Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Further restriction of child processes capabilities (part 2) #7703

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

Further restriction of child processes capabilities (part 2) #7703

wants to merge 5 commits into from

Commits on Nov 19, 2024

  1. KRB5: skip switch_creds() in PKINIT case 

    Since 'krb5_child' has lost set-id bit and is run under uid/gid of
the backend, it was a no-op.
    @alexey-tikhonov
    alexey-tikhonov committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    58a7bf5 View commit details
    Browse the repository at this point in the history

  2. KRB5_CHILD: 'fast-ccache-uid/gid' args aren't used anymore

    @alexey-tikhonov
    alexey-tikhonov committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    b3b1501 View commit details
    Browse the repository at this point in the history

  3. UTILS: "hide" switch_/restore_creds() 

    Those functions are used only in 'krb5_ccache.c' in `sss_open_ccache_as_user()`

This function, in turn, used in:
 - `k5c_ccache_setup()`: justified in PKINIT case
 - `get_and_save_tgt()` -> `safe_remove_old_ccache_file()`: no-op
 - `tgt_req_child()`::ERR_CREDS_EXPIRED -> `safe_remove_old_ccache_file()`: no-op

Perhaps the only justified use case can be re-worked to avoid the need
to switch/restore creds.

That would be good because function is easy to misuse.

Let's stress that those functions should be better avoided by removing from
public header.
    @alexey-tikhonov
    alexey-tikhonov committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    d8644e0 View commit details
    Browse the repository at this point in the history

  4. UTILS: switch_creds(): check if already requested user 

    as a first thing
    @alexey-tikhonov
    alexey-tikhonov committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    cabebce View commit details
    Browse the repository at this point in the history

  5. UTILS: switch_creds(): cosmetics

    @alexey-tikhonov
    alexey-tikhonov committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    6c71729 View commit details
    Browse the repository at this point in the history