[PATCH] Fix for #101
by Simo Sorce
This adds a workaround to the mechglue layer so that gss_display_name()
always return zero terminated trings in the buffer, although the API
contract does not require it. This "fixes" buggy applications that
assume otherwise (like mod_auht_kerb).
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 3 months
[PATCH] Implement dropping privileges
by Simo Sorce
Implements RFE ticket #102
Allows to specify a user to drop privileges to.
When dropping privileges the /var/lib/gssproxy/clients directory and any
keytab gssproxy needs access to need to be readable by the proxy user.
For testing with /etc/krb5.keytab I suggest running:
setfacl -m u:gssproxy:r /etc/krb5.keytab
Assuming "gssproxy" is the name of an existing system user set in the
config file as:
run_as_user = gssproxy
I did some basic testing on my client system that is set up to
impersonate nfs client users by using constrained delegation and the
host keytab. Seem to work ok in Fedora 20, but requires setenforce = 0
in my system because rpc.gssd is still broken in the selinux policy when
it tries to fork the handling child.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 3 months
[PATCH] Fix for #112
by Simo Sorce
It was a copy&paste mistake :/
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 4 months
