diff --git a/aclocal/kerberos5.m4 b/aclocal/kerberos5.m4

index 0bf35d3..8a0f3e4 100644

--- a/aclocal/kerberos5.m4

+++ b/aclocal/kerberos5.m4

@@ -43,15 +43,6 @@ AC_DEFUN([AC_KERBEROS_V5],[

                    -f $dir/lib/libgssapi_krb5.so \) ; then

          AC_DEFINE(HAVE_KRB5, 1, [Define this if you have MIT Kerberos libraries])

          KRBDIR="$dir"

-  dnl If we are using MIT K5 1.3.1 and before, we *MUST* use the

-  dnl private function (gss_krb5_ccache_name) to get correct

-  dnl behavior of changing the ccache used by gssapi.

-  dnl Starting in 1.3.2, we *DO NOT* want to use

-  dnl gss_krb5_ccache_name, instead we want to set KRB5CCNAME

-  dnl to get gssapi to use a different ccache

-         if test $K5VERS -le 131; then

-           AC_DEFINE(USE_GSS_KRB5_CCACHE_NAME, 1, [Define this if the private function, gss_krb5_cache_name, must be used to tell the Kerberos library which credentials cache to use. Otherwise, this is done by setting the KRB5CCNAME environment variable])

-         fi

          gssapi_lib=gssapi_krb5

          break

       dnl The following ugly hack brought on by the split installation

@@ -92,8 +83,6 @@ AC_DEFUN([AC_KERBEROS_V5],[

     AC_DEFINE(HAVE_LUCID_CONTEXT_SUPPORT, 1, [Define this if the Kerberos GSS library supports gss_krb5_export_lucid_sec_context]), ,$KRBLIBS)

   AC_CHECK_LIB($gssapi_lib, gss_krb5_set_allowable_enctypes,

     AC_DEFINE(HAVE_SET_ALLOWABLE_ENCTYPES, 1, [Define this if the Kerberos GSS library supports gss_krb5_set_allowable_enctypes]), ,$KRBLIBS)

-  AC_CHECK_LIB($gssapi_lib, gss_krb5_ccache_name,

-    AC_DEFINE(HAVE_GSS_KRB5_CCACHE_NAME, 1, [Define this if the Kerberos GSS library supports gss_krb5_ccache_name]), ,$KRBLIBS)

   AC_CHECK_LIB($gssapi_lib, gss_krb5_free_lucid_sec_context,

     AC_DEFINE(HAVE_GSS_KRB5_FREE_LUCID_SEC_CONTEXT, 1, [Define this if the Kerberos GSS library supports gss_krb5_free_lucid_sec_context]), ,$KRBLIBS)

diff --git a/aclocal/libpthread.m4 b/aclocal/libpthread.m4

new file mode 100644

index 0000000..e87d2a0

--- /dev/null

+++ b/aclocal/libpthread.m4

@@ -0,0 +1,13 @@

+dnl Checks for pthreads library and headers

+dnl

+AC_DEFUN([AC_LIBPTHREAD], [

+

+    dnl Check for library, but do not add -lpthreads to LIBS

+    AC_CHECK_LIB([pthread], [pthread_create], [LIBPTHREAD=-lpthread],

+                 [AC_MSG_ERROR([libpthread not found.])])

+  AC_SUBST(LIBPTHREAD)

+

+  AC_CHECK_HEADERS([pthread.h], ,

+                   [AC_MSG_ERROR([libpthread headers not found.])])

+

+])dnl

diff --git a/configure.ac b/configure.ac

index 4ee4db5..56f7f3e 100644

--- a/configure.ac

+++ b/configure.ac

@@ -355,6 +355,9 @@ if test "$enable_gss" = yes; then

   dnl Invoked after AC_KERBEROS_V5; AC_LIBRPCSECGSS needs to have KRBLIBS set

   AC_LIBRPCSECGSS

+  dnl Check for pthreads

+  AC_LIBPTHREAD

+

   dnl librpcsecgss already has a dependency on libgssapi,

   dnl but we need to make sure we get the right version

   if test "$enable_gss" = yes; then

diff --git a/utils/gssd/Makefile.am b/utils/gssd/Makefile.am

index fd488a1..f387c16 100644

--- a/utils/gssd/Makefile.am

+++ b/utils/gssd/Makefile.am

@@ -42,7 +42,8 @@ gssd_LDADD = \

 	$(RPCSECGSS_LIBS) \

 	$(KRBLIBS) \

 	$(GSSAPI_LIBS) \

-	$(LIBTIRPC)

+	$(LIBTIRPC) \

+	$(LIBPTHREAD)

 gssd_LDFLAGS = \

 	$(KRBLDFLAGS)

diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c

index 7ba27b1..43fccaf 100644

--- a/utils/gssd/gssd.c

+++ b/utils/gssd/gssd.c

@@ -87,7 +87,9 @@ unsigned int  rpc_timeout = 5;

 char *preferred_realm = NULL;

 /* Avoid DNS reverse lookups on server names */

 static bool avoid_dns = true;

-

+int thread_started = false;

+pthread_mutex_t pmutex = PTHREAD_MUTEX_INITIALIZER;

+pthread_cond_t pcond = PTHREAD_COND_INITIALIZER;

 TAILQ_HEAD(topdir_list_head, topdir) topdir_list;

@@ -361,20 +363,91 @@ gssd_destroy_client(struct clnt_info *clp)

 static void gssd_scan(void);

+static int

+start_upcall_thread(void (*func)(struct clnt_upcall_info *), void *info)

+{

+	pthread_attr_t attr;

+	pthread_t th;

+	int ret;

+

+	ret = pthread_attr_init(&attr);

+	if (ret != 0) {

+		printerr(0, "ERROR: failed to init pthread attr: ret %d: %s\n",

+			 ret, strerror(errno));

+		return ret;

+	}

+	ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);

+	if (ret != 0) {

+		printerr(0, "ERROR: failed to create pthread attr: ret %d: "

+			 "%s\n", ret, strerror(errno));

+		return ret;

+	}

+

+	ret = pthread_create(&th, &attr, (void *)func, (void *)info);

+	if (ret != 0)

+		printerr(0, "ERROR: pthread_create failed: ret %d: %s\n",

+			 ret, strerror(errno));

+	return ret;

+}

+

+static struct clnt_upcall_info *alloc_upcall_info(struct clnt_info *clp)

+{

+	struct clnt_upcall_info *info;

+

+	info = malloc(sizeof(struct clnt_upcall_info));

+	if (info == NULL)

+		return NULL;

+	info->clp = clp;

+

+	return info;

+}

+

+/* For each upcall read the upcall info into the buffer, then create a

+ * thread in a detached state so that resources are released back into

+ * the system without the need for a join.

+ */

 static void

 gssd_clnt_gssd_cb(int UNUSED(fd), short UNUSED(which), void *data)

 {

 	struct clnt_info *clp = data;

+	struct clnt_upcall_info *info;

+

+	info = alloc_upcall_info(clp);

+	if (info == NULL)

+		return;

+

+	info->lbuflen = read(clp->gssd_fd, info->lbuf, sizeof(info->lbuf));

+	if (info->lbuflen <= 0 || info->lbuf[info->lbuflen-1] != '\n') {

+		printerr(0, "WARNING: %s: failed reading request\n", __func__);

+		free(info);

+		return;

+	}

+	info->lbuf[info->lbuflen-1] = 0;

-	handle_gssd_upcall(clp);

+	if (start_upcall_thread(handle_gssd_upcall, info))

+		free(info);

 }

 static void

 gssd_clnt_krb5_cb(int UNUSED(fd), short UNUSED(which), void *data)

 {

 	struct clnt_info *clp = data;

+	struct clnt_upcall_info *info;

+

+	info = alloc_upcall_info(clp);

+	if (info == NULL)

+		return;

+

+	if (read(clp->krb5_fd, &info->uid,

+			sizeof(info->uid)) < (ssize_t)sizeof(info->uid)) {

+		printerr(0, "WARNING: %s: failed reading uid from krb5 "

+			 "upcall pipe: %s\n", __func__, strerror(errno));

+		free(info);

+		return;

+	}

-	handle_krb5_upcall(clp);

+	if (start_upcall_thread(handle_krb5_upcall, info))

+		free(info);

 }

 static struct clnt_info *

diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h

index c6937c5..f4f5975 100644

--- a/utils/gssd/gssd.h

+++ b/utils/gssd/gssd.h

@@ -36,6 +36,7 @@

 #include <gssapi/gssapi.h>

 #include <event.h>

 #include <stdbool.h>

+#include <pthread.h>

 #ifndef GSSD_PIPEFS_DIR

 #define GSSD_PIPEFS_DIR		"/var/lib/nfs/rpc_pipefs"

@@ -48,7 +49,7 @@

 #define GSSD_DEFAULT_MACHINE_CRED_SUFFIX	"machine"

 #define GSSD_DEFAULT_KEYTAB_FILE		"/etc/krb5.keytab"

 #define GSSD_SERVICE_NAME			"nfs"

-

+#define RPC_CHAN_BUF_SIZE			32768

 /*

  * The gss mechanisms that we can handle

  */

@@ -61,6 +62,10 @@ extern int			root_uses_machine_creds;

 extern unsigned int 		context_timeout;

 extern unsigned int rpc_timeout;

 extern char			*preferred_realm;

+extern pthread_mutex_t ple_lock;

+extern pthread_cond_t pcond;

+extern pthread_mutex_t pmutex;

+extern int thread_started;

 struct clnt_info {

 	TAILQ_ENTRY(clnt_info)	list;

@@ -80,8 +85,15 @@ struct clnt_info {

 	struct			sockaddr_storage addr;

 };

-void handle_krb5_upcall(struct clnt_info *clp);

-void handle_gssd_upcall(struct clnt_info *clp);

+struct clnt_upcall_info {

+	struct clnt_info 	*clp;

+	char			lbuf[RPC_CHAN_BUF_SIZE];

+	int			lbuflen;

+	uid_t			uid;

+};

+

+void handle_krb5_upcall(struct clnt_upcall_info *clp);

+void handle_gssd_upcall(struct clnt_upcall_info *clp);

 #endif /* _RPC_GSSD_H_ */

diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c

index 69c6a34..fda7595 100644

--- a/utils/gssd/gssd_proc.c

+++ b/utils/gssd/gssd_proc.c

@@ -69,6 +69,7 @@

 #include <netdb.h>

 #include <sys/types.h>

 #include <sys/wait.h>

+#include <syscall.h>

 #include "gssd.h"

 #include "err_util.h"

@@ -442,7 +443,7 @@ change_identity(uid_t uid)

 	struct passwd	*pw;

 	/* drop list of supplimentary groups first */

-	if (setgroups(0, NULL) != 0) {

+	if (syscall(SYS_setgroups, 0, 0) != 0) {

 		printerr(0, "WARNING: unable to drop supplimentary groups!");

 		return errno;

 	}

@@ -459,20 +460,18 @@ change_identity(uid_t uid)

 		}

 	}

-	/*

-	 * Switch the GIDs. Note that we leave the saved-set-gid alone in an

-	 * attempt to prevent attacks via ptrace()

+	/* Switch the UIDs and GIDs. */

+	/* For the threaded version we have to set uid,gid per thread instead

+	 * of per process. glibc setresuid() when called from a thread, it'll

+	 * send a signal to all other threads to synchronize the uid in all

+	 * other threads. To bypass this, we have to call syscall() directly.

 	 */

-	if (setresgid(pw->pw_gid, pw->pw_gid, -1) != 0) {

+	if (syscall(SYS_setresgid, pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {

 		printerr(0, "WARNING: failed to set gid to %u!\n", pw->pw_gid);

 		return errno;

 	}

-	/*

-	 * Switch UIDs, but leave saved-set-uid alone to prevent ptrace() by

-	 * other processes running with this uid.

