Performing verification for jammy. I set up a fresh jammy VM with the same reproducer as documented in https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914
The kernel is the latest 5.15.0-140-generic from -updates. $ uname -rv 5.15.0-140-generic #150-Ubuntu SMP Sat Apr 12 06:00:09 UTC 2025 cifs-utils is 2:6.14-1ubuntu0.1 from -updates. $ apt-cache policy cifs-utils | grep Installed cifs-utils: Installed: 2:6.14-1ubuntu0.1 We kinit and get a tgt: root@jammy-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 19 days on Wed Jun 11 05:39:46 2025 root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:21:03 05/23/25 14:21:03 krbtgt/[email protected] renew until 05/24/25 04:21:01 Mount the cifs share: root@jammy-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba- dc.example.com/demo /mnt/testshare1 We now have a service ticket: root@jammy-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:21:03 05/23/25 14:21:03 krbtgt/[email protected] renew until 05/24/25 04:21:01 05/23/25 04:21:33 05/23/25 14:21:03 cifs/samba-dc.example.com@ renew until 05/24/25 04:21:01 Ticket server: cifs/[email protected] Unmount the share: root@jammy-dc:/home/ubuntu# umount /mnt/testshare1 Perform some kerberos credential case surgery to remove the TGT: root@jammy-dc:/home/ubuntu# cd python-krb5ccparse/ root@jammy-dc:/home/ubuntu/python-krb5ccparse# ./kremovetkt -c /tmp/krb5cc_0 -o /tmp/removed -p krbtgt/[email protected] Skipping ticket for krbtgt/[email protected] Keeping ticket for krb5_ccache_conf_data/pa_type/krbtgt/[email protected]@X-CACHECONF: Keeping ticket for cifs/samba-dc.example.com@ Lets see if it is successful: root@jammy-dc:/home/ubuntu/python-krb5ccparse# kdestroy root@jammy-dc:/home/ubuntu/python-krb5ccparse# mv /tmp/removed /tmp/krb5cc_0 root@jammy-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:21:33 05/23/25 14:21:03 cifs/samba-dc.example.com@ renew until 05/24/25 04:21:01 Ticket server: cifs/[email protected] We only have service ticket now, so try mount the share: root@jammy-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 mount error(126): Required key not available Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) # journalctl -b0 May 23 04:23:06 jammy-dc kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified May 23 04:23:06 jammy-dc kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified May 23 04:23:06 jammy-dc kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo May 23 04:23:06 jammy-dc cifs.upcall[1402]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0> May 23 04:23:06 jammy-dc cifs.upcall[1403]: ver=2 May 23 04:23:06 jammy-dc cifs.upcall[1403]: host=samba-dc.example.com May 23 04:23:06 jammy-dc cifs.upcall[1403]: ip=192.168.122.168 May 23 04:23:06 jammy-dc cifs.upcall[1403]: sec=1 May 23 04:23:06 jammy-dc cifs.upcall[1403]: uid=0 May 23 04:23:06 jammy-dc cifs.upcall[1403]: creduid=0 May 23 04:23:06 jammy-dc cifs.upcall[1403]: user=root May 23 04:23:06 jammy-dc cifs.upcall[1403]: pid=1396 May 23 04:23:06 jammy-dc cifs.upcall[1402]: get_cachename_from_process_env: pid == 0 May 23 04:23:06 jammy-dc cifs.upcall[1402]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 May 23 04:23:06 jammy-dc cifs.upcall[1402]: krb5_get_init_creds_keytab: -1765328378 May 23 04:23:06 jammy-dc cifs.upcall[1402]: Exit status 1 May 23 04:23:06 jammy-dc kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed May 23 04:23:06 jammy-dc kernel: CIFS: VFS: \\samba-dc.example.com Send error in SessSetup = -126 May 23 04:23:06 jammy-dc kernel: CIFS: VFS: cifs_mount failed w/return code = -126 We fail, due to cifs-utils in -release not seeing a TGT, and backing out, even though we have a valid cifs service ticket. I then enabled -security-proposed: sudo