gss-proxy.git, branch alluids

Change version to 0.3.0

2013-10-14T21:31:11+00:00

Add option to specify allowed usage.

2013-10-14T21:31:11+00:00

Credentials can often be used both to accept and to initiate contexts.
With this option admins can allow a specific usage only.
This is to avoid allowing an unprivileged process to fool a remote
client by allowing it to impersonate a server, when we only want to
allow this service to use credentials to initiate contexts.

Allow arbitrary users to connect to a service

2013-10-14T21:30:53+00:00

The rpc.gssd daemon is changing to fork and change uid to the unprivileged
user it wants to authenticate, this means gssproxy needs to allow connection
from any euid. When this is done though, the trusted flag needs to be dropped,
if the connecting euid does not match the default trusted uid to prevent
improper impersonation.

Resolves: https://fedorahosted.org/gss-proxy/ticket/103

Use right signedness for creds buffer.

2013-08-28T15:04:58+00:00

gp_export_creds_*() functions are using a arrays of int32_t values, however this
array holds uids and gids which are unsigned integers.

Signed-off-by: Günther Deschner

Fix selinux option check

2013-08-26T15:05:32+00:00

Found by coverity (CID 11894)

Reviewed-by: Günther Deschner

Add service match using SeLinux Context

2013-07-02T14:17:23+00:00

Using getpeercon we can know the elinux context of the process talking to
gssproxy. Use this information as an optional additional filter to match
processes to service definitions.
If a selinux_context option with a full user;role;type context is specified
into a service section, then the connecting process must also be running under
the specified selinux context in order to be allowed to connect.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Coverity fixes.

2013-06-27T16:07:23+00:00

Fix a 4 coverity issues, ranging from memory leaks, to uninitialized
variables, to potential NULL derefernce.
Also a TOCTOU report that is in one of the accessory test scripts.
The bug itself is not reallya TOCTOU, but the check done in the script is
unecessary, so I just removed it.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Further improve debugging, mention servicename, socket and euid.

2013-06-24T15:51:39+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Properly check socket for connection matching.

2013-06-21T15:04:45+00:00

We always need to chekc if the socket matches otherwise the worng service may
be selected if a specific socket is being used but a service allowing the same
euid is confgured to use the deault socket as well.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Split nfs server and client services

2013-06-21T14:26:38+00:00

The NFS server uses a special socket for the kernel communication.
Split configuration in 2 distinct services so we can use specific options that
may be different between server and client.

The 3 main differences so far are:
1. socket: default for client, custom for server
2. kernel_nfd option only for server
3. ccache and client keytab options only for client

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner