On Tue, Feb 24, 2009 at 09:08:57PM -0800, Russ Allbery wrote: > david l goodrich <d...@dsrw.org> writes: > > > It's a custom kernel, because it's a Xen domU. Which probably invites > > all kinds of pain. But its config file is used in a different Xen domU, > > which works fine. I've attached it, I'm not very adept at reading these > > files. It works for me, so I just copy it to my new systems and build > > the kernel with whatever version of gcc the new machine requires. > > Indeed, the kernel isn't built with keyring support: > > > # > > # Security options > > # > > # CONFIG_KEYS is not set > > CONFIG_KEYS is the relevant setting. > > Now, that doesn't explain why it's working elsewhere, particularly if the > same versions of everything are involved. In some ways, it raises more > questions than it answers, such as how you're getting PAGs at all since > the other way of doing them isn't exported in current kernels (but it may > be that this is an older version). However, I suspect that if you enable > CONFIG_KEYS and build an AFS kernel module against the resulting kernel, > you'll find that this starts working. > > If I had to guess, I'd say that the AFS module is managing to create the > group for the PAG but failing to hook into setgroups, so then when ssh > calls setgroups, it blows away the PAG again and you lose access to your > token. No idea why that isn't happening on your other systems too. > > It's likely that OpenAFS will completely drop support for kernels without > keyring support in some future version, since doing anything else is just > too ugly and is explicitly not supported by the Linux kernel developers.
Success! Setting CONFIG_KEYS=y and rebuilding the kernel solved the problem: d...@chaos:~$ id uid=1000(dlg) gid=1000(dlg) groups=1000(dlg),1101353942 d...@chaos:~$ tokens Tokens held by the Cache Manager: User's (AFS ID 1000) tokens for a...@dsrw.org [Expires Feb 26 08:21] --End of list-- d...@chaos:~$ keyctl show Session Keyring -3 --alswrv 0 0 keyring: _ses.16448 12 ----s--v 0 0 \_ afs_pag: _pag d...@chaos:~$ Thanks so much for all your help, this has stumped me for quite some time. --david -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org