<feed xmlns='http://www.w3.org/2005/Atom'>
<title>sssd.git/src/providers/krb5, branch token3</title>
<subtitle>System Security Services Daemon [okos' clone]</subtitle>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/'/>
<entry>
<title>krb5: Fix warning sometimes uninitialized</title>
<updated>2013-09-10T15:32:33+00:00</updated>
<author>
<name>Lukas Slebodnik</name>
<email>lslebodn@redhat.com</email>
</author>
<published>2013-09-10T08:07:51+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=c1f94194a9fee8582a0af3b151b4f2b14fa1019a'/>
<id>c1f94194a9fee8582a0af3b151b4f2b14fa1019a</id>
<content type='text'>
warning: variable 'ret' is used uninitialized whenever
'if' condition is false
    if (kerr) {
        ^~~~
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
warning: variable 'ret' is used uninitialized whenever
'if' condition is false
    if (kerr) {
        ^~~~
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5_child: Simplify ccache creation</title>
<updated>2013-09-09T19:11:46+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-09-03T03:52:46+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=a6a0d4edebccd3cf04f9813fc65185845626b5d4'/>
<id>a6a0d4edebccd3cf04f9813fc65185845626b5d4</id>
<content type='text'>
The containing ccache directory is precreated by the parent code,
so there is no special need to do so here for any type.
Also the special handling for the FILE ccache temporary file is not really
useful, because libkrb5 internally unlinks and then recreate the file, so
mkstemp cannot really prevent subtle races, it can only make sure the file is
unique at creation time.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The containing ccache directory is precreated by the parent code,
so there is no special need to do so here for any type.
Also the special handling for the FILE ccache temporary file is not really
useful, because libkrb5 internally unlinks and then recreate the file, so
mkstemp cannot really prevent subtle races, it can only make sure the file is
unique at creation time.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Add file/dir path precheck</title>
<updated>2013-09-09T19:11:46+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-31T18:21:22+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=14050f35224360883e20ebd810d3eb40f39267cf'/>
<id>14050f35224360883e20ebd810d3eb40f39267cf</id>
<content type='text'>
Add a precheck on the actual existence at all of the file/dir ccname
targeted (for FILE/DIR types), and bail early if nothing is available.

While testing I found out that without this check, the krb5_cc_resolve()
function we call as user to check old paths would try to create the
directory if it didn't exist.

With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would
cause two undesirable side effects:

First it would actually create a directory with the old name, when it
should not.

Second, because for some reason the umask is set to 0127 in sssd_be, it
would create the directory with permission 600 (missing the 'x' traverse
bit on the directory. If the new ccache has the same name it would cause
the krb5_child process to fal to store the credential cache in it.

Related:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add a precheck on the actual existence at all of the file/dir ccname
targeted (for FILE/DIR types), and bail early if nothing is available.

While testing I found out that without this check, the krb5_cc_resolve()
function we call as user to check old paths would try to create the
directory if it didn't exist.

With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would
cause two undesirable side effects:

First it would actually create a directory with the old name, when it
should not.

Second, because for some reason the umask is set to 0127 in sssd_be, it
would create the directory with permission 600 (missing the 'x' traverse
bit on the directory. If the new ccache has the same name it would cause
the krb5_child process to fal to store the credential cache in it.

Related:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Remove unused ccache backend infrastructure</title>
<updated>2013-09-09T19:11:46+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-31T00:11:42+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=d20a5a74666413cadbf64c02eb656a5a3b4bb1de'/>
<id>d20a5a74666413cadbf64c02eb656a5a3b4bb1de</id>
<content type='text'>
Remove struct sss_krb5_cc_be and the remaining functions that reference
it as they are all unused now.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove struct sss_krb5_cc_be and the remaining functions that reference
it as they are all unused now.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Unify function to create ccache files</title>
<updated>2013-09-09T19:11:46+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T21:25:01+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=1c022b3556f442f57326c4a3f250128b1bd232ae'/>
<id>1c022b3556f442f57326c4a3f250128b1bd232ae</id>
<content type='text'>
Only 2 types (FILE and DIR) need to precreate files or directories
on the file system, and the 2 functions were basically identical.

