[SSSD] [PATCH] krb5: remove field run_as_user

Lukas Slebodnik lslebodn at redhat.com
Wed May 13 16:14:15 UTC 2015


On (12/05/15 16:23), Pavel Reichl wrote:
>Hello,
>
>this patch was already ACKed in another thread, I decided to move it here as
>that thread is going to take some more time to finish.
>
>Thanks!

>From d7266fc2bb4ffb9b16ba5cbf4f7bff552eed43a9 Mon Sep 17 00:00:00 2001
>From: Pavel Reichl <preichl at redhat.com>
>Date: Wed, 29 Apr 2015 06:03:04 -0400
>Subject: [PATCH] krb5: remove field run_as_user
>
>run_as_user is set set but never read.
>---
> src/providers/krb5/krb5_auth.c | 14 --------------
> src/providers/krb5/krb5_auth.h |  1 -
> 2 files changed, 15 deletions(-)
>
>diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
>index 91989df428b2a574a0e45ec01569cf94f7841725..148b08fdf860e92d00be0582eb73a822113f3880 100644
>--- a/src/providers/krb5/krb5_auth.c
>+++ b/src/providers/krb5/krb5_auth.c
>@@ -186,7 +186,6 @@ errno_t krb5_setup(TALLOC_CTX *mem_ctx, struct pam_data *pd,
>         return ENOMEM;
>     }
>     kr->is_offline = false;
>-    kr->run_as_user = true;
>     talloc_set_destructor((TALLOC_CTX *) kr, krb5_cleanup);
> 
>     kr->pd = pd;
>@@ -699,19 +698,6 @@ static void krb5_auth_resolve_done(struct tevent_req *subreq)
>         kr->is_offline = be_is_offline(state->be_ctx);
>     }
> 
>-    /* We need to keep the root privileges to read the keytab file if
>-     * validation or FAST is enabled, otherwise we can drop them and run
>-     * krb5_child with user privileges.
>-     * If we are offline we want to create an empty ccache file. In this
>-     * case we can drop the privileges, too. */
>-    if ((dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) ||
>-         kr->krb5_ctx->use_fast) &&
>-        (!kr->is_offline)) {
>-        kr->run_as_user = false;
>-    } else {
>-        kr->run_as_user = true;
>-    }
>-
>     subreq = handle_child_send(state, state->ev, kr);
>     if (subreq == NULL) {
>         DEBUG(SSSDBG_CRIT_FAILURE, "handle_child_send failed.\n");
>diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
>index 00cb658c418ade2e6a1d9b5362a40f97e0dc6c6b..c9325291627c40e509dc804714b662942fb1d07a 100644
>--- a/src/providers/krb5/krb5_auth.h
>+++ b/src/providers/krb5/krb5_auth.h
>@@ -53,7 +53,6 @@ struct krb5child_req {
>     struct fo_server *kpasswd_srv;
>     bool active_ccache;
>     bool valid_tgt;
>-    bool run_as_user;
>     bool upn_from_different_realm;
>     bool send_pac;
> };
>-- 
>2.1.0
>
Obviuos ACK
http://sssd-ci.duckdns.org/logs/job/15/15/summary.html

LS



More information about the sssd-devel mailing list