Re: nfs client 'nobody no matter what' clarification was Re: k5userok .c / doc mismatch

On 10/15/2011 2:00 PM, [email protected] wrote:
> On Fri, Oct 14, 2011 at 05:29:50PM -0500, Harry Coin wrote:
>> I'd be grateful to anyone who could point me to
>> a single option somewhere that lets me 'recompile the freebsd kernel and
>> userland world' with MIT's version.
> Curious why you are looking for using MIT for _all_ applications,
> it looks like you depend on a certain (or a few) one(s) doing wrong.

Freebsd embeds a fair fraction of kerberos in the kernel, along with a 
big part of NFS as well.   I'd rather the system be entirely one or the 
other.   However, at present it looks like implementing the 
/etc/k5login.d, kuserok looking first there for username then content 
matching, while aname_to_local will look through the .k5login content 
and return the filename==username on match.  Solves the 'no default 
directory' problem, and even gives admins a way to remove .k5login 
capability from account owners.. just create an empty file with the 
username in /etc/k5login.d.



>
> Technically it is no problem to let any application use any arbitrary
> set of libraries (even though the traditional practices make this hard -
> this is not hard and is quite useful when done consequently).
>
> Besides this it can happen that you are trying to solve problems stemming
> from certain design choices. Your (now unmet) expectations from Kerberos
> might have led you off the right road in a early design stage.
>
> It may be even so that MIT will reveal other limitations relevant for
> your situation, which you are not yet aware of. Just a word of caution.

Thanks, looks like either road has some bumps to navigate.   I'd prefer 
a couple of patches here in heimdal as it appears these are the last 
I'll be needing.

Harry