gss-proxy October 2023

gss-proxy@lists.fedorahosted.org

2 participants
7 discussions

[gssapi/gssproxy] b70043: Modernize systemd.m4 macro
by David Härdeman 25 Oct '23

25 Oct '23

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: b70043186e4d323d29663783572ecf8fcbaf30d4 https://github.com/gssapi/gssproxy/commit/b70043186e4d323d29663783572ecf8fc… Author: David Härdeman <david(a)hardeman.nu> Date: 2023-10-25 (Wed, 25 Oct 2023) Changed paths: M external/systemd.m4 Log Message: ----------- [gssproxy] Modernize systemd.m4 macro libsystemd-daemon hasn't been a thing since systemd 209 was released (February 2014, before RHEL 7). And the thing we really want to look for is libsystemd, that's it. Signed-off-by: David Härdeman <david(a)hardeman.nu> Commit: 92e87872846c400598db30fb1759cd7c6f00db34 https://github.com/gssapi/gssproxy/commit/92e87872846c400598db30fb1759cd7c6… Author: David Härdeman <david(a)hardeman.nu> Date: 2023-10-25 (Wed, 25 Oct 2023) Changed paths: M contrib/gssproxy.spec.in M src/gp_common.h M src/gp_init.c M src/gp_mgmt.c M src/gp_util.c M systemd/gssproxy.service.in M systemd/gssuserproxy.service.in Log Message: ----------- [gssproxy] Change daemon to Type=notify with systemd This avoids the need for daemonization, pid files, etc and also provides nicer output from systemctl. The notify integration is already prepared to work with Type=notify-reload (which is a bit too recent to make the default at the moment, requires systemd 253+). With this patch applied: root@qtest1:~# systemctl status gssproxy ● gssproxy.service - GSSAPI Proxy Daemon Loaded: loaded (/lib/systemd/system/gssproxy.service; enabled; preset: enabled) Active: active (running) since Fri 2023-10-20 12:59:32 CEST; 4s ago Main PID: 58516 (gssproxy) Status: "Running, 1 service(s) configured" ... root@qtest1:~# ls -1 /etc/gssproxy/ 24-nfs-server.conf gssproxy.conf root@qtest1:~# vi /etc/gssproxy/50-nfs-client.conf root@qtest1:~# ls -1 /etc/gssproxy/ 24-nfs-server.conf 50-nfs-client.conf gssproxy.conf root@qtest1:~# systemctl reload gssproxy root@qtest1:~# systemctl status gssproxy ● gssproxy.service - GSSAPI Proxy Daemon Loaded: loaded (/lib/systemd/system/gssproxy.service; enabled; preset: enabled) Active: active (running) since Fri 2023-10-20 12:59:32 CEST; 1min 39s ago Process: 58576 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 58516 (gssproxy) Status: "Running, 2 service(s) configured" ... Signed-off-by: David Härdeman <david(a)hardeman.nu> Commit: 8d3cc9c5247ce3353f1f9a2ce63bda22cb78b287 https://github.com/gssapi/gssproxy/commit/8d3cc9c5247ce3353f1f9a2ce63bda22c… Author: David Härdeman <david(a)hardeman.nu> Date: 2023-10-25 (Wed, 25 Oct 2023) Changed paths: M systemd/gssproxy.service.in Log Message: ----------- [gssproxy] Harden systemd .service file Most of the configuration options should be straightforward. The previous version of the .service file contained a comment that NoNewPrivileges=yes breaks the ability to open a socket under /var/lib/gssproxy. That does not appear to be correct because ProtectClock=yes was already set, which enables NoNewPrivileges. Furthermore, the comment for ProtectKernelTunables also appears to be incorrect, because it doesn't make all of /proc read-only (it's only /proc/sys/, /sys/, /proc/sysrq-trigger, /proc/latency_stats, /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq, see man systemd.exec(5)), so /proc/net/rpc/use-gss-proxy is still writeable. Perhaps it was a mixup with ProtectProc? With this applied, the "systemd-analyze security gssproxy" score goes from 8.4 (EXPOSED) to 1.7 (OK). Tested with nfs-kernel-server, some more testing in other scenarios might still be necessary. Also, note that this expects all RW data to be stored under /var/lib/gssproxy, /root, /home or /run/user. Signed-off-by: David Härdeman <david(a)hardeman.nu> Compare: https://github.com/gssapi/gssproxy/compare/d4004e67cb39...8d3cc9c5247c

1 0

[gssapi/gssproxy] d4004e: upgrade xml DTD to 4.5
by Tomasz Kłoczko 19 Oct '23

19 Oct '23

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: d4004e67cb399054c07b34517e8f0eaee83c55de https://github.com/gssapi/gssproxy/commit/d4004e67cb399054c07b34517e8f0eaee… Author: Tomasz Kłoczko <kloczek(a)github.com> Date: 2023-10-19 (Thu, 19 Oct 2023) Changed paths: M man/gssproxy-mech.8.xml.in M man/gssproxy.8.xml M man/gssproxy.conf.5.xml Log Message: ----------- upgrade xml DTD to 4.5 Trival change which upgardes xml DTD version to latest stable 4.5. Signed-off-by: Tomasz Kłoczko <kloczek(a)github.com>