-	 */

-	if (setresuid(uid, uid, -1) != 0) {

+	if (syscall(SYS_setresuid, uid, uid, uid) != 0) {

 		printerr(0, "WARNING: Failed to setuid for user with uid %u\n",

 				uid);

 		return errno;

@@ -554,7 +553,15 @@ krb5_use_machine_creds(struct clnt_info *clp, uid_t uid, char *tgtname,

 			goto out;

 		}

 		for (ccname = credlist; ccname && *ccname; ccname++) {

-			gssd_setup_krb5_machine_gss_ccache(*ccname);

+			u_int min_stat;

+

+			if (gss_krb5_ccache_name(&min_stat, *ccname, NULL) !=

+					GSS_S_COMPLETE) {

+				printerr(1, "WARNING: gss_krb5_ccache_name "

+					 "with name '%s' failed (%s)\n",

+					 *ccname, error_message(min_stat));

+				continue;

+			}

 			if ((create_auth_rpc_client(clp, tgtname, rpc_clnt,

 						&auth, uid,

 						AUTHTYPE_KRB5,

@@ -602,7 +609,6 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,

 	gss_buffer_desc		token;

 	int			err, downcall_err = -EACCES;

 	OM_uint32		maj_stat, min_stat, lifetime_rec;

-	pid_t			pid, childpid = -1;

 	gss_name_t		gacceptor = GSS_C_NO_NAME;

 	gss_OID			mech;

 	gss_buffer_desc		acceptor  = {0};

@@ -635,36 +641,6 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,

 	if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 &&

 				service == NULL)) {

-		/* already running as uid 0 */

-		if (uid == 0)

-			goto no_fork;

-

-		pid = fork();

-		switch(pid) {

-		case 0:

-			/* Child: fall through to rest of function */

-			childpid = getpid();

-			unsetenv("KRB5CCNAME");

-			printerr(2, "CHILD forked pid %d \n", childpid);

-			break;

-		case -1:

-			/* fork() failed! */

-			printerr(0, "WARNING: unable to fork() to handle"

-				"upcall: %s\n", strerror(errno));

-			return;

-		default:

-			/* Parent: just wait on child to exit and return */

-			do {

-				pid = wait(&err;;

-			} while(pid == -1 && errno != -ECHILD);

-

-			if (WIFSIGNALED(err))

-				printerr(0, "WARNING: forked child was killed"

-					 "with signal %d\n", WTERMSIG(err));

-			return;

-		}

-no_fork:

-

 		auth = krb5_not_machine_creds(clp, uid, tgtname, &downcall_err,

 						&err, &rpc_clnt);

 		if (err)

@@ -730,11 +706,7 @@ out:

 	if (rpc_clnt)

 		clnt_destroy(rpc_clnt);

-	pid = getpid();

-	if (pid == childpid)

-		exit(0);

-	else

-		return;

+	return;

 out_return_error:

 	do_error_downcall(fd, uid, downcall_err);

@@ -742,27 +714,21 @@ out_return_error:

 }

 void

-handle_krb5_upcall(struct clnt_info *clp)

+handle_krb5_upcall(struct clnt_upcall_info *info)

 {

-	uid_t			uid;

-

-	if (read(clp->krb5_fd, &uid, sizeof(uid)) < (ssize_t)sizeof(uid)) {

-		printerr(0, "WARNING: failed reading uid from krb5 "

-			    "upcall pipe: %s\n", strerror(errno));

-		return;

-	}

+	struct clnt_info *clp = info->clp;

-	printerr(2, "\n%s: uid %d (%s)\n", __func__, uid, clp->relpath);

+	printerr(2, "\n%s: uid %d (%s)\n", __func__, info->uid, clp->relpath);

-	process_krb5_upcall(clp, uid, clp->krb5_fd, NULL, NULL);

+	process_krb5_upcall(clp, info->uid, clp->krb5_fd, NULL, NULL);

+	free(info);

 }

 void

-handle_gssd_upcall(struct clnt_info *clp)

+handle_gssd_upcall(struct clnt_upcall_info *info)

 {

+	struct clnt_info	*clp = info->clp;

 	uid_t			uid;

-	char			*lbuf = NULL;

