Add option to specify allowed usage.

Credentials can often be used both to accept and to initiate contexts.
With this option admins can allow a specific usage only.
This is to avoid allowing an unprivileged process to fool a remote
client by allowing it to impersonate a server, when we only want to
allow this service to use credentials to initiate contexts.

Reviewed-by: Günther Deschner <gdeschner@redhat.com

1 files changed, 1 insertions, 0 deletions

diff --git a/proxy/src/gp_proxy.h b/proxy/src/gp_proxy.h
index a5b3a28..5f42ffa 100644
--- a/proxy/src/gp_proxy.h
+++ b/proxy/src/gp_proxy.h
@@ -55,6 +55,7 @@ struct gp_service {
     bool kernel_nfsd;
     char *socket;
     SELINUX_CTX selinux_ctx;
+    gss_cred_usage_t cred_usage;
 
     uint32_t mechs;
     struct gp_cred_krb5 krb5;