[SSSD] [PATCHES] KRB5: Add support for KEYRING:persistent

Stephen Gallagher sgallagh at redhat.com
Fri Aug 23 18:37:48 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patch 0001: Adds a couple debug messages I found useful to figure out
if a bug was in SSSD or libkrb5. Feel free to skip its inclusion if
you feel it's unnecessary (it's at log level 9)

Patch 0002: KRB5: Remove unnecessary call to become_user()
By the time that the create_ccache_in_dir() routine is called, we are
already guaranteed to have dropped privileges. This has either happened
because we dropped them before the exec() in the normal operation case
or because we dropped them explicitly after we completed the TGT
validation step if that or FAST is configured. This code is actually
completely harmless, since it checks internally to see if we've
already dropped privileges before it does so, but it's unnecessary.

Patch 0003: KRB5: Add support for KEYRING cache type
This is the Big One. This adds support for KEYRING types but notes in
sssd-krb5(5) that we only support KEYRING:persistent (this is because
the other keyring types may break if validation or FAST are used).
Other than that, this patch should be reasonably straightforward. I
have tested this code against Simo's preliminary Kerberos patches
along with David Howells' kernel patch for persistent keyrings. We hit
(and fixed) a couple bugs in krb5. This patch should be safe to put
into the upstream master immediately; it does not change any behavior
with the existing FILE or DIR cache types.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlIXq/sACgkQeiVVYja6o6NbpQCgr7VL8rYn4pBM6evONUIFLn5m
fYwAn3vZg2/Bn8R2RsExD7biknyHidvp
=6n94
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Add-low-level-debugging-to-sss_get_ccache_name_.patch
Type: text/x-patch
Size: 1232 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-KRB5-Remove-unnecessary-call-to-become_user.patch
Type: text/x-patch
Size: 1307 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-KRB5-Add-support-for-KEYRING-cache-type.patch
Type: text/x-patch
Size: 14329 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Add-low-level-debugging-to-sss_get_ccache_name_.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-KRB5-Remove-unnecessary-call-to-become_user.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment-0001.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-KRB5-Add-support-for-KEYRING-cache-type.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130823/2ee110ae/attachment-0002.sig>


More information about the sssd-devel mailing list