-	int			lbuflen = 0;

 	char			*p;

 	char			*mech = NULL;

 	char			*uidstr = NULL;

@@ -770,15 +736,9 @@ handle_gssd_upcall(struct clnt_info *clp)

 	char			*service = NULL;

 	char			*enctypes = NULL;

-	if (readline(clp->gssd_fd, &lbuf, &lbuflen) != 1) {

-		printerr(0, "WARNING: handle_gssd_upcall: "

-			    "failed reading request\n");

-		return;

-	}

-

-	printerr(2, "\n%s: '%s' (%s)\n", __func__, lbuf, clp->relpath);

+	printerr(2, "\n%s: '%s' (%s)\n", __func__, info->lbuf, clp->relpath);

-	for (p = strtok(lbuf, " "); p; p = strtok(NULL, " ")) {

+	for (p = strtok(info->lbuf, " "); p; p = strtok(NULL, " ")) {

 		if (!strncmp(p, "mech=", strlen("mech=")))

 			mech = p + strlen("mech=");

 		else if (!strncmp(p, "uid=", strlen("uid=")))

@@ -794,8 +754,8 @@ handle_gssd_upcall(struct clnt_info *clp)

 	if (!mech || strlen(mech) < 1) {

 		printerr(0, "WARNING: handle_gssd_upcall: "

 			    "failed to find gss mechanism name "

-			    "in upcall string '%s'\n", lbuf);

-		return;

+			    "in upcall string '%s'\n", info->lbuf);

+		goto out;

 	}

 	if (uidstr) {

@@ -807,21 +767,21 @@ handle_gssd_upcall(struct clnt_info *clp)

 	if (!uidstr) {

 		printerr(0, "WARNING: handle_gssd_upcall: "

 			    "failed to find uid "

-			    "in upcall string '%s'\n", lbuf);

-		return;

+			    "in upcall string '%s'\n", info->lbuf);

+		goto out;

 	}

 	if (enctypes && parse_enctypes(enctypes) != 0) {

 		printerr(0, "WARNING: handle_gssd_upcall: "

 			 "parsing encryption types failed: errno %d\n", errno);

-		return;

+		goto out;

 	}

 	if (target && strlen(target) < 1) {

 		printerr(0, "WARNING: handle_gssd_upcall: "

 			 "failed to parse target name "

-			 "in upcall string '%s'\n", lbuf);

-		return;

+			 "in upcall string '%s'\n", info->lbuf);

+		goto out;

 	}

 	/*

@@ -835,8 +795,8 @@ handle_gssd_upcall(struct clnt_info *clp)

 	if (service && strlen(service) < 1) {

 		printerr(0, "WARNING: handle_gssd_upcall: "

 			 "failed to parse service type "

-			 "in upcall string '%s'\n", lbuf);

-		return;

+			 "in upcall string '%s'\n", info->lbuf);

+		goto out;

 	}

 	if (strcmp(mech, "krb5") == 0 && clp->servername)

@@ -847,5 +807,8 @@ handle_gssd_upcall(struct clnt_info *clp)

 				 "received unknown gss mech '%s'\n", mech);

 		do_error_downcall(clp->gssd_fd, uid, -EACCES);

 	}

+out:

+	free(info);

+	return;

 }

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c

index 3849b6a..bc29787 100644

--- a/utils/gssd/krb5_util.c

+++ b/utils/gssd/krb5_util.c

@@ -128,6 +128,7 @@

 /* Global list of principals/cache file names for machine credentials */

 struct gssd_k5_kt_princ *gssd_k5_kt_princ_list = NULL;

+pthread_mutex_t ple_lock = PTHREAD_MUTEX_INITIALIZER;

 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES

 int limit_to_legacy_enctypes = 0;

@@ -467,37 +468,6 @@ gssd_get_single_krb5_cred(krb5_context context,

 }

 /*

- * Depending on the version of Kerberos, we either need to use

- * a private function, or simply set the environment variable.

