gss-proxy.git/proxy, branch master-fixes3

docs: Fill in GSSPROXY_BEHAVIOR default setting from configure option.

2013-10-17T16:53:47+00:00

Signed-off-by: Günther Deschner

docs: autogenerate proxymech manpage.

2013-10-17T15:17:44+00:00

Signed-off-by: Günther Deschner

setup KRB5RCACHEDIR so that krb5 replay caches are created in a defined place.

2013-10-16T13:37:48+00:00

resolves: https://fedorahosted.org/gss-proxy/ticket/100
Signed-off-by: Günther Deschner

Fix resource leak in gpm_accept_sec_context().

2013-10-15T11:48:20+00:00

Resolves Coverity CID #12027.

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Use right signedness for creds buffer.

2013-08-28T15:04:58+00:00

gp_export_creds_*() functions are using a arrays of int32_t values, however this
array holds uids and gids which are unsigned integers.

Signed-off-by: Günther Deschner

Fix selinux option check

2013-08-26T15:05:32+00:00

Found by coverity (CID 11894)

Reviewed-by: Günther Deschner

Add service match using SeLinux Context

2013-07-02T14:17:23+00:00

Using getpeercon we can know the elinux context of the process talking to
gssproxy. Use this information as an optional additional filter to match
processes to service definitions.
If a selinux_context option with a full user;role;type context is specified
into a service section, then the connecting process must also be running under
the specified selinux context in order to be allowed to connect.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Coverity fixes.

2013-06-27T16:07:23+00:00

Fix a 4 coverity issues, ranging from memory leaks, to uninitialized
variables, to potential NULL derefernce.
Also a TOCTOU report that is in one of the accessory test scripts.
The bug itself is not reallya TOCTOU, but the check done in the script is
unecessary, so I just removed it.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Further improve debugging, mention servicename, socket and euid.

2013-06-24T15:51:39+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Properly check socket for connection matching.

2013-06-21T15:04:45+00:00

We always need to chekc if the socket matches otherwise the worng service may
be selected if a specific socket is being used but a service allowing the same
euid is confgured to use the deault socket as well.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner