[SSSD] [PATCH] IPA: Handle sssd-owned keytabs when running as root
Jakub Hrozek
jhrozek at redhat.com
Thu Jul 23 10:59:09 UTC 2015
On Wed, Jul 22, 2015 at 11:25:06PM +0200, Jakub Hrozek wrote:
> On Wed, Jul 22, 2015 at 06:16:00PM +0200, Jakub Hrozek wrote:
> > Hi,
> >
> > the attached patch fixes #2718. To reproduce, run sssd as the root user,
> > but chown the keytab as the sssd users.
>
> And now with two additional trivial patches that make the debug messages
> a bit less noisy and useful.
Sorry for the spam, but one of the debug messages had a wrong level.
-------------- next part --------------
>From 5ed80d4ead8428a69aad761023cf0888c08fbcad Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 15:17:57 +0200
Subject: [PATCH 1/3] IPA: Better debugging
---
src/providers/ipa/ipa_subdomains_server.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
index cd8c6301c4e4fbbf194ca98ce7a7bfe6215b381c..a9e2c1f700ef47716be868bad68590b8d5d0d42a 100644
--- a/src/providers/ipa/ipa_subdomains_server.c
+++ b/src/providers/ipa/ipa_subdomains_server.c
@@ -623,6 +623,9 @@ ipa_server_trust_add_send(TALLOC_CTX *mem_ctx,
immediate:
if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Could not add trusted subdomain %s from forest %s\n",
+ subdom->name, state->forest);
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
--
2.4.3
-------------- next part --------------
>From d55d1d09a2fb5228f52260b8bd54522b6c594fa7 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 16:29:09 +0200
Subject: [PATCH 2/3] UTIL: Lower debug level in perform_checks()
Failures in perform_checks() don't have to be fatal, therefore the debug
messages shouldn't be either.
---
src/util/check_and_open.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/util/check_and_open.c b/src/util/check_and_open.c
index 59b90bf4b96731e385fcf92ed8bc251cb94abfda..b40ae2003e3de22ce9e4ca07cecc68e18a7abab4 100644
--- a/src/util/check_and_open.c
+++ b/src/util/check_and_open.c
@@ -99,12 +99,12 @@ static errno_t perform_checks(struct stat *stat_buf,
}
if ((mode & S_IFMT) != (st_mode & S_IFMT)) {
- DEBUG(SSSDBG_CRIT_FAILURE, "File is not the right type.\n");
+ DEBUG(SSSDBG_TRACE_LIBS, "File is not the right type.\n");
return EINVAL;
}
if ((st_mode & ALLPERMS) != (mode & ALLPERMS)) {
- DEBUG(SSSDBG_CRIT_FAILURE,
+ DEBUG(SSSDBG_TRACE_LIBS,
"File has the wrong (bit masked) mode [%.7o], "
"expected [%.7o].\n",
(st_mode & ALLPERMS), (mode & ALLPERMS));
@@ -112,12 +112,12 @@ static errno_t perform_checks(struct stat *stat_buf,
}
if (uid != (uid_t)(-1) && stat_buf->st_uid != uid) {
- DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by uid [%d].\n", uid);
+ DEBUG(SSSDBG_TRACE_LIBS, "File must be owned by uid [%d].\n", uid);
return EINVAL;
}
if (gid != (gid_t)(-1) && stat_buf->st_gid != gid) {
- DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by gid [%d].\n", gid);
+ DEBUG(SSSDBG_TRACE_LIBS, "File must be owned by gid [%d].\n", gid);
return EINVAL;
}
--
2.4.3
-------------- next part --------------
>From 6a489e72b33d2b02c2f6324369448b34fae9cd43 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 22 Jul 2015 17:20:11 +0200
Subject: [PATCH 3/3] IPA: Handle sssd-owned keytabs when running as root
https://fedorahosted.org/sssd/ticket/2718
This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.
