On Tue, Dec 02, 2014 at 10:03:54PM +0100, Jakub Hrozek wrote:
On Tue, Dec 02, 2014 at 09:40:42PM +0100, Sumit Bose wrote:
> On Tue, Dec 02, 2014 at 02:54:42PM +0100, Jakub Hrozek wrote:
> > Hi,
> >
> > these patches depend on Sumit's "[PATCHES] ldap_child, krb5_child:
copy
> > keytab and FAST ccache into memory".
> >
> > When applied, the FAST ccache is created as the SSSD so that no Kerberos
> > networking code runs as the root user. In order to do that, the
> > krb5_child receives the SSSD user IDs as parameters.
> >
> > I also have tests for the other functions in the child_common.c module
> > but I will send them separately to speed up the review.
...
static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
krb5_context ctx,
+ uid_t fast_uid,
+ gid_t fast_gid,
const char *primary,
const char *realm,
const char *keytab_name,
@@ -1737,6 +1720,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
krb5_keytab keytab = NULL;
krb5_principal client_princ = NULL;
krb5_principal server_princ = NULL;
+ pid_t fchild_pid;
+ int status;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
@@ -1794,10 +1779,78 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
}
}
- kerr = get_and_save_tgt_with_keytab(ctx, client_princ, keytab, ccname);
- if (kerr != 0) {
- DEBUG(SSSDBG_CRIT_FAILURE, "get_and_save_tgt_with_keytab failed.\n");
- goto done;
+ /* Need to recreate the FAST ccache */
+ fchild_pid = fork();
+ switch (fchild_pid) {
+ case -1:
+ DEBUG(SSSDBG_CRIT_FAILURE, "fork failed\n");
+ kerr = EIO;
+ goto done;
+ case 0:
+ /* Child */
+ debug_prg_name = talloc_asprintf(NULL, "[sssd[krb5_child[%d]]]",
getpid());
+ if (debug_prg_name == NULL) {
just a nitpick, DEBUG will use NULL as debug_prg_name here, better add
debug_prg_name = "[sssd[krb5_child]]";
as in main(). Otherwise ACK.
bye,
Sumit