Performing verification for focal. I set up a fresh focal VM with the same reproducer as documented in https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2099914
The kernel is the latest 5.4.0-216-generic from -updates. $ uname -rv 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 cifs-utils is 2:6.9-1ubuntu0.2 from -updates. $ apt-cache policy cifs-utils | grep Installed cifs-utils: Installed: 2:6.9-1ubuntu0.2 We kinit and get a tgt: root@focal-dc:/home/ubuntu# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 19 days on Wed Jun 11 06:13:06 2025 root@focal-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:03:33 05/23/25 15:03:33 krbtgt/[email protected] renew until 05/24/25 05:03:30 Mount the cifs share: root@focal-dc:/home/ubuntu# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba- dc.example.com/demo /mnt/testshare1 We now have a service ticket: root@focal-dc:/home/ubuntu# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:03:33 05/23/25 15:03:33 krbtgt/[email protected] renew until 05/24/25 05:03:30 05/23/25 05:04:00 05/23/25 15:03:33 cifs/samba-dc.example.com@ renew until 05/24/25 05:03:30 05/23/25 05:04:00 05/23/25 15:03:33 cifs/[email protected] renew until 05/24/25 05:03:30 Unmount the share: root@focal-dc:/home/ubuntu# umount /mnt/testshare1 Perform some kerberos credential case surgery to remove the TGT: root@focal-dc:/home/ubuntu# cd python-krb5ccparse/ root@focal-dc:/home/ubuntu/python-krb5ccparse# ./kremovetkt -c /tmp/krb5cc_0 -o /tmp/removed -p krbtgt/[email protected] Skipping ticket for krbtgt/[email protected] Keeping ticket for krb5_ccache_conf_data/pa_type/krbtgt/[email protected]@X-CACHECONF: Keeping ticket for cifs/samba-dc.example.com@ Keeping ticket for cifs/[email protected] Lets see if it is successful: root@focal-dc:/home/ubuntu/python-krb5ccparse# kdestroy root@focal-dc:/home/ubuntu/python-krb5ccparse# mv /tmp/removed /tmp/krb5cc_0 root@focal-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:04:00 05/23/25 15:03:33 cifs/samba-dc.example.com@ renew until 05/24/25 05:03:30 05/23/25 05:04:00 05/23/25 15:03:33 cifs/[email protected] renew until 05/24/25 05:03:30 We only have service ticket now, so try mount the share: root@focal-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 mount error(2): No such file or directory Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) # journalctl -b0 May 23 05:13:52 focal-dc kernel: CIFS: Attempting to mount //samba-dc.example.com/demo May 23 05:13:52 focal-dc kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > May 23 05:13:52 focal-dc cifs.upcall[1694]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;> May 23 05:13:52 focal-dc cifs.upcall[1695]: ver=2 May 23 05:13:52 focal-dc cifs.upcall[1695]: host=samba-dc.example.com May 23 05:13:52 focal-dc cifs.upcall[1695]: ip=192.168.122.27 May 23 05:13:52 focal-dc cifs.upcall[1695]: sec=1 May 23 05:13:52 focal-dc cifs.upcall[1695]: uid=0 May 23 05:13:52 focal-dc cifs.upcall[1695]: creduid=0 May 23 05:13:52 focal-dc cifs.upcall[1695]: user=root May 23 05:13:52 focal-dc cifs.upcall[1695]: pid=1688 May 23 05:13:52 focal-dc cifs.upcall[1694]: get_cachename_from_process_env: pid == 0 May 23 05:13:52 focal-dc cifs.upcall[1694]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 May 23 05:13:52 focal-dc cifs.upcall[1694]: krb5_get_init_creds_keytab: -1765328378 May 23 05:13:52 focal-dc cifs.upcall[1694]: Exit status 1 May 23 05:13:52 focal-dc kernel: CIFS VFS: Verify user has a krb5 ticket and keyutils is installed May 23 05:13:52 focal-dc kernel: CIFS VFS: \\samba-dc.example.com Send error in SessSetup = -126 May 23 05:13:52 focal-dc kernel: CIFS VFS: cifs_mount failed w/return code = -2 We fail, due to cifs-utils in -release not seeing a TGT, and backing out, even though we have a valid cifs service ticket. I then enabled -security-proposed: sudo add-apt-repository ppa:ubuntu-security-proposed/ppa and installed cifs-utils 2:6.9-1ubuntu0.3 I then attempted the mount: root@focal-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:04:00 05/23/25 15:03:33 cifs/samba-dc.example.com@ renew until 05/24/25 05:03:30 05/23/25 05:04:00 05/23/25 15:03:33 cifs/[email protected] renew until 05/24/25 05:03:30 root@focal-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@focal-dc:/home/ubuntu/python-krb5ccparse# mount -l ... //samba-dc.example.com/demo on /mnt/testshare1 type cifs //samba-dc.example.com/demo on /mnt/testshare1 type cifs (rw,relatime,vers=3.1.1,sec=krb5i,cruid=0,cache=strict,username=root,uid=0,forceuid,gid=0,forcegid,addr=192.168.122.27,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,user=root) # stat /mnt/testshare1/ File: /mnt/testshare1/ Size: 0 Blocks: 0 IO Block: 1048576 directory Device: 35h/53d Inode: 260995 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-04-30 06:16:07.320000000 +0000 Modify: 2025-04-30 06:16:07.320000000 +0000 Change: 2025-04-30 06:16:07.320000000 +0000 Birth: - # journalctl -b0 May 23 05:15:55 focal-dc kernel: CIFS: Attempting to mount //samba-dc.example.com/demo May 23 05:15:55 focal-dc kernel: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS (SMB1). To use the > May 23 05:15:55 focal-dc cifs.upcall[2423]: key description: cifs.spnego;0;0;39010000;ver=0x2;host=samba-dc.example.com;ip4=192.168.122.27;sec=krb5;uid=0x0;creduid=0x0;> May 23 05:15:55 focal-dc cifs.upcall[2424]: ver=2 May 23 05:15:55 focal-dc cifs.upcall[2424]: host=samba-dc.example.com May 23 05:15:55 focal-dc cifs.upcall[2424]: ip=192.168.122.27 May 23 05:15:55 focal-dc cifs.upcall[2424]: sec=1 May 23 05:15:55 focal-dc cifs.upcall[2424]: uid=0 May 23 05:15:55 focal-dc cifs.upcall[2424]: creduid=0 May 23 05:15:55 focal-dc cifs.upcall[2424]: user=root May 23 05:15:55 focal-dc cifs.upcall[2424]: pid=2417 May 23 05:15:55 focal-dc cifs.upcall[2423]: upcall_target=app, switching namespaces to application thread May 23 05:15:55 focal-dc cifs.upcall[2423]: get_cachename_from_process_env: pid == 0 May 23 05:15:55 focal-dc cifs.upcall[2423]: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0 May 23 05:15:55 focal-dc cifs.upcall[2423]: main: valid service ticket exists in credential cache May 23 05:15:55 focal-dc cifs.upcall[2423]: handle_krb5_mech: getting service ticket for samba-dc.example.com May 23 05:15:55 focal-dc cifs.upcall[2423]: handle_krb5_mech: obtained service ticket May 23 05:15:55 focal-dc cifs.upcall[2423]: Exit status 0 The filesystem is mounted correctly. I also did a mount with both TGT and service ticket: root@focal-dc:/home/ubuntu/python-krb5ccparse# umount /mnt/testshare1 root@focal-dc:/home/ubuntu/python-krb5ccparse# kdestroy root@focal-dc:/home/ubuntu/python-krb5ccparse# kinit [email protected] Password for [email protected]: Warning: Your password will expire in 19 days on Wed Jun 11 06:13:06 2025 root@focal-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:17:31 05/23/25 15:17:31 krbtgt/[email protected] renew until 05/24/25 05:17:27 root@focal-dc:/home/ubuntu/python-krb5ccparse# mount -t cifs -o cruid=root,user=root,sec=krb5i,uid=0,gid=0,cred=/tmp/krb5cc_0 //samba-dc.example.com/demo /mnt/testshare1 root@focal-dc:/home/ubuntu/python-krb5ccparse# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 05/23/25 05:17:31 05/23/25 15:17:31 krbtgt/[email protected] renew until 05/24/25 05:17:27 05/23/25 05:17:44 05/23/25 15:17:31 cifs/samba-dc.example.com@ renew until 05/24/25 05:17:27 05/23/25 05:17:44 05/23/25 15:17:31 cifs/[email protected] renew until 05/24/25 05:17:27 The filesystem is again mounted correctly, so no regressions with both TGT and service ticket either. The package in -proposed fixes the issue. Happy to mark focal as verified. ** Tags added: verification-done-focal -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099917 Title: cifs.upcall: If kerberos credential cache already contains a valid service ticket, use that even if TGT is expired To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2099917/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
