[SSSD] [PATCH] Collect krb5 trace on high debug levels

Ondrej Kos okos at redhat.com
Thu Oct 11 13:21:21 UTC 2012


On 10/09/2012 07:15 PM, Jakub Hrozek wrote:
> On Tue, Oct 02, 2012 at 10:53:54AM -0400, Stephen Gallagher wrote:
>> On 10/02/2012 09:32 AM, Jakub Hrozek wrote:
>>> https://fedorahosted.org/sssd/ticket/1539
>>>
>>> If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set
>>> Kerberos tracing with krb5_set_trace_filename.
>>>
>>> There's one catch, though. The krb5_child and ldap_child logs are only
>>> writable by root, but the krb5_child process drops privileges to the
>>> user before priming his ccache. With this patch applied and debug_level
>>> set to 10, the krb5_child process doesn't drop privileges..
>>>
>>> I personally think that's fine, because running with debug_level 10
>>
>> SSSDBG_TRACE_ALL is actually level 9
>>
>>> provides a LOT of debugging so it should only be configured for
>>> debugging anyway. Also we don't drop privileges in other scenarios..
>>>
>>
>> Well, this really isn't acceptable. The reason we drop privileges is
>> because that's the only way to create the credential cache with the
>> proper ownership (and handle SELinux transitions).
>>
>>
>>> I could maybe add a new param to the child or add heuristics to drop
>>> privileges after the debugging is set but that seemed like an over
>>> engineering when this feature is only useful for hardcode debugging.
>>>
>>>
>>
>> I'd rather add a new debug level for this, if it's really the
>> solution we're going to take, I want it to be called out in the
>> manpage that if you set debug_level = 10 (or 0x8000) that you are
>> accepting that the added debug information comes at a cost,
>> specifically that it will result in unexpected behavior post-login
>> (wrt access to the credential cache). Because this is now owned by
>> root, it's nontrivial to restore access after this as well.
>>
>>
>> I would much prefer finding a different way to do the logging;
>> perhaps we could have the krb5_child log to krb5_child.$USER.log
>> instead?
>
> You're right, that wasn't my brightest patch.
>
> I've checked the krb5 API again and used krb5_set_trace_callback() to
> proxy krb5 tracing to our DEBUG macros.
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
Ack

O.

-- 
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech

phone: +420-532-294-558
cell:  +420-736-417-909
ext:   82-62558
loc:   1/5C Brno 1 office
irc:   okos @ #brno



More information about the sssd-devel mailing list