gss-proxy.git, branch usermode

Block parent process until child is initialized.

2014-01-04T15:26:53+00:00

This way the init system will not proceed starting dependencies until gssproxy
is actually ready to serve requests.
In particular this is used to make sure the nfsd proc file has been touched
before the nfsd server is started.

Resolves: https://fedorahosted.org/gss-proxy/ticket/114

Signed-off-by: Simo Sorce

Add utility functions to read()/write() safely

2014-01-03T21:47:02+00:00

Automatically handle short reads due to singals interrupting the process.

Signed-off-by: Simo Sorce

Add support for dropping privileges

2013-12-26T21:08:58+00:00

If the 'proxy user' configuation option is set in the [gssproxy] section then
GSS Proxy will drop privileges to the specified after setting up all the
sockets.

Care must be taken to make sure all the resources the daemon need access to
(keytabs, ccache directories, etc..) are accessible as the proxy user.

Implements: https://fedorahosted.org/gss-proxy/ticket/102

Signed-off-by: Simo Sorce

Fix config token parsing.

2013-12-09T15:22:52+00:00

Resolves: https://fedorahosted.org/gss-proxy/ticket/112

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Change version to 0.3.1

2013-11-26T12:22:52+00:00

Signed-off-by: Günther Deschner

Use gp_strerror() everywhere instead of strerror()

2013-11-22T13:41:24+00:00

https://fedorahosted.org/gss-proxy/ticket/111

Reviewed-by: Günther Deschner

Add Thread-safe implementation of strerror()

2013-11-22T13:40:42+00:00

Unfortunately strerror() is not thread safe so we have to juggle with
strerror_r() which is a can of worms as 2 incompatible implementations
are available depending on what is defined at compile time.

Try to do something sane.

https://fedorahosted.org/gss-proxy/ticket/111

Reviewed-by: Günther Deschner

Use secure_getenv in client and mechglue module

2013-11-21T12:48:25+00:00

proxymehc.so may be used in setuid binaries so follow best security
practices and use secure_getenv() if available.
Fallback to poorman emulation when secure_getenv() is not available.

Resolves: https://fedorahosted.org/gss-proxy/ticket/110

Reviewed-by: Günther Deschner

creds: Allow admins to define only client creds

2013-11-20T14:50:12+00:00

When a service is configured with cred_usage = initiate it is
ok to allow only client credentials to be defined.

Reviewed-by: Günther Deschner

config: Do not modify const strings

2013-11-20T14:48:45+00:00

Take a copy here, the option string is const and strtok_r() is not a safe
function as it may change the string it manipulates.

Reviewed-by: Günther Deschner