/program %k %d 600

create	id_resolver	*	*		/usr/sbin/nfs.idmap %k %d 600

``#OP	TYPE	DESCRIPTION	CALLOUT INFO	PROGRAM ARG1 ARG2 ARG3 ...``

``#======	=======	===============	===============	===============================``

``create	id_resolver	uid:*	*		/some/other/program %k %d 600``

``create	id_resolver	*	*		/usr/sbin/nfs.idmap %k %d 600``





Notice that the new line was added above the line for the generic program.

request-key will find the first matching line and corresponding program.  In

this case, /some/other/program will handle all uid lookups and

/usr/sbin/nfs.idmap will handle gid, user, and group lookups.



See <file:Documentation/security/keys/request-key.rst> for more information

See Documentation/security/keys/request-key.rst for more information

about the request-key function.





=========

nfs.idmap

=========



nfs.idmap is designed to be called by request-key, and should not be run "by

hand".  This program takes two arguments, a serialized key and a key

description.  The serialized key is first converted into a key_serial_t, and

CRA Git | Maintained and supported by SUSTech CRA and CCSE