On Tue, Oct 28, 2014 at 03:13:37AM +0100, Jakub Hrozek wrote:
> Hi,
>
> attached are patches that apply on top of my previous ldap_child and
> selinux_child patches. The complete branch (including tests I'm still
> working on) can be inspected here:
>
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=nonroot
>
> Simo, Sumit, I added you to CC directly, b/c I suspected you wanted to be
> included in larger krb5_child changes..
>
> Below are patch descriptinons of the individual changes.
>
> [PATCH 1/6] BUILD: Install krb5_child as suid if running under non-privileged user
> If sssd_be is running unprivileged, then krb5_child must be setuid to be
> able to access the keytab and become arbitrary user.
>
>
> [PATCH 2/6] KRB5: Drop privileges in the child, not the back end
> In future patches, sssd_be will be running as a non-privileged user, who
> will execute the setuid krb5_child. In this case, the child will start
> as root and drop the privileges as soon as possible.
>
>
> [PATCH 3/6] KRB5: Move ccache-related functions to krb5_ccache.c
> Add a new module krb5_ccache.c that contains all ccache-related
> operations. The only user of this module shall be krb5_child.c as the
> other modules will run unprivileged and accessing the keytab requires
> either privileges of root or the ccache owner.
>
> This patch only /moves/ code, the changes will come in later patches.
>
>
> [PATCH 4/6] KRB5: Move checking for illegal RE to krb5_utils.c
> Otherwise we would have to link krb5_child with pcre and transfer the
> regex, which wold be cumbersome. Check for illegal patterns when
> expanding the template instead.
>
>
> [PATCH 5/6] KRB5: Move all ccache operations to krb5_child.c
> The credential cache operations must be now performed by the krb5_child
> completely, because the sssd_be process might be running as the sssd
> user who doesn't have access to the ccaches.
>
> src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5
> until we fix Kerberos ticket renewal as non-root.
>
> Also includes a new error code that indicates that the back end should
> remove the old ccache attribute -- the child can't do that if it's
> running as the user.
>
>
> [PATCH 6/6] KRB5: Do not switch_creds() if already the specified user
> The code didn't have to handle this case previously as sssd_be was always
> running as root and switching to the ccache as the user logging in.
>
> Also handle NULL creds on restore_creds() in case there was no switch.
> One less if-condition and fewer indentation levels.
>
> Thank you for the review.
Hi,
attached patches fix make distcheck issue. There are no changes in the
code itself.
Hi,
attached are rebased patches. Again, there is no change in the code
itself.
I'm still looking for a reviewer ...