On Wed, 2012-06-13 at 14:21 -0400, Stephen Gallagher wrote:
On Wed, 2012-06-13 at 14:11 -0400, Simo Sorce wrote:
> On Wed, 2012-06-13 at 12:18 -0400, Stephen Gallagher wrote:
>
> > Also, I'm going to open a bug to have pam_systemd.so create a
> > subdirectory for us, so we're not polluting the /run/user/username
> > directory with cryptically-named files.
>
> Why cryptically named files ?
libkrb5 creates files named tktXXXXX (where XXXXX is random) and primary
in the target directory. I'd like to keep this in a subdirectory
of /run/user/username.
>
> We should just create one well know ccache dir.
> And we can create it ourselves, why should we have pam_systemd involved
> here ?
/run/user/username is created automatically by pam_systemd during
session start (and removed on last session exit).
If we decide to take on directory creation, we need to handle parent
directories too (in case someone chooses to manually set a cache dir
that's much deeper). And this still wouldn't play well with other
libkrb5-using applications, since they would each need to grow this
functionality as well.
No we don't need to handle parent directories creation.
If the path up to the component before the cache does not exist we just
fail.
this is because we MUST create the cache as the user not as root (this
is mandatory) and the user will have no permission to create anything
outside or /ryn/user/username
Plus I do not think we need to give the same kind of flexibility we have
for FILE ccaches. Ie we should not allow arbitrary filenames.
Also we need to alignn with libkrb5 they will create the ccache dir if
one does not exist in the next version, also there is work to change the
default for libkrb5 to /run/user/username/ as you know, so allowing
admins to change that randomly will probably be a bad idea for the DIR
type.
So I opened
https://bugzilla.redhat.com/show_bug.cgi?id=831738 to
have
pam_systemd just do this for us on session login so we don't have to
worry about it for each and every potential consumer.
I think pam_systemd should have nothing to do with krb5, I would close
it.
I also opened
https://bugzilla.redhat.com/show_bug.cgi?id=831740 for
the
record (to change to /run/user/UID instead of /run/user/username). We'll
see where that goes.
Yes we probably still want to push for this if it is not too late.
Simo.
--
Simo Sorce * Red Hat, Inc * New York