[SSSD] [PATCH] Add option to specify the kerberos replay cache dir

Stephen Gallagher sgallagh at redhat.com
Wed Aug 31 16:04:37 UTC 2011


On Wed, 2011-08-31 at 12:47 +0200, Sumit Bose wrote:
> On Tue, Aug 30, 2011 at 04:07:22PM -0400, Stephen Gallagher wrote:
> > On Tue, 2011-08-30 at 13:10 -0400, Stephen Gallagher wrote:
> > > On Tue, 2011-08-30 at 11:23 -0400, Stephen Gallagher wrote:
> > > > On Tue, 2011-08-30 at 10:52 -0400, Stephen Gallagher wrote:
> > > > > Adds a configure option to set the distribution default as well as
> > > > > an sssd.conf option to override it.
> > > > > 
> > > > > Resolves: https://fedorahosted.org/sssd/ticket/980
> > > > 
> > > > Sumit pointed out on IRC that I forgot to include the option in the
> > > > SSSDConfig API. New patch fixes that.
> > > 
> > > Sumit also discovered that my configure script did not properly handle
> > > the default case (where --with-krb5-rcache-dir was not specified).
> > > 
> > > Fixed in the attached patch.
> > 
> > New patch guarantees the existence of the rcache directory.
> > 
> 
> The patch is working as expected, but I'm sorry but I think I have
> changed my mind about the default for KRB5RCACHEDIR. From a Fedora/Red
> Hat perspective using /var/cache/krb5rcache to solve the SELinux issue
> mentioned in #980 and the related bugzilla entry make sense. But while
> testing the patch I realized that currently it is not possible to not
> set KRB5RCACHEDIR to a value. So it is not possible to just use the
> libkrb5 defaults.
> 
> I would like to suggest to change the default to not set KRB5RCACHEDIR
> and use "--with-krb5-rcache-dir=/var/cache/krb5rcache" in Fedora and
> RHEL spec files. This would allow other users and distributions to use
> the libkrb5 defaults.
> 
> Additionally I wasn't able to overwrite the path given by the configure
> option with an empty path with krb5_rcache_dir = "" or similar. Maybe we
> need a special keyword here to allow unsetting KRB5RCACHEDIR via
> sssd.conf?
> 
> Finally a higher level log message if the rcache directory does not
> exists might be useful even if it is in the log of the monitor.


New patch attached makes the following changes:
The special option __LIBKRB5_DEFAULTS__ has been added which will not
set the environment variable. I opted not to have it explicitly unset
the variable, since proper default behavior would be to honor whatever
was in the environment at startup.

I have made the default configure option be __LIBKRB5_DEFAULTS__ but
have changed the example spec file to specify
%{_localstatedir}/cache/krb5rcache

I have updated the manpage to mention __LIBKRB5_DEFAULTS__ and the new
default behavior.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-option-to-specify-the-kerberos-replay-cache-dir.patch
Type: text/x-patch
Size: 9306 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110831/7e113bc3/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110831/7e113bc3/attachment.sig>


More information about the sssd-devel mailing list