[PATCHES] Merging INI snippets
by Dmitri Pal
Hello,
Extensive travel in recent months allowed me to finish this code.
Here is the updated design:
https://fedorahosted.org/sssd/wiki/DesignDocs/ding-libs/INIConfigMerge
Patches:
0001 - Fix in case the Ref array is empty and we need to print/debug it
0002 - Declaration of the new function to do access checks
0003 - Big patch with core functionality
0004 - Updated access check code to use new internal access control function
0005 - File with expected output for unit test validation
0006 - Makefile and related changes to start building new code
No rush, take your time. :-)
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
9 years, 5 months
KRB5CCNAME variable broken in second concurrent login shell - bug?
by Joschi Brauchle
We have a weird problem with the KRB5CCNAME environment variable that
seems to be an SSSD bug.
Configuration:
------------ /etc/sssd/sssd.conf ------------
...
# Set CCache to Kerberos default
krb5_ccachedir = /run/user/%U
krb5_ccname_template = DIR:%d/krb5cc
...
------------ /etc/sssd/sssd.conf ------------
Now, user "ne96soh" logs in to the machine for the FIRST time and does a
kerberized ldapsearch:
------------
ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME
DIR:/run/user/3036404/krb5cc
ne96soh@tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
... <succeeds>
------------
but then logs into the machine a SECOND concurrent time (i.e. leaving
first session open):
------------
ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME
DIR::/run/user/3036404/krb5cc/tktZoweZq
ne96soh@tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available)
------------
For me, the format of 'DIR::/run/user/3036404/krb5cc/tktZoweZq' in the
second login seems strange! Is this a valid format?
When I manuelly reset the KRB5CCNAME variable in the second login shell
to its original value 'DIR:/run/user/3036404/krb5cc', then the
ldapsearch using GSSAPI succeeds.
The reason of all this seems to be that SSSD reuses existing ccaches for
already logged on users, but possibly mixes up formats there.
See
------------ /var/log/sssd_default.log ------------
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_auth_send]
(0x4000): Ccache_file is [DIR::/run/user/3036404/krb5cc/tktZoweZq] and
is active and TGT is valid.
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_find_ccache_step]
(0x0080): Saved ccache DIR::/run/user/3036404/krb5cc/tktZoweZq if of
different type than ccache in configuration file, reusing the old ccache
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]]
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
same, no one will be deleted.
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_mod_ccname]
(0x4000): Save ccname [DIR::/run/user/3036404/krb5cc/tktZoweZq] for user
[ne96soh].
------------ /var/log/sssd_default.log ------------
Best regards,
--
Dipl.-Ing. Joschi Brauchle, M.S.
Institute for Communications Engineering (LNT)
Technische Universitaet Muenchen (TUM)
80290 Munich, Germany
Tel (work): +49 89 289-23474
Fax (work): +49 89 289-23490
E-mail: joschi.brauchle(a)tum.de
Web: http://www.lnt.ei.tum.de/
9 years, 5 months
[PATCH] krb5: Check return value of sss_krb5_princ_realm
by Lukas Slebodnik
ehlo,
yet another warning from clang static analyser.
sss_krb5_princ_realm set output parameter realm to NULL and len to 0
in case of failure. Clang static analysers repoted warning
"Null pointer passed as an argument to a 'nonnull' parameter"
in function match_principal. It was possible, that realm_name with value NULL
could be used in strncmp.
Function sss_krb5_princ_realm is used on other places for printing(formatting)
realm_name and NULL can be safely used as a argument for printf-like
functions.
Patch is attached.
LS
9 years, 5 months
[PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged
by Jakub Hrozek
Hi,
attached are patches that apply on top of my previous ldap_child and
selinux_child patches. The complete branch (including tests I'm still
working on) can be inspected here:
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=nonroot
Simo, Sumit, I added you to CC directly, b/c I suspected you wanted to be
included in larger krb5_child changes..
Below are patch descriptinons of the individual changes.
[PATCH 1/6] BUILD: Install krb5_child as suid if running under non-privileged user
If sssd_be is running unprivileged, then krb5_child must be setuid to be
able to access the keytab and become arbitrary user.
[PATCH 2/6] KRB5: Drop privileges in the child, not the back end
In future patches, sssd_be will be running as a non-privileged user, who
will execute the setuid krb5_child. In this case, the child will start
as root and drop the privileges as soon as possible.
[PATCH 3/6] KRB5: Move ccache-related functions to krb5_ccache.c
Add a new module krb5_ccache.c that contains all ccache-related
operations. The only user of this module shall be krb5_child.c as the
other modules will run unprivileged and accessing the keytab requires
either privileges of root or the ccache owner.
This patch only /moves/ code, the changes will come in later patches.
[PATCH 4/6] KRB5: Move checking for illegal RE to krb5_utils.c
Otherwise we would have to link krb5_child with pcre and transfer the
regex, which wold be cumbersome. Check for illegal patterns when
expanding the template instead.
[PATCH 5/6] KRB5: Move all ccache operations to krb5_child.c
The credential cache operations must be now performed by the krb5_child
completely, because the sssd_be process might be running as the sssd
user who doesn't have access to the ccaches.
src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5
until we fix Kerberos ticket renewal as non-root.
Also includes a new error code that indicates that the back end should
remove the old ccache attribute -- the child can't do that if it's
running as the user.
[PATCH 6/6] KRB5: Do not switch_creds() if already the specified user
The code didn't have to handle this case previously as sssd_be was always
running as root and switching to the ccache as the user logging in.
Also handle NULL creds on restore_creds() in case there was no switch.
One less if-condition and fewer indentation levels.
Thank you for the review.
9 years, 5 months
[PATCH] Move settig the SELinux context into a privileged child process
by Jakub Hrozek
Hi,
this patchset moves setting the SELinux context from the sssd_be process
to a privileges child process in preparation for making the sssd_be process
running as the sssd user.
The first two patches just reduce code duplication between the child
processes we already have, the last one implements setting the context.
Please note that the Fedora and RHEL SELinux policy must be tweaked, so
currently the patches must be tested with SELinux set to Permissive.
Additionally, I wasn't able to run Coverity scan on these patches, because
our Coverity server was returning errors again for me. I'll run the tests
later, or, if the reviewer would find any issues, I'll be happy to fix them.
9 years, 6 months
