[SSSD] [PATCH] Open the PAC socket from krb5_child before dropping root

Jakub Hrozek jhrozek at redhat.com
Wed Jan 21 08:51:29 UTC 2015


Hi,

the attached patch adds a public function that opens the PAC responder
socket. The krb5_child uses this call to open a fd towards PAC before
becoming user so that PAC responder is contacted for users from trusted
domains.
-------------- next part --------------
>From ec362973a69f13d2bf7022fefd9dc1e2bbc757f5 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 20 Jan 2015 18:06:49 +0100
Subject: [PATCH] Open the PAC socket from krb5_child before dropping root

---
 src/providers/krb5/krb5_child.c |  8 ++++++++
 src/sss_client/common.c         | 13 +++++++++++++
 src/sss_client/sss_cli.h        |  6 ++++++
 3 files changed, 27 insertions(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ae395e5d3e1a879f5f8ee9c5cadf1c836ecfbec3..8b3f10d8244f483e6f99a79b01964b0018fa3ee4 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -2313,6 +2313,14 @@ static krb5_error_code privileged_krb5_setup(struct krb5_req *kr,
         }
     }
 
+    if (kr->send_pac) {
+        ret = sss_pac_check_and_open();
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE, "Cannot open the PAC responder socket\n");
+            /* Not fatal */
+        }
+    }
+
     return 0;
 }
 
diff --git a/src/sss_client/common.c b/src/sss_client/common.c
index 7c4bb7ab8769a72f943158366f358b108bfc3bdc..1b0fb1223f3509ef0b5aaf4a53851b868e12d6f0 100644
--- a/src/sss_client/common.c
+++ b/src/sss_client/common.c
@@ -749,6 +749,19 @@ enum nss_status sss_nss_make_request(enum sss_cli_command cmd,
     }
 }
 
+int sss_pac_check_and_open(void)
+{
+    enum sss_status ret;
+    int errnop;
+
+    ret = sss_cli_check_socket(&errnop, SSS_PAC_SOCKET_NAME);
+    if (ret != SSS_STATUS_SUCCESS) {
+        return EIO;
+    }
+
+    return EOK;
+}
+
 int sss_pac_make_request(enum sss_cli_command cmd,
                          struct sss_cli_req_data *rd,
                          uint8_t **repbuf, size_t *replen,
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index 2d909311cf2fa508a187ee4a29a45eae681dc705..6286077fcf25aead1dfcba5c6483e4ff8ae63b9f 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -511,6 +511,12 @@ int sss_pam_make_request(enum sss_cli_command cmd,
                          int *errnop);
 void sss_pam_close_fd(void);
 
+/* Checks access to the PAC responder and opens the socket, if available.
+ * Required for processes like krb5_child that need to open the socket
+ * before dropping privs.
+ */
+int sss_pac_check_and_open(void);
+
 int sss_pac_make_request(enum sss_cli_command cmd,
                          struct sss_cli_req_data *rd,
                          uint8_t **repbuf, size_t *replen,
-- 
2.1.0



More information about the sssd-devel mailing list