add-apt-repository ppa:ubuntu-security-proposed/ppa and installed cifs-utils 2:6.14-1ubuntu0.2 I then attempted the mount: root@jammy-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:21:33 05/23/25 14:21:03 cifs/samba-dc.example.com@ renew until 05/24/25 04:21:01 Ticket server: cifs/[email protected] root@jammy-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu/python-krb5ccparse# mount -l ... //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.168,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,user=root) # stat /mnt/testshare1/ File: /mnt/testshare1/ Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 2dh/45d Inode: 261033 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 05:43:19.217555200 +0000 Modify: 2025-04-30 05:42:30.507699600 +0000 Change: 2025-04-30 05:42:30.507699600 +0000 Birth: 2025-04-30 05:42:30.490607200 +0000 # journalctl -b0 May 23 04:24:30 jammy-dc kernel: CIFS: enabling forceuid mount option implicitly because uid= option is specified May 23 04:24:30 jammy-dc kernel: CIFS: enabling forcegid mount option implicitly because gid= option is specified May 23 04:24:30 jammy-dc kernel: CIFS: Attempting to mount \\samba-dc.example.com\demo May 23 04:24:30 jammy-dc cifs.upcall[2081]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.168;sec=krb5;uid=0x0;creduid=0x0> May 23 04:24:30 jammy-dc cifs.upcall[2082]: ver=2 May 23 04:24:30 jammy-dc cifs.upcall[2082]: host=samba-dc.example.com May 23 04:24:30 jammy-dc cifs.upcall[2082]: ip=192.168.122.168 May 23 04:24:30 jammy-dc cifs.upcall[2082]: sec=1 May 23 04:24:30 jammy-dc cifs.upcall[2082]: uid=0 May 23 04:24:30 jammy-dc cifs.upcall[2082]: creduid=0 May 23 04:24:30 jammy-dc cifs.upcall[2082]: user=root May 23 04:24:30 jammy-dc cifs.upcall[2082]: pid=2075 May 23 04:24:30 jammy-dc cifs.upcall[2081]: upcall_target=app, switching namespaces to application thread May 23 04:24:30 jammy-dc cifs.upcall[2081]: get_cachename_from_process_env: pid == 0 May 23 04:24:30 jammy-dc cifs.upcall[2081]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 May 23 04:24:30 jammy-dc cifs.upcall[2081]: main: valid service ticket exists in credential cache May 23 04:24:30 jammy-dc cifs.upcall[2081]: handle_krb5_mech: getting service ticket for samba-dc.example.com May 23 04:24:30 jammy-dc cifs.upcall[2081]: handle_krb5_mech: obtained service ticket May 23 04:24:30 jammy-dc cifs.upcall[2081]: Exit status 0 The filesystem is mounted correctly. I also did a mount with both TGT and service ticket: root@jammy-dc:/home/ubuntu/python-krb5ccparse# umount /mnt/testshare1 root@jammy-dc:/home/ubuntu/python-krb5ccparse# kdestroy root@jammy-dc:/home/ubuntu/python-krb5ccparse# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 19 days on Wed Jun 11 05:39:46 2025 root@jammy-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:25:57 05/23/25 14:25:57 krbtgt/[email protected] renew until 05/24/25 04:25:54 root@jammy-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@jammy-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 04:25:57 05/23/25 14:25:57 krbtgt/[email protected] renew until 05/24/25 04:25:54 05/23/25 04:26:09 05/23/25 14:25:57 cifs/samba-dc.example.com@ renew until 05/24/25 04:25:54 Ticket server: cifs/[email protected] The filesystem is again mounted correctly, so no regressions with both TGT and service ticket either. The package in -proposed fixes the issue. Happy to mark jammy as verified. ** Tags added: verification-done-jammy -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099917 Title: cifs.upcall: If kerberos credential cache already contains a valid service ticket, use that even if TGT is expired To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099917/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
