[SSSD] [PATCH] Support DIR: credential caches

Simo Sorce simo at redhat.com
Wed Jun 13 18:29:58 UTC 2012


On Wed, 2012-06-13 at 14:21 -0400, Stephen Gallagher wrote:
> On Wed, 2012-06-13 at 14:11 -0400, Simo Sorce wrote:
> > On Wed, 2012-06-13 at 12:18 -0400, Stephen Gallagher wrote:
> > 
> > > Also, I'm going to open a bug to have pam_systemd.so create a
> > > subdirectory for us, so we're not polluting the /run/user/username
> > > directory with cryptically-named files.
> > 
> > Why cryptically named files ?
> 
> libkrb5 creates files named tktXXXXX (where XXXXX is random) and primary
> in the target directory. I'd like to keep this in a subdirectory
> of /run/user/username.
> 
> 
> 
> > 
> > We should just create one well know ccache dir.
> > And we can create it ourselves, why should we have pam_systemd involved
> > here ?
> 
> /run/user/username is created automatically by pam_systemd during
> session start (and removed on last session exit).
> 
> If we decide to take on directory creation, we need to handle parent
> directories too (in case someone chooses to manually set a cache dir
> that's much deeper). And this still wouldn't play well with other
> libkrb5-using applications, since they would each need to grow this
> functionality as well.

No we don't need to handle parent directories creation.
If the path up to the component before the cache does not exist we just
fail.

this is because we MUST create the cache as the user not as root (this
is mandatory) and the user will have no permission to create anything
outside or /ryn/user/username

Plus I do not think we need to give the same kind of flexibility we have
for FILE ccaches. Ie we should not allow arbitrary filenames.

Also we need to alignn with libkrb5 they will create the ccache dir if
one does not exist in the next version, also there is work to change the
default for libkrb5 to /run/user/username/ as you know, so allowing
admins to change that randomly will probably be a bad idea for the DIR
type.

> So I opened https://bugzilla.redhat.com/show_bug.cgi?id=831738 to have
> pam_systemd just do this for us on session login so we don't have to
> worry about it for each and every potential consumer.

I think pam_systemd should have nothing to do with krb5, I would close
it.

> I also opened https://bugzilla.redhat.com/show_bug.cgi?id=831740 for the
> record (to change to /run/user/UID instead of /run/user/username). We'll
> see where that goes.

Yes we probably still want to push for this if it is not too late.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list