diff options
| author | Simo Sorce <simo@redhat.com> | 2013-12-22 16:13:56 -0500 |
|---|---|---|
| committer | Günther Deschner <gdeschner@redhat.com> | 2014-01-14 16:07:27 +0100 |
| commit | a14cb37d199fec9227f668fe107bf38f99b8b842 (patch) | |
| tree | 87846966a6820a6c109e856d7185f490f81ffd01 /proxy/src/gp_config.c | |
| parent | 8b147c9196d9068d0fc5e5a8919b84e8cbb97ef4 (diff) | |
| download | gss-proxy-a14cb37d199fec9227f668fe107bf38f99b8b842.tar.gz gss-proxy-a14cb37d199fec9227f668fe107bf38f99b8b842.tar.xz gss-proxy-a14cb37d199fec9227f668fe107bf38f99b8b842.zip | |
Add support for dropping privileges
If the 'proxy user' configuation option is set in the [gssproxy] section then
GSS Proxy will drop privileges to the specified after setting up all the
sockets.
Care must be taken to make sure all the resources the daemon need access to
(keytabs, ccache directories, etc..) are accessible as the proxy user.
Implements: https://fedorahosted.org/gss-proxy/ticket/102
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Günther Deschner <gdeschner@redhat.com>
Diffstat (limited to 'proxy/src/gp_config.c')
| -rw-r--r-- | proxy/src/gp_config.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c index ee96975..b102546 100644 --- a/proxy/src/gp_config.c +++ b/proxy/src/gp_config.c @@ -453,6 +453,17 @@ int load_config(struct gp_config *cfg) goto done; } + ret = gp_config_get_string(ctx, "gssproxy", "run_as_user", &tmpstr); + if (ret == 0) { + cfg->proxy_user = strdup(tmpstr); + if (!cfg->proxy_user) { + ret = ENOMEM; + goto done; + } + } else if (ret != ENOENT) { + goto done; + } + ret = gp_config_get_int(ctx, "gssproxy", "worker threads", &cfg->num_workers); if (ret != 0 && ret != ENOENT) { @@ -540,6 +551,7 @@ void free_config(struct gp_config **cfg) free(config->config_file); free(config->socket_name); + free(config->proxy_user); for (i=0; i < config->num_svcs; i++) { gp_service_free(config->svcs[i]); |