diff options
| author | Jakub Hrozek <jhrozek@redhat.com> | 2015-01-20 18:06:49 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-01-21 11:25:49 +0100 |
| commit | 858e750c3d4fe54e50616a1ed1e101469503c070 (patch) | |
| tree | bcedf85c2277380983eb21251f375adea06d7f5f /src/sss_client/sss_cli.h | |
| parent | 7543052f562f157f7b17fdc46a6777d80c0cb3bd (diff) | |
| download | sssd-858e750c3d4fe54e50616a1ed1e101469503c070.tar.gz sssd-858e750c3d4fe54e50616a1ed1e101469503c070.tar.xz sssd-858e750c3d4fe54e50616a1ed1e101469503c070.zip | |
Open the PAC socket from krb5_child before dropping root
The PAC responder by default allows only connections from the root user.
This patch opens the socket to the PAC responder before the krb5_child
drops privileges so the connection seemingly comes from root.
https://fedorahosted.org/sssd/ticket/2559
Reviewed-by: Sumit Bose <sbose@redhat.com>
Diffstat (limited to 'src/sss_client/sss_cli.h')
| -rw-r--r-- | src/sss_client/sss_cli.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index 2d909311c..6286077fc 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -511,6 +511,12 @@ int sss_pam_make_request(enum sss_cli_command cmd, int *errnop); void sss_pam_close_fd(void); +/* Checks access to the PAC responder and opens the socket, if available. + * Required for processes like krb5_child that need to open the socket + * before dropping privs. + */ +int sss_pac_check_and_open(void); + int sss_pac_make_request(enum sss_cli_command cmd, struct sss_cli_req_data *rd, uint8_t **repbuf, size_t *replen, |