gss-proxy January 2014

gss-proxy@lists.fedorahosted.org

2 participants
4 discussions

[PATCHES] Implement RFE #114
by Simo Sorce 16 Jan '14

16 Jan '14

First patch adds utility functions to read/write safely even when interrupted by signal. Second patch creates a pipe between child and parent so the parent will wait until the child finishes initializing all the sockets and write to the nfsd file in proc. This is necessary to reliably enable gssproxy code in nfsd via init system ordering and avoid races where the client may not have written the proc file in time if the parent immediately returns and the init system immediately starts the kernel nfs daemon. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 2

[PATCH] Fix failure case in name conversion
by Simo Sorce 15 Jan '14

15 Jan '14

Found this by playing with gssntlmssp, fixes a segfault in gssproxy. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 2

[PATCH] Fix for #101
by Simo Sorce 15 Jan '14

15 Jan '14

This adds a workaround to the mechglue layer so that gss_display_name() always return zero terminated trings in the buffer, although the API contract does not require it. This "fixes" buggy applications that assume otherwise (like mod_auht_kerb). Simo. -- Simo Sorce * Red Hat, Inc * New York

2 1

[PATCH] Implement dropping privileges
by Simo Sorce 14 Jan '14

14 Jan '14

Implements RFE ticket #102 Allows to specify a user to drop privileges to. When dropping privileges the /var/lib/gssproxy/clients directory and any keytab gssproxy needs access to need to be readable by the proxy user. For testing with /etc/krb5.keytab I suggest running: setfacl -m u:gssproxy:r /etc/krb5.keytab Assuming "gssproxy" is the name of an existing system user set in the config file as: run_as_user = gssproxy I did some basic testing on my client system that is set up to impersonate nfs client users by using constrained delegation and the host keytab. Seem to work ok in Fedora 20, but requires setenforce = 0 in my system because rpc.gssd is still broken in the selinux policy when it tries to fork the handling child. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy January 2014