This is an automated email from the git hooks/post-receive script.
rharwood pushed a change to branch master
in repository gssproxy.
from c7e8b40 Update systemd file
new 00893a5 Mark selinux config attributes as deprecated
new d5423f3 Require krb5 >= 1.14 for GSS_KRB5_CRED_NO_CI_FLAGS_X
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "adds" were already present in the repository and have only
been added to this reference.
Summary of changes:
proxy/configure.ac | 3 +++
proxy/man/gssproxy.conf.5.xml | 23 +++++++++--------------
proxy/src/gp_config.c | 2 ++
3 files changed, 14 insertions(+), 14 deletions(-)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
Show replies by date
This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master
in repository gssproxy.
commit 00893a5a596daaad87fe6a5b1cdf133384f696ea
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Fri May 12 16:51:06 2017 -0400
Mark selinux config attributes as deprecated
Resolves: #179
Signed-off-by: Robbie Harwood <rharwood(a)redhat.com>
Reviewed-by: Simo Sorce <simo(a)redhat.com>
Merges: #183
---
proxy/man/gssproxy.conf.5.xml | 23 +++++++++--------------
proxy/src/gp_config.c | 2 ++
2 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/proxy/man/gssproxy.conf.5.xml b/proxy/man/gssproxy.conf.5.xml
index ad9d96f..ed003c1 100644
--- a/proxy/man/gssproxy.conf.5.xml
+++ b/proxy/man/gssproxy.conf.5.xml
@@ -91,12 +91,13 @@
<term>allow_any_uid (boolean)</term>
<listitem>
<para>Allow any process of any user to use this
service.</para>
- <para>Note that absent a custom socket or selinux_context
option
- this option may cause a service definition to mask access
to
- following services. To avoid issues change the order of
services
- in your configuation file so that services with
allow_any_uid
- enabled are listed last, or define a custom socket for
other
- services.</para>
+ <para>Note that absent a custom socket option this
+ option may cause a service definition to mask
+ access to following services. To avoid issues
+ change the order of services in your
+ configuation file so that services with
+ allow_any_uid enabled are listed last, or define
+ a custom socket for other services.</para>
<para>Default: false</para>
</listitem>
</varlistentry>
@@ -331,14 +332,8 @@
<varlistentry>
<term>selinux_context (string)</term>
<listitem>
- <para>This parameter instructs the proxy to allow map a
- request to the service only if the context of the
- connecting client matches the one defined here.
- </para>
- <para>When this parameter is not set any client will be
- allowed regardless of their selinux context.
- </para>
- <para>Example: selinux_context = system_u:system_r:gssd_t
+ <para>This option is deprecated. Use a custom socket
+ or euid instead.
</para>
</listitem>
</varlistentry>
diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c
index a671333..1d2bf7d 100644
--- a/proxy/src/gp_config.c
+++ b/proxy/src/gp_config.c
@@ -477,6 +477,8 @@ static int load_services(struct gp_config *cfg, struct gp_ini_context
*ctx)
ret = gp_config_get_string(ctx, secname,
"selinux_context", &value);
if (ret == 0) {
+ GPDEBUG(
+ "selinux_ctx is deprecated; use euid/socket instead.\n");
cfg->svcs[n]->selinux_ctx = SELINUX_context_new(value);
if (!cfg->svcs[n]->selinux_ctx) {
ret = EINVAL;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master
in repository gssproxy.
commit d5423f37c79e3e9944d4166935c073e0b0b0cf41
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Fri May 12 17:05:49 2017 -0400
Require krb5 >= 1.14 for GSS_KRB5_CRED_NO_CI_FLAGS_X
Resolves: #169
Signed-off-by: Robbie Harwood <rharwood(a)redhat.com>
Reviewed-by: Simo Sorce <simo(a)redhat.com>
Merges: #184
---
proxy/configure.ac | 3 +++
1 file changed, 3 insertions(+)
diff --git a/proxy/configure.ac b/proxy/configure.ac
index c52dbb6..bc73dd9 100644
--- a/proxy/configure.ac
+++ b/proxy/configure.ac
@@ -133,6 +133,9 @@ AC_CHECK_LIB(gssapi_krb5, gss_export_cred,,
AC_CHECK_DECLS([GSS_KRB5_GET_CRED_IMPERSONATOR], [], [],
[[#include <gssapi/gssapi_krb5.h>]])
+AC_CHECK_DECLS([GSS_KRB5_CRED_NO_CI_FLAGS_X], [],
+ [AC_MSG_ERROR([krb5 too old; missing GSS_KRB5_CRED_NO_CI_FLAGS_X
(v1.14)])],
+ [[#include <gssapi/gssapi_krb5.h>]])
AC_SUBST([KRB5_CFLAGS])
AC_SUBST([KRB5_LIBS])
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.