[SSSD] [PATCH] IPA: Handle sssd-owned keytabs when running as root

Jakub Hrozek jhrozek at redhat.com
Wed Jul 22 21:25:06 UTC 2015


On Wed, Jul 22, 2015 at 06:16:00PM +0200, Jakub Hrozek wrote:
> Hi,
> 
> the attached patch fixes #2718. To reproduce, run sssd as the root user,
> but chown the keytab as the sssd users.

And now with two additional trivial patches that make the debug messages
a bit less noisy and useful.
-------------- next part --------------
>From b461b92e4abe2cfea2acf3832fca22622c488257 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 15:17:57 +0200
Subject: [PATCH 1/3] IPA: Better debugging

---
 src/providers/ipa/ipa_subdomains_server.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
index cd8c6301c4e4fbbf194ca98ce7a7bfe6215b381c..401f31d4289a6ee106b0953e2a0f9c767075143f 100644
--- a/src/providers/ipa/ipa_subdomains_server.c
+++ b/src/providers/ipa/ipa_subdomains_server.c
@@ -623,6 +623,9 @@ ipa_server_trust_add_send(TALLOC_CTX *mem_ctx,
 
 immediate:
     if (ret != EOK) {
+        DEBUG(SSSDBG_TRACE_LIBS,
+              "Could not add trusted subdomain %s from forest %s\n",
+              subdom->name, state->forest);
         tevent_req_error(req, ret);
     } else {
         tevent_req_done(req);
-- 
2.4.3

-------------- next part --------------
>From 3acdee2af554b38831ca12956e506e8354530216 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 16:29:09 +0200
Subject: [PATCH 2/3] UTIL: Lower debug level in perform_checks()

Failures in perform_checks() don't have to be fatal, therefore the debug
messages shouldn't be either.
---
 src/util/check_and_open.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/util/check_and_open.c b/src/util/check_and_open.c
index 59b90bf4b96731e385fcf92ed8bc251cb94abfda..b40ae2003e3de22ce9e4ca07cecc68e18a7abab4 100644
--- a/src/util/check_and_open.c
+++ b/src/util/check_and_open.c
@@ -99,12 +99,12 @@ static errno_t perform_checks(struct stat *stat_buf,
     }
 
     if ((mode & S_IFMT) != (st_mode & S_IFMT)) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "File is not the right type.\n");
+        DEBUG(SSSDBG_TRACE_LIBS, "File is not the right type.\n");
         return EINVAL;
     }
 
     if ((st_mode & ALLPERMS) != (mode & ALLPERMS)) {
-        DEBUG(SSSDBG_CRIT_FAILURE,
+        DEBUG(SSSDBG_TRACE_LIBS,
               "File has the wrong (bit masked) mode [%.7o], "
               "expected [%.7o].\n",
               (st_mode & ALLPERMS), (mode & ALLPERMS));
@@ -112,12 +112,12 @@ static errno_t perform_checks(struct stat *stat_buf,
     }
 
     if (uid != (uid_t)(-1) && stat_buf->st_uid != uid) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by uid [%d].\n", uid);
+        DEBUG(SSSDBG_TRACE_LIBS, "File must be owned by uid [%d].\n", uid);
         return EINVAL;
     }
 
     if (gid != (gid_t)(-1) && stat_buf->st_gid != gid) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by gid [%d].\n", gid);
+        DEBUG(SSSDBG_TRACE_LIBS, "File must be owned by gid [%d].\n", gid);
         return EINVAL;
     }
 
-- 
2.4.3

-------------- next part --------------
>From 028373622bbaa1018f2369b987707eff22c129be Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 17:20:11 +0200
Subject: [PATCH 3/3] IPA: Handle sssd-owned keytabs when running as root

https://fedorahosted.org/sssd/ticket/2718

This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.
---
 src/providers/ipa/ipa_subdomains.h        |  3 ++
 src/providers/ipa/ipa_subdomains_server.c | 46 +++++++++++++++++++++++++------
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
index 5bc63a173a1a8967eb5de30a2da84a81377d3900..2302c5f03e80de2ea1efad424769e777cd6dd8d5 100644
--- a/src/providers/ipa/ipa_subdomains.h
+++ b/src/providers/ipa/ipa_subdomains.h
@@ -94,6 +94,9 @@ struct ipa_server_mode_ctx {
 