1 0

Version 0.9.2 Released
by Simo Sorce 19 Oct '23

19 Oct '23

Misc improvements contributed over the past year on top of the 0.9 series. ## What's Changed * Add a few badges rendered on github by @simo5 in https://github.com/gssapi/gssproxy/pull/58 * Add some unit file proteciton directives by @simo5 in https://github.com/gssapi/gssproxy/pull/59 * Run coverity if there was any commit in the week by @simo5 in https://github.com/gssapi/gssproxy/pull/60 * Coverity fixes by @simo5 in https://github.com/gssapi/gssproxy/pull/61 * Typo doc fix. by @jas4711 in https://github.com/gssapi/gssproxy/pull/62 * More typo fixes to silence Debian lintian typo-in-manual-page. by @jas4711 in https://github.com/gssapi/gssproxy/pull/64 * gssproxy: check result of calloc() is necessary by @GYShit in https://github.com/gssapi/gssproxy/pull/70 * gssproxy/tests: add missing cmd_index in t_program by @GYShit in https://github.com/gssapi/gssproxy/pull/71 * Guard against NULL remote credentials by @simo5 in https://github.com/gssapi/gssproxy/pull/68 * gssproxy:Fix doc typo by @GYShit in https://github.com/gssapi/gssproxy/pull/73 * Fix build on musl libc with clang 16 by @listout in https://github.com/gssapi/gssproxy/pull/76 * systemd: add StateDirectory to gssproxy.service by @bertogg in https://github.com/gssapi/gssproxy/pull/79 * tests: fix userproxytest missed NULL argument pointer by @laokz in https://github.com/gssapi/gssproxy/pull/83 * [gssproxy] retry writing to /proc/net/rpc/use-gss-proxy by @Alphix in https://github.com/gssapi/gssproxy/pull/85 * Do not close fd if it was never set by @simo5 in https://github.com/gssapi/gssproxy/pull/86 ## New Contributors * @jas4711 made their first contribution in https://github.com/gssapi/gssproxy/pull/62 * @GYShit made their first contribution in https://github.com/gssapi/gssproxy/pull/70 * @listout made their first contribution in https://github.com/gssapi/gssproxy/pull/76 * @bertogg made their first contribution in https://github.com/gssapi/gssproxy/pull/79 * @laokz made their first contribution in https://github.com/gssapi/gssproxy/pull/83 * @Alphix made their first contribution in https://github.com/gssapi/gssproxy/pull/85 **Full Changelog**: https://github.com/gssapi/gssproxy/compare/v0.9.1...v0.9.2 Also available here: https://github.com/gssapi/gssproxy/releases/tag/v0.9.2 -- Simo Sorce, DE @ RHEL Crypto Team, Red Hat, Inc

1 0

[gssapi/gssproxy]
by Simo Sorce 19 Oct '23

19 Oct '23

Branch: refs/tags/v0.9.2 Home: https://github.com/gssapi/gssproxy

1 0

[gssapi/gssproxy] 27f883: Version 0.9.2
by Simo Sorce 19 Oct '23

19 Oct '23

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 27f883ff3a75dc7b52d0b0bd692f9eeb8ee53338 https://github.com/gssapi/gssproxy/commit/27f883ff3a75dc7b52d0b0bd692f9eeb8… Author: Simo Sorce <simo(a)redhat.com> Date: 2023-10-19 (Thu, 19 Oct 2023) Changed paths: M version.m4 Log Message: ----------- Version 0.9.2 Signed-off-by: Simo Sorce <simo(a)redhat.com>

1 0

[gssapi/gssproxy] 9d013b: Do not close fd if it was never set
by Simo Sorce 18 Oct '23

18 Oct '23

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 9d013b1bcc6277842824b25241e8652a865a2944 https://github.com/gssapi/gssproxy/commit/9d013b1bcc6277842824b25241e8652a8… Author: Simo Sorce <simo(a)redhat.com> Date: 2023-10-18 (Wed, 18 Oct 2023) Changed paths: M src/gp_init.c Log Message: ----------- Do not close fd if it was never set Fixes Coverity 403648: Argument cannot be negative Signed-off-by: Simo Sorce <simo(a)redhat.com>

1 0

[gssapi/gssproxy] fb8737: retry writing to /proc/net/rpc/use-gss-...
by David Härdeman 18 Oct '23

18 Oct '23

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: fb8737b2c48d67a63a66abfa090e92f21765a94f https://github.com/gssapi/gssproxy/commit/fb8737b2c48d67a63a66abfa090e92f21… Author: David Härdeman <david(a)hardeman.nu> Date: 2023-10-18 (Wed, 18 Oct 2023) Changed paths: M src/gp_init.c M src/gp_proxy.h M src/gssproxy.c Log Message: ----------- [gssproxy] retry writing to /proc/net/rpc/use-gss-proxy This improves the handling of cases where the auth_rpcgss module has not yet been loaded when gssproxy is started. Signed-off-by: David Härdeman <david(a)hardeman.nu>

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy October 2023