This is an automated email from the git hooks/post-receive script.
rharwood pushed a change to branch master in repository gssproxy.
from c7e8b40 Update systemd file new 00893a5 Mark selinux config attributes as deprecated new d5423f3 Require krb5 >= 1.14 for GSS_KRB5_CRED_NO_CI_FLAGS_X
The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference.
Summary of changes: proxy/configure.ac | 3 +++ proxy/man/gssproxy.conf.5.xml | 23 +++++++++-------------- proxy/src/gp_config.c | 2 ++ 3 files changed, 14 insertions(+), 14 deletions(-)
This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master in repository gssproxy.
commit 00893a5a596daaad87fe6a5b1cdf133384f696ea Author: Robbie Harwood rharwood@redhat.com Date: Fri May 12 16:51:06 2017 -0400
Mark selinux config attributes as deprecated
Resolves: #179 Signed-off-by: Robbie Harwood rharwood@redhat.com Reviewed-by: Simo Sorce simo@redhat.com Merges: #183 --- proxy/man/gssproxy.conf.5.xml | 23 +++++++++-------------- proxy/src/gp_config.c | 2 ++ 2 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/proxy/man/gssproxy.conf.5.xml b/proxy/man/gssproxy.conf.5.xml index ad9d96f..ed003c1 100644 --- a/proxy/man/gssproxy.conf.5.xml +++ b/proxy/man/gssproxy.conf.5.xml @@ -91,12 +91,13 @@ <term>allow_any_uid (boolean)</term> <listitem> <para>Allow any process of any user to use this service.</para> - <para>Note that absent a custom socket or selinux_context option - this option may cause a service definition to mask access to - following services. To avoid issues change the order of services - in your configuation file so that services with allow_any_uid - enabled are listed last, or define a custom socket for other - services.</para> + <para>Note that absent a custom socket option this + option may cause a service definition to mask + access to following services. To avoid issues + change the order of services in your + configuation file so that services with + allow_any_uid enabled are listed last, or define + a custom socket for other services.</para> <para>Default: false</para> </listitem> </varlistentry> @@ -331,14 +332,8 @@ <varlistentry> <term>selinux_context (string)</term> <listitem> - <para>This parameter instructs the proxy to allow map a - request to the service only if the context of the - connecting client matches the one defined here. - </para> - <para>When this parameter is not set any client will be - allowed regardless of their selinux context. - </para> - <para>Example: selinux_context = system_u:system_r:gssd_t + <para>This option is deprecated. Use a custom socket + or euid instead. </para> </listitem> </varlistentry> diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c index a671333..1d2bf7d 100644 --- a/proxy/src/gp_config.c +++ b/proxy/src/gp_config.c @@ -477,6 +477,8 @@ static int load_services(struct gp_config *cfg, struct gp_ini_context *ctx) ret = gp_config_get_string(ctx, secname, "selinux_context", &value); if (ret == 0) { + GPDEBUG( + "selinux_ctx is deprecated; use euid/socket instead.\n"); cfg->svcs[n]->selinux_ctx = SELINUX_context_new(value); if (!cfg->svcs[n]->selinux_ctx) { ret = EINVAL;
This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master in repository gssproxy.
commit d5423f37c79e3e9944d4166935c073e0b0b0cf41 Author: Robbie Harwood rharwood@redhat.com Date: Fri May 12 17:05:49 2017 -0400
Require krb5 >= 1.14 for GSS_KRB5_CRED_NO_CI_FLAGS_X
Resolves: #169 Signed-off-by: Robbie Harwood rharwood@redhat.com Reviewed-by: Simo Sorce simo@redhat.com Merges: #184 --- proxy/configure.ac | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/proxy/configure.ac b/proxy/configure.ac index c52dbb6..bc73dd9 100644 --- a/proxy/configure.ac +++ b/proxy/configure.ac @@ -133,6 +133,9 @@ AC_CHECK_LIB(gssapi_krb5, gss_export_cred,,
AC_CHECK_DECLS([GSS_KRB5_GET_CRED_IMPERSONATOR], [], [], [[#include <gssapi/gssapi_krb5.h>]]) +AC_CHECK_DECLS([GSS_KRB5_CRED_NO_CI_FLAGS_X], [], + [AC_MSG_ERROR([krb5 too old; missing GSS_KRB5_CRED_NO_CI_FLAGS_X (v1.14)])], + [[#include <gssapi/gssapi_krb5.h>]])
AC_SUBST([KRB5_CFLAGS]) AC_SUBST([KRB5_LIBS])
gss-proxy@lists.fedorahosted.org