[SSSD] [PATCH] Recreate FAST ccache as the sssd user

Sumit Bose sbose at redhat.com
Wed Dec 3 08:44:13 UTC 2014


On Tue, Dec 02, 2014 at 10:03:54PM +0100, Jakub Hrozek wrote:
> On Tue, Dec 02, 2014 at 09:40:42PM +0100, Sumit Bose wrote:
> > On Tue, Dec 02, 2014 at 02:54:42PM +0100, Jakub Hrozek wrote:
> > > Hi,
> > > 
> > > these patches depend on Sumit's "[PATCHES] ldap_child, krb5_child: copy
> > > keytab and FAST ccache into memory".
> > > 
> > > When applied, the FAST ccache is created as the SSSD so that no Kerberos
> > > networking code runs as the root user. In order to do that, the
> > > krb5_child receives the SSSD user IDs as parameters.
> > > 
> > > I also have tests for the other functions in the child_common.c module
> > > but I will send them separately to speed up the review.

...

>  static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
>                                           krb5_context ctx,
> +                                         uid_t fast_uid,
> +                                         gid_t fast_gid,
>                                           const char *primary,
>                                           const char *realm,
>                                           const char *keytab_name,
> @@ -1737,6 +1720,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
>      krb5_keytab keytab = NULL;
>      krb5_principal client_princ = NULL;
>      krb5_principal server_princ = NULL;
> +    pid_t fchild_pid;
> +    int status;
>  
>      tmp_ctx = talloc_new(NULL);
>      if (tmp_ctx == NULL) {
> @@ -1794,10 +1779,78 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
>          }
>      }
>  
> -    kerr = get_and_save_tgt_with_keytab(ctx, client_princ, keytab, ccname);
> -    if (kerr != 0) {
> -        DEBUG(SSSDBG_CRIT_FAILURE, "get_and_save_tgt_with_keytab failed.\n");
> -        goto done;
> +    /* Need to recreate the FAST ccache */
> +    fchild_pid = fork();
> +    switch (fchild_pid) {
> +        case -1:
> +            DEBUG(SSSDBG_CRIT_FAILURE, "fork failed\n");
> +            kerr = EIO;
> +            goto done;
> +        case 0:
> +            /* Child */
> +            debug_prg_name = talloc_asprintf(NULL, "[sssd[krb5_child[%d]]]", getpid());
> +            if (debug_prg_name == NULL) {

just a nitpick, DEBUG will use NULL as debug_prg_name here, better add
     debug_prg_name = "[sssd[krb5_child]]";
as in main(). Otherwise ACK.

bye,
Sumit



More information about the sssd-devel mailing list