[SSSD] [PATCHES] Simplify credential krb5 cache manipulation

Simo Sorce simo at redhat.com
Thu Sep 5 13:20:14 UTC 2013


On Thu, 2013-09-05 at 09:16 -0400, Simo Sorce wrote:
> On Thu, 2013-09-05 at 13:47 +0200, Sumit Bose wrote:
> > On Tue, Sep 03, 2013 at 10:07:13PM -0400, Simo Sorce wrote:
> > > After the recent patches to explicitly enable the KEYRING type in SSSD I
> > > realized that the code that manipulates ccaches had grown too much, and,
> > > most importantly, was doing unnecessary operations already performed in
> > > an abstract way by krb5 functions.
> > > 
> > > This patch set mostly addresses ticket #2061
> > > 
> > > The aims has been to remove as much as possible type-specific code,
> > > resorting to type specific behavior only as an explicit exception where
> > > necessary due to historical or other reasons.
> > > 
> > > The combined diff gives a nice total stat of:
> > >   815 insertions(+)
> > >   1529 deletions(-)
> > > 
> > 
> > I really like cleanup that comes with the patches but I would prefer not
> > to use setresuid() in the backend code because it allows any SSSD user
> > to kill the complete sssd_be process.
> > 
> > If there is no other safe way to handle the credential cache I think the
> > related operations should be moved from the backend code to the
> > krb5_child.
> 
> That would be quite a different set of patches, I guess we can open a
> bug to do that after this patchset goes in, but it will be hard, we do
> some sysdb operations in there and I am not sure we want to allow the
> child to do that.
> 
> Why do you think any user can kill sssd_be if we change user ?
> IIRC we block all signals that could do that already.

Btw, rebased patches on top of master are kept here:
http://fedorapeople.org/cgit/simo/public_git/sssd.git/log/?h=ccname

Given the size I'll resend the patchset to the list if there is any
change request, but not for mere rebases for now.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list