summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2015-01-20 18:06:49 +0100
committerJakub Hrozek <jhrozek@redhat.com>2015-01-21 11:25:49 +0100
commit858e750c3d4fe54e50616a1ed1e101469503c070 (patch)
treebcedf85c2277380983eb21251f375adea06d7f5f
parent7543052f562f157f7b17fdc46a6777d80c0cb3bd (diff)
downloadsssd-858e750c3d4fe54e50616a1ed1e101469503c070.tar.gz
sssd-858e750c3d4fe54e50616a1ed1e101469503c070.tar.xz
sssd-858e750c3d4fe54e50616a1ed1e101469503c070.zip
Open the PAC socket from krb5_child before dropping root
The PAC responder by default allows only connections from the root user. This patch opens the socket to the PAC responder before the krb5_child drops privileges so the connection seemingly comes from root. https://fedorahosted.org/sssd/ticket/2559 Reviewed-by: Sumit Bose <sbose@redhat.com>
-rw-r--r--src/providers/krb5/krb5_child.c8
-rw-r--r--src/sss_client/common.c13
-rw-r--r--src/sss_client/sss_cli.h6
3 files changed, 27 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index ae395e5d3..8b3f10d82 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -2313,6 +2313,14 @@ static krb5_error_code privileged_krb5_setup(struct krb5_req *kr,
}
}
+ if (kr->send_pac) {
+ ret = sss_pac_check_and_open();
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE, "Cannot open the PAC responder socket\n");
+ /* Not fatal */
+ }
+ }
+
return 0;
}
diff --git a/src/sss_client/common.c b/src/sss_client/common.c
index 7c4bb7ab8..1b0fb1223 100644
--- a/src/sss_client/common.c
+++ b/src/sss_client/common.c
@@ -749,6 +749,19 @@ enum nss_status sss_nss_make_request(enum sss_cli_command cmd,
}
}
+int sss_pac_check_and_open(void)
+{
+ enum sss_status ret;
+ int errnop;
+
+ ret = sss_cli_check_socket(&errnop, SSS_PAC_SOCKET_NAME);
+ if (ret != SSS_STATUS_SUCCESS) {
+ return EIO;
+ }
+
+ return EOK;
+}
+
int sss_pac_make_request(enum sss_cli_command cmd,
struct sss_cli_req_data *rd,
uint8_t **repbuf, size_t *replen,
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index 2d909311c..6286077fc 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -511,6 +511,12 @@ int sss_pam_make_request(enum sss_cli_command cmd,
int *errnop);
void sss_pam_close_fd(void);
+/* Checks access to the PAC responder and opens the socket, if available.
+ * Required for processes like krb5_child that need to open the socket
+ * before dropping privs.
+ */
+int sss_pac_check_and_open(void);
+
int sss_pac_make_request(enum sss_cli_command cmd,
struct sss_cli_req_data *rd,
uint8_t **repbuf, size_t *replen,