[SSSD] [PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged

Jakub Hrozek jhrozek at redhat.com
Tue Nov 18 14:19:43 UTC 2014


On Mon, Nov 17, 2014 at 08:45:26PM +0100, Sumit Bose wrote:
> On Mon, Nov 17, 2014 at 06:35:57PM +0100, Sumit Bose wrote:
> > On Fri, Nov 14, 2014 at 01:52:20PM +0100, Jakub Hrozek wrote:
> > > On Thu, Nov 13, 2014 at 07:30:41PM +0100, Jakub Hrozek wrote:
> > > > On Wed, Nov 12, 2014 at 05:08:09PM +0100, Lukas Slebodnik wrote:
> > > > 
> > 
> > ...
> > 
> > > > Thank you, see the attached patches.
> > > 
> > > I forgot to remove the extra find_uid.c from Makefile.am
> > 
> > I only have minor comments, see below. I understand that most part of
> > the patches are refactorings to make sure the related code is run with
> > the right permissions. (See next mail for some additional suggestions).
> 
> Currently with a bit more complex/secure setup with e.g. FAST and ticket
> validation most of the krb5_child still runs as root.
> 
> I still haven't found a way to proper serialize keytab or ccache data
> so that it can be send from one process to another, but both keytab and
> ccache have a memory type. The three attached patches read the keytab
> and for FAST the FAST ccache into a MEMORY type, drop the privileges and
> run all other operations as unprivileged users.
> 
> For the ldap_child this is straight forward because only the keytab has
> to be read. With a bit of refactoring it might be even possible to drop
> the privileges earlier.
> 
> FAST makes the situation for the krb5_child a bit more complicated
> because if there is no valid FAST ccache a whole kinit with the keytab
> has to be run and it would be nice if the result can be read by other
> krb5_child processes as well as long as the ticket is valid. What would
> be possible is to read the keytab as root, switch to the SSSD user to
> check the FAST ccache and eventually do a kinit to renew it, switch
> back to root and finally drop all privileges and become the user. I'm
> not sure about the switching to the SSSD user because we not really drop
> the privileges because we can become root again. As an alternative we
> can become the user immediately after reading the keytab and create the
> FAST ccache only in memory. But this means that we always have to get a
> fresh FAST ccache.
> 
> Please note that the patches are only a POC, tests are missing and there
> might be some memory issues. Nevertheless it would be nice to know if
> you think that this idea is worth to follow further.

Absolutely!

You're right that with my patches the child processes still run as root
and this would be an awesome improvement.

About testing -- I'd like to summarize what's done and what's missing in
the design page as the immediate next step, then work on tests. I
submitted some previously, but they were a bit fragile. I guess when
ldap_child and krb5_child tests are in place, we can start merging your
patches..



More information about the sssd-devel mailing list