URL:
https://github.com/freeipa/freeipa/pull/5328
Author: abbra
Title: #5328: Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches
Action: opened
PR body:
"""
With commit c6644b8566f747fa80e2c1925b79bad9f8c92bd7 we default to
create unique credential caches in /run/ipa/ccaches for every client
that connects to IPA with a new session. On F34, mod_auth_gssapi process
running as 'apache' cannot create the ccache in /run/ipa/ccaches because
it has no access rights.
The core of the problem is that we have two different paths to obtaining
a ccache: one where 'apache' running httpd process creates it directly
and one where an internal redirect from 'ipaapi' running httpd process
is happening.
Since /run/ipa/ccaches is a temporary directory created in /run which is
mounted as tmpfs, POSIX ACLs can be used to add 'apache' group
permission to create the ccaches.
When '/run/ipa/ccaches' has SGID bit, created files inside it would
automatically get 'ipaapi' group assigned. So all we need is to mark the
directory as 02770 (SGID bit).
Fixes:
https://pagure.io/freeipa/issue/8613
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5328/head:pr5328
git checkout pr5328