KCM notifications
by Pavel Březina
Hi devs,
I'm thinking about ways to implement SSSD KCM notification that
something has changed (i.e. user called kinit/kdestroy) [1]. The main
use case is to notify Gnome Online Accounts (which is a daemon running
under logged-in user) when something has changed and it is already a
D-Bus service.
The basic idea is that we would use D-Bus signals that would be emitted
by SSSD KCM responder (sssd_kcm process). Signals are broadcasted
messages that are delivered to client that chose to listen to them.
The problem is that we
1) can't connect to specific user's session bus because KCM runs as
root/sssd and connecting to other user's bus is not allowed
2) can't specify which user is allowed to get the signal
3) therefore we can't send the signal only to specific user
So the solution is that KCM connects to system bus and sends
org.sssd.kcm.Changed(uid) signal where uid is uid of the user which
ccache has changed so the receiver can know which user is affected. This
signal is broadcasted to everyone who listens to it.
It is perfectly usable, however the question is whether we can broadcast
this information (that user A run kinit/kdestroy/other modification of
ccache) or it is a security leak that we must avoid and we should seek
other solution.
I asked this secalert and they reply that there is no security concern
"but":
> After looking at this issue, honestly I dont see an attack vector here, but i am afraid something like this could be used with some other security flaw to maybe gain privesc? For example a flaw which is some component which can be triggered only when kinit is run? where precise timing is required.
>
> So in conclusion if there is another "better" solution than it should be preferred. Or in worse case atleast have an option to disable this somehow via some config, so that such situations can be avoided.
I don't think a precise timing is necessary and we can send the signal
few miliseconds or a second later. That should eliminate this concern (I
asked this, waiting for an answer).
I can think of two more solutions currently:
1) Have client connect to KCM socket and await signal there. This
however would mean that connection between client and KCM need to be
always established and KCM responder would be running all the time
(currently it is only short-lived socket activated process).
2) Create a temporary file in a directory owned by user. User can then
setup inotify watch to the file and sssd would write to the file on
changes. Since it is in directory owned by user, other users would not
be able to setup the watch.
Note that it is possile to setup inotify watch on FILE ccache (keeping
distro settings out of the question the default ccache is
FILE:/tmp/krb5cc_%{uid} as per krb5.conf manpage) so perhaps we really
don't have to care about broadcasting this information.
Thanks,
Pavel.
[1] https://pagure.io/SSSD/sssd/issue/3568
4 years, 1 month
[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/918
Title: #918: Add support for NSS hosts database lookup.
sumit-bose commented:
"""
Thanks, sorry for nitpicking, but `ldap_iphost_entry_usn` is still missing in some files:
```
$ git grep -E '(ldap_iphost_name|ldap_iphost_entry_usn)' ../
../src/config/SSSDConfig/sssdoptions.py: 'ldap_iphost_name': _('IP host name attribute'),
../src/config/cfg_rules.ini:option = ldap_iphost_name
../src/config/etc/sssd.api.d/sssd-ad.conf:ldap_iphost_name = str, None, false
../src/config/etc/sssd.api.d/sssd-ldap.conf:ldap_iphost_name = str, None, false
../src/man/sssd-ldap-attributes.5.xml: <term>ldap_iphost_name (string)</term>
../src/providers/ad/ad_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL },
../src/providers/ad/ad_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL },
../src/providers/ldap/ldap_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL },
../src/providers/ldap/ldap_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL },
```
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-593489917
4 years, 1 month