diff options
| -rw-r--r-- | Makefile.am | 1 | ||||
| -rw-r--r-- | src/monitor/monitor.c | 27 | ||||
| -rw-r--r-- | src/providers/krb5/krb5_delayed_online_authentication.c | 2 |
3 files changed, 29 insertions, 1 deletions
diff --git a/Makefile.am b/Makefile.am index a423ace39..6f01cfbd0 100644 --- a/Makefile.am +++ b/Makefile.am @@ -402,6 +402,7 @@ sssd_SOURCES = \ sssd_LDADD = \ $(SSSD_LIBS) \ $(LIBNL_LIBS) \ + $(KEYUTILS_LIBS) \ libsss_util.la sssd_nss_SOURCES = \ diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c index 1b7f87a94..2db9d5417 100644 --- a/src/monitor/monitor.c +++ b/src/monitor/monitor.c @@ -51,6 +51,10 @@ #include "sbus/sssd_dbus.h" #include "monitor/monitor_interfaces.h" +#ifdef USE_KEYRING +#include <keyutils.h> +#endif + /* ping time cannot be less then once every few seconds or the * monitor will get crazy hammering children with messages */ #define MONITOR_DEF_PING_TIME 10 @@ -2472,6 +2476,29 @@ int main(int argc, const char *argv[]) } } +#ifdef USE_KEYRING + /* Do this before all the forks, it sets the session key ring so all + * keys are private to the daemon and cannot be read by any other process + * tree */ + + /* make a new session */ + ret = keyctl_join_session_keyring(NULL); + if (ret == -1) { + sss_log(SSS_LOG_ALERT, + "Could not create private keyring session. " + "If you store password there they may be easily accessible " + "to the root user. (%d, %s)", errno, strerror(errno)); + } + + ret = keyctl_setperm(KEY_SPEC_SESSION_KEYRING, KEY_POS_ALL); + if (ret == -1) { + sss_log(SSS_LOG_ALERT, + "Could not set permissions on private keyring. " + "If you store password there they may be easily accessible " + "to the root user. (%d, %s)", errno, strerror(errno)); + } +#endif + /* Warn if nscd seems to be running */ ret = check_file(NSCD_SOCKET_PATH, -1, -1, -1, CHECK_SOCK, NULL, false); if (ret == EOK) { diff --git a/src/providers/krb5/krb5_delayed_online_authentication.c b/src/providers/krb5/krb5_delayed_online_authentication.c index 02f09919a..d5dea3bb4 100644 --- a/src/providers/krb5/krb5_delayed_online_authentication.c +++ b/src/providers/krb5/krb5_delayed_online_authentication.c @@ -258,7 +258,7 @@ errno_t add_user_to_delayed_online_authentication(struct krb5_ctx *krb5_ctx, #ifdef USE_KEYRING new_pd->key_serial = add_key("user", new_pd->user, new_pd->authtok, - new_pd->authtok_size, KEY_SPEC_THREAD_KEYRING); + new_pd->authtok_size, KEY_SPEC_SESSION_KEYRING); if (new_pd->key_serial == -1) { ret = errno; DEBUG(1, ("add_key fialed [%d][%s].\n", ret, strerror(ret))); |