---
src/providers/ipa/ipa_subdomains.h | 3 ++
src/providers/ipa/ipa_subdomains_server.c | 46 +++++++++++++++++++++++++------
2 files changed, 41 insertions(+), 8 deletions(-)
diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
index 5bc63a173a1a8967eb5de30a2da84a81377d3900..2302c5f03e80de2ea1efad424769e777cd6dd8d5 100644
--- a/src/providers/ipa/ipa_subdomains.h
+++ b/src/providers/ipa/ipa_subdomains.h
@@ -94,6 +94,9 @@ struct ipa_server_mode_ctx {
struct ipa_ad_server_ctx *trusts;
struct ipa_ext_groups *ext_groups;
+
+ uid_t kt_owner_uid;
+ uid_t kt_owner_gid;
};
int ipa_ad_subdom_init(struct be_ctx *be_ctx,
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
index a9e2c1f700ef47716be868bad68590b8d5d0d42a..4bfea61e6dd0a02f6b723a39f7ba236c914009b0 100644
--- a/src/providers/ipa/ipa_subdomains_server.c
+++ b/src/providers/ipa/ipa_subdomains_server.c
@@ -520,16 +520,28 @@ static errno_t ipa_getkeytab_recv(struct tevent_req *req, int *child_status)
return EOK;
}
-static errno_t ipa_check_keytab(const char *keytab)
+static errno_t ipa_check_keytab(const char *keytab,
+ uid_t kt_owner_uid,
+ gid_t kt_owner_gid)
{
errno_t ret;
ret = check_file(keytab, getuid(), getgid(), S_IFREG|0600, 0, NULL, false);
- if (ret != EOK) {
- if (ret != ENOENT) {
- DEBUG(SSSDBG_OP_FAILURE, "Failed to check for %s\n", keytab);
- } else {
- DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+ if (ret == ENOENT) {
+ DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+ goto done;
+ } else if (ret != EOK) {
+ if (kt_owner_uid) {
+ ret = check_file(keytab, kt_owner_uid, kt_owner_gid,
+ S_IFREG|0600, 0, NULL, false);
+ }
+
+ if (ret != EOK) {
+ if (ret != ENOENT) {
+ DEBUG(SSSDBG_OP_FAILURE, "Failed to check for %s\n", keytab);
+ } else {
+ DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
+ }
}
goto done;
}
@@ -648,7 +660,9 @@ static errno_t ipa_server_trust_add_1way(struct tevent_req *req)
return EIO;
}
- ret = ipa_check_keytab(state->keytab);
+ ret = ipa_check_keytab(state->keytab,
+ state->id_ctx->server_mode->kt_owner_uid,
+ state->id_ctx->server_mode->kt_owner_gid);
if (ret == EOK) {
DEBUG(SSSDBG_TRACE_FUNC,
"Keytab already present, can add the trust\n");
@@ -704,7 +718,9 @@ static void ipa_server_trust_1way_kt_done(struct tevent_req *subreq)
DEBUG(SSSDBG_TRACE_FUNC,
"Keytab successfully retrieved to %s\n", state->keytab);
- ret = ipa_check_keytab(state->keytab);
+ ret = ipa_check_keytab(state->keytab,
+ state->id_ctx->server_mode->kt_owner_uid,
+ state->id_ctx->server_mode->kt_owner_gid);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, "ipa_check_keytab failed: %d\n", ret);
tevent_req_error(req, ret);
@@ -1029,6 +1045,20 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
id_ctx->server_mode->hostname = hostname;
id_ctx->server_mode->trusts = NULL;
id_ctx->server_mode->ext_groups = NULL;
+ id_ctx->server_mode->kt_owner_uid = 0;
+ id_ctx->server_mode->kt_owner_gid = 0;
+
+ if (getuid() == 0) {
+ /* We need to handle keytabs created by IPA oddjob script gracefully
+ * even if we're running as root and IPA creates them as the SSSD user
+ */
+ ret = sss_user_by_name_or_uid(SSSD_USER,
+ &id_ctx->server_mode->kt_owner_uid,
+ &id_ctx->server_mode->kt_owner_gid);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE, "Failed to get ID of %s\n", SSSD_USER);
+ }
+ }
ret = ipa_ad_subdom_reinit(be_ctx, be_ctx->ev,
be_ctx, id_ctx, be_ctx->domain);
--
2.4.3
More information about the sssd-devel
mailing list