- */

-static void

-gssd_set_krb5_ccache_name(char *ccname)

-{

-#ifdef USE_GSS_KRB5_CCACHE_NAME

-	u_int	maj_stat, min_stat;

-

-	printerr(3, "using gss_krb5_ccache_name to select krb5 ccache %s\n",

-		 ccname);

-	maj_stat = gss_krb5_ccache_name(&min_stat, ccname, NULL);

-	if (maj_stat != GSS_S_COMPLETE) {

-		printerr(0, "WARNING: gss_krb5_ccache_name with "

-			"name '%s' failed (%s)\n",

-			ccname, error_message(min_stat));

-	}

-#else

-	/*

-	 * Set the KRB5CCNAME environment variable to tell the krb5 code

-	 * which credentials cache to use.  (Instead of using the private

-	 * function above for which there is no generic gssapi

-	 * equivalent.)

-	 */

-	printerr(3, "using environment variable to select krb5 ccache %s\n",

-		 ccname);

-	setenv("KRB5CCNAME", ccname, 1);

-#endif

-}

-

-/*

  * Given a principal, find a matching ple structure

  */

 static struct gssd_k5_kt_princ *

@@ -586,10 +556,12 @@ get_ple_by_princ(krb5_context context, krb5_principal princ)

 	/* Need to serialize list if we ever become multi-threaded! */

+	pthread_mutex_lock(&ple_lock);

 	ple = find_ple_by_princ(context, princ);

 	if (ple == NULL) {

 		ple = new_ple(context, princ);

 	}

+	pthread_mutex_unlock(&ple_lock);

 	return ple;

 }

@@ -1091,6 +1063,7 @@ gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern)

 	const char		*cctype;

 	struct dirent		*d;

 	int			err, i, j;

+	u_int			maj_stat, min_stat;

 	printerr(3, "looking for client creds with uid %u for "

 		    "server %s in %s\n", uid, servername, dirpattern);

@@ -1126,22 +1099,16 @@ gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern)

 	printerr(2, "using %s as credentials cache for client with "

 		    "uid %u for server %s\n", buf, uid, servername);

-	gssd_set_krb5_ccache_name(buf);

-	return 0;

-}

-/*

- * Let the gss code know where to find the machine credentials ccache.

- *

- * Returns:

- *	void

- */

-void

-gssd_setup_krb5_machine_gss_ccache(char *ccname)

-{

-	printerr(2, "using %s as credentials cache for machine creds\n",

-		 ccname);

-	gssd_set_krb5_ccache_name(ccname);

+	printerr(3, "using gss_krb5_ccache_name to select krb5 ccache %s\n",

+		 buf);

+	maj_stat = gss_krb5_ccache_name(&min_stat, buf, NULL);

+	if (maj_stat != GSS_S_COMPLETE) {

+		printerr(0, "ERROR: unable to get user cred cache '%s' "

+			 "failed (%s)\n", buf, error_message(min_stat));

+		return maj_stat;

+	}

+	return 0;

 }

 /*

diff --git a/utils/gssd/krb5_util.h b/utils/gssd/krb5_util.h

index a319588..e3bbb07 100644

--- a/utils/gssd/krb5_util.h

+++ b/utils/gssd/krb5_util.h

@@ -27,7 +27,6 @@ int gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername,

 				     char *dirname);

 int  gssd_get_krb5_machine_cred_list(char ***list);

 void gssd_free_krb5_machine_cred_list(char **list);

-void gssd_setup_krb5_machine_gss_ccache(char *servername);

 void gssd_destroy_krb5_machine_creds(void);

 int  gssd_refresh_krb5_machine_credential(char *hostname,

 					  struct gssd_k5_kt_princ *ple, 

@@ -55,8 +54,6 @@ int limit_krb5_enctypes(struct rpc_gss_sec *sec);

 #define k5_free_unparsed_name(ctx, name)	free(name)

 #define k5_free_default_realm(ctx, realm)	free(realm)

 #define k5_free_kt_entry(ctx, kte)		krb5_kt_free_entry((ctx),(kte))

-#undef USE_GSS_KRB5_CCACHE_NAME

-#define USE_GSS_KRB5_CCACHE_NAME 1

 #endif

 #endif /* KRB5_UTIL_H */