[SSSD] [PATCH] Better confinment of keyrings

Jakub Hrozek jhrozek at redhat.com
Tue Nov 15 17:23:01 UTC 2011


On Fri, Nov 11, 2011 at 06:18:55PM -0500, Simo Sorce wrote:
> After a quick discussion with David Howells (maintainer of
> keutils/keyrings) I created this patch for SSSD.
> 
> It should make the keyrings used to store user passwords not as easy to
> access even for root by confining them to the sssd process and it's
> children.
> 
> I haven't really tested it yet, but I guess we want to discuss if this
> approach is ok first anyway.
> 
> Simo.
> 
> -- 
> Simo Sorce * Red Hat, Inc * New York

I've tested the patch and delayed auth still works OK. I have a
question though - if we fail joining the session keyring, that's not
fatal. Where does keyutils store the key then, if add_key() specifies
KEY_SPEC_SESSION_KEYRING? To the session keyring sssd inherited from
its parent?

Also I think it would make sense to report the errno value in cases joining
the session keyring fails.




More information about the sssd-devel mailing list