On Mon, Nov 17, 2014 at 06:35:57PM +0100, Sumit Bose wrote:
On Fri, Nov 14, 2014 at 01:52:20PM +0100, Jakub Hrozek wrote:
> On Thu, Nov 13, 2014 at 07:30:41PM +0100, Jakub Hrozek wrote:
> > On Wed, Nov 12, 2014 at 05:08:09PM +0100, Lukas Slebodnik wrote:
> >
...
> > Thank you, see the attached patches.
>
> I forgot to remove the extra find_uid.c from Makefile.am
I only have minor comments, see below. I understand that most part of
the patches are refactorings to make sure the related code is run with
the right permissions. (See next mail for some additional suggestions).
Currently with a bit more complex/secure setup with e.g. FAST and ticket
validation most of the krb5_child still runs as root.
I still haven't found a way to proper serialize keytab or ccache data
so that it can be send from one process to another, but both keytab and
ccache have a memory type. The three attached patches read the keytab
and for FAST the FAST ccache into a MEMORY type, drop the privileges and
run all other operations as unprivileged users.
For the ldap_child this is straight forward because only the keytab has
to be read. With a bit of refactoring it might be even possible to drop
the privileges earlier.
FAST makes the situation for the krb5_child a bit more complicated
because if there is no valid FAST ccache a whole kinit with the keytab
has to be run and it would be nice if the result can be read by other
krb5_child processes as well as long as the ticket is valid. What would
be possible is to read the keytab as root, switch to the SSSD user to
check the FAST ccache and eventually do a kinit to renew it, switch
back to root and finally drop all privileges and become the user. I'm
not sure about the switching to the SSSD user because we not really drop
the privileges because we can become root again. As an alternative we
can become the user immediately after reading the keytab and create the
FAST ccache only in memory. But this means that we always have to get a
fresh FAST ccache.
Please note that the patches are only a POC, tests are missing and there
might be some memory issues. Nevertheless it would be nice to know if
you think that this idea is worth to follow further.
bye,
Sumit
The ccache handling always was delicate, e.g. directory creation with
DIR type and determine if FILE with _XXXXXX should be recreated or
reused. I run couple to tests without an issue but I think only
regression testing might give clarity here. So ACK from my side.
bye,
Sumit