Bug#867067: nfs-kernel-server: nfsdcltrack fails to init database

[Sergio Gelato]

I have empirical reasons to believe that the fix for CVE-2019-3689 (cf. #940848)
will take care of this bug as well.

Bug#867067: nfs-kernel-server: nfsdcltrack fails to init database

[Kurt Roeckx]

This problem is still present in buster.

The relevant strace output seems to be:
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = 0
capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=0, 
inheritable=0}) = 0
access("/var/lib/nfs/nfsdcltrack", W_OK) = -1 ENOENT (No such file or directory)
lstat("/var/lib/nfs/nfsdcltrack/main.sqlite", 0x7fffcc2d1530) = -1 ENOENT (No 
such file or directory)
getpid()= 9566
getpid()= 9566
openat(AT_FDCWD, "/var/lib/nfs/nfsdcltrack/main.sqlite", 
O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/var/lib/nfs/nfsdcltrack/main.sqlite", O_RDONLY|O_CLOEXEC) = 
-1 ENOENT (No such file or directory)
mkdir("/var/lib/nfs/nfsdcltrack", 0700) = -1 EACCES (Permission denied)

So my understanding is that it's dropping priviledges, and
/var/lib/nfs is owned by statd, but nfsdcltrack is probably run
as root instead.


Kurt

Bug#867067: nfs-kernel-server: nfsdcltrack fails to init database

[Stephen Guzik]

Package: nfs-kernel-server
Version: 1:1.3.4-2.1
Severity: important

Dear Maintainer,

On a new 'stretch' install, starting or restarting nfs-server.service
reports:
Jul 03 12:25:03 tuxe3 nfsdcltrack[4101]: Failed to init database: -13
Jul 03 12:25:03 tuxe3 systemd[1]: Started NFS server and services.
Jul 03 12:25:03 tuxe3 kernel: NFSD: Using /var/lib/nfs/v4recovery as the
NFSv4 state recovery directory

An far as I can tell, everything related to nfs seems to be working in
standard conditions.  Have not tested conditions nfsdcltrack appears
designed to address.  Not sure if an alternate method is used in 3rd
line above.

During install, error message was more troubling:
Job for nfs-server.service failed because the control process exited
with error code.
See "systemctl status nfs-server.service" and "journalctl -xe" for details.
nfs-server.service couldn't start.

Only error in logs is same as noted above.  After configuring, nfs
appears to work but error regarding failure to init database persists.

 may be related?

-- Package-specific info:
-- /etc/default/nfs-kernel-server --
RPCNFSDCOUNT=8
RPCNFSDPRIORITY=0
RPCMOUNTDOPTS="--manage-gids"
NEED_SVCGSSD="yes"
RPCSVCGSSDOPTS=""

-- System Information:
Debian Release: 9.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-3-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages nfs-kernel-server depends on:
ii  init-system-helpers  1.48
ii  keyutils 1.5.9-9
ii  libblkid12.29.2-1
ii  libc62.24-11+deb9u1
ii  libcap2  1:2.25-1
ii  libsqlite3-0 3.16.2-5
ii  libtirpc10.2.5-1.2
ii  libwrap0 7.6.q-26
ii  lsb-base 9.20161125
ii  netbase  5.4
ii  nfs-common   1:1.3.4-2.1
ii  ucf  3.0036

nfs-kernel-server recommends no packages.

nfs-kernel-server suggests no packages.

-- no debconf information