     struct ipa_ad_server_ctx *trusts;
     struct ipa_ext_groups *ext_groups;
+
+    uid_t kt_owner_uid;
+    uid_t kt_owner_gid;
 };
 
 int ipa_ad_subdom_init(struct be_ctx *be_ctx,
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
index 401f31d4289a6ee106b0953e2a0f9c767075143f..2faeb58f7f94c279e590de3ffaf28c5d94e84e90 100644
--- a/src/providers/ipa/ipa_subdomains_server.c
+++ b/src/providers/ipa/ipa_subdomains_server.c
@@ -520,16 +520,28 @@ static errno_t ipa_getkeytab_recv(struct tevent_req *req, int *child_status)
     return EOK;
 }
 
-static errno_t ipa_check_keytab(const char *keytab)
+static errno_t ipa_check_keytab(const char *keytab,
+                                uid_t kt_owner_uid,
+                                gid_t kt_owner_gid)
 {
     errno_t ret;
 
     ret = check_file(keytab, getuid(), getgid(), S_IFREG|0600, 0, NULL, false);
-    if (ret != EOK) {
-        if (ret != ENOENT) {
-            DEBUG(SSSDBG_OP_FAILURE, "Failed to check for %s\n", keytab);
-        } else {
-            DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+        goto done;
+    } else if (ret != EOK) {
+        if (kt_owner_uid) {
+            ret = check_file(keytab, kt_owner_uid, kt_owner_gid,
+                             S_IFREG|0600, 0, NULL, false);
+        }
+
+        if (ret != EOK) {
+            if (ret != ENOENT) {
+                DEBUG(SSSDBG_OP_FAILURE, "Failed to check for %s\n", keytab);
+            } else {
+                DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+            }
         }
         goto done;
     }
@@ -648,7 +660,9 @@ static errno_t ipa_server_trust_add_1way(struct tevent_req *req)
         return EIO;
     }
 
-    ret = ipa_check_keytab(state->keytab);
+    ret = ipa_check_keytab(state->keytab,
+                           state->id_ctx->server_mode->kt_owner_uid,
+                           state->id_ctx->server_mode->kt_owner_gid);
     if (ret == EOK) {
         DEBUG(SSSDBG_TRACE_FUNC,
               "Keytab already present, can add the trust\n");
@@ -704,7 +718,9 @@ static void ipa_server_trust_1way_kt_done(struct tevent_req *subreq)
     DEBUG(SSSDBG_TRACE_FUNC,
           "Keytab successfully retrieved to %s\n", state->keytab);
 
-    ret = ipa_check_keytab(state->keytab);
+    ret = ipa_check_keytab(state->keytab,
+                           state->id_ctx->server_mode->kt_owner_uid,
+                           state->id_ctx->server_mode->kt_owner_gid);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "ipa_check_keytab failed: %d\n", ret);
         tevent_req_error(req, ret);
@@ -1029,6 +1045,20 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
     id_ctx->server_mode->hostname = hostname;
     id_ctx->server_mode->trusts = NULL;
     id_ctx->server_mode->ext_groups = NULL;
+    id_ctx->server_mode->kt_owner_uid = 0;
+    id_ctx->server_mode->kt_owner_gid = 0;
+
+    if (getuid() == 0) {
+        /* We need to handle keytabs created by IPA oddjob script gracefully
+         * even if we're running as root and IPA creates them as the SSSD user
+         */
+        ret = sss_user_by_name_or_uid(SSSD_USER,
+                                      &id_ctx->server_mode->kt_owner_uid,
+                                      &id_ctx->server_mode->kt_owner_gid);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE, "Failed to get ID of %s\n", SSSD_USER);
+        }
+    }
 
     ret = ipa_ad_subdom_reinit(be_ctx, be_ctx->ev,
                                be_ctx, id_ctx, be_ctx->domain);
-- 
2.4.3



More information about the sssd-devel mailing list