Consolidate all in one common function and use that function directly
where needed instead of using indirection.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Only 2 types (FILE and DIR) need to precreate files or directories
on the file system, and the 2 functions were basically identical.

Consolidate all in one common function and use that function directly
where needed instead of using indirection.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Use new function to validate ccaches</title>
<updated>2013-09-09T19:11:45+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T20:35:43+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=84ce563e3f430eec1225a6f8493eb0a6c9a3013a'/>
<id>84ce563e3f430eec1225a6f8493eb0a6c9a3013a</id>
<content type='text'>
This function replaces and combines check_for_valid_tgt() and type specific
functions that checked for ccache existence by using generic krb5 cache
function and executing them as the target user (implicitly validate the
target use rcan properly access the ccache).

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This function replaces and combines check_for_valid_tgt() and type specific
functions that checked for ccache existence by using generic krb5 cache
function and executing them as the target user (implicitly validate the
target use rcan properly access the ccache).

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Make check_for_valid_tgt() static</title>
<updated>2013-09-09T19:11:45+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T16:27:49+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=c121e65ed592bf3611053ee38032fd33c8d1b285'/>
<id>c121e65ed592bf3611053ee38032fd33c8d1b285</id>
<content type='text'>
check_for_valid_tgt() is used exclusively in krb5_uitls.c so move it there.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
check_for_valid_tgt() is used exclusively in krb5_uitls.c so move it there.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: move template check to initializzation</title>
<updated>2013-09-09T19:11:45+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T16:21:39+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=5dc3b01fd9b2fa244e7c2820ce04602c9f059370'/>
<id>5dc3b01fd9b2fa244e7c2820ce04602c9f059370</id>
<content type='text'>
The randomized template check realy only makes sense for the FILE ccache
which is the only one that normally needs to use randomizing chars.
Also it is better to warn the admin early rather than to warn 'when it
is too late'.
So move the check at initialization time when we determine what the
template actually is.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The randomized template check realy only makes sense for the FILE ccache
which is the only one that normally needs to use randomizing chars.
Also it is better to warn the admin early rather than to warn 'when it
is too late'.
So move the check at initialization time when we determine what the
template actually is.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Move determination of user being active</title>
<updated>2013-09-09T19:11:45+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T15:31:23+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=bfd32c9e8f302d7722838a68572c6801f5640657'/>
<id>bfd32c9e8f302d7722838a68572c6801f5640657</id>
<content type='text'>
The way a user is checked for being active does not depend on the ccache
type so move that check out of the ccache specific functions.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The way a user is checked for being active does not depend on the ccache
type so move that check out of the ccache specific functions.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
<entry>
<title>krb5: Replace type-specific ccache/principal check</title>
<updated>2013-09-09T19:11:45+00:00</updated>
<author>
<name>Simo Sorce</name>
<email>simo@redhat.com</email>
</author>
<published>2013-08-30T04:58:24+00:00</published>
<link rel='alternate' type='text/html' href='https://fedorapeople.org/cgit/okos/public_git/sssd.git/commit/?id=1536e39c191a013bc50bb6fd4b8eaef11cf0d436'/>
<id>1536e39c191a013bc50bb6fd4b8eaef11cf0d436</id>
<content type='text'>
Instead of having duplicate functions that are type custom use a signle common
function that also performs access to the cache as the user owner, implicitly
validating correctness of ownership.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Instead of having duplicate functions that are type custom use a signle common
function that also performs access to the cache as the user owner, implicitly
validating correctness of ownership.

Resolves:
https://fedorahosted.org/sssd/ticket/2061
</pre>
</div>
</content>
</entry>
</feed>
