summaryrefslogtreecommitdiffstats
path: root/proxy/src/gp_proxy.h
Commit message (Collapse)AuthorAgeFilesLines
* Extract generalized selinux context comparison functionRobbie Harwood2015-09-041-0/+1
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for config directoriesRobbie Harwood (frozencemetery)2015-09-041-2/+3
| | | | | | | | | | Option '-C|--configdir' has been added, and defaults to /etc/gssproxy. File "gssproxy.conf" and all files of the form "##-foo.conf" will be read from that directory. Ticket: https://fedorahosted.org/gss-proxy/ticket/122 Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add cmdline option to override default socketSimo Sorce2014-09-151-1/+2
| | | | | | | | This is especially useful for testing, but can be useful for custom configurations of gss-proxy as well (containers, chroots, etc..) Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Guenther Deschner <gdeschner@redhat.com>
* Block parent process until child is initialized.Simo Sorce2014-01-151-1/+2
| | | | | | | | | | | | This way the init system will not proceed starting dependencies until gssproxy is actually ready to serve requests. In particular this is used to make sure the nfsd proc file has been touched before the nfsd server is started. Resolves: https://fedorahosted.org/gss-proxy/ticket/114 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add support for dropping privilegesSimo Sorce2014-01-141-0/+3
| | | | | | | | | | | | | | If the 'proxy user' configuation option is set in the [gssproxy] section then GSS Proxy will drop privileges to the specified after setting up all the sockets. Care must be taken to make sure all the resources the daemon need access to (keytabs, ccache directories, etc..) are accessible as the proxy user. Implements: https://fedorahosted.org/gss-proxy/ticket/102 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* config: Add code to source flag filtersSimo Sorce2013-11-201-0/+2
| | | | | | | | | | | | | | | | | | | 2 New configuration options are made available: - filter_flags - enforce_flags Any GSS Flags listed in the filter_flags option is forcibly filtered out before a gss_init_sec_context() call is invoked. Any GSS Flags listed in the enforce_flags option is forcibly added to the list of flags requested by a gss_init_sec_context() call is invoked. Flags can be either literals or numeric and must be preceded by the sign + (to add to the list) or - (to remove from the list). Resolves: https://fedorahosted.org/gss-proxy/ticket/109 Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add impersonation supportSimo Sorce2013-10-231-0/+1
| | | | | | | | | | | | | By setting the impersonate flag to true, the acquisition of credentials will be done using constrained delegation (s4uself + s4u2proxy). To work this needs MIT Kereberos 1.11.4 or later. Previous versions have a bug in the import_cred function that prevents the library from properly importing previously exported delegated credentials. Resolves: https://fedorahosted.org/gss-proxy/ticket/95 Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add option to specify allowed usage.Simo Sorce2013-10-181-0/+1
| | | | | | | | | | Credentials can often be used both to accept and to initiate contexts. With this option admins can allow a specific usage only. This is to avoid allowing an unprivileged process to fool a remote client by allowing it to impersonate a server, when we only want to allow this service to use credentials to initiate contexts. Reviewed-by: Günther Deschner <gdeschner@redhat.com
* Allow arbitrary users to connect to a serviceSimo Sorce2013-10-181-2/+9
| | | | | | | | | | | The rpc.gssd daemon is changing to fork and change uid to the unprivileged user it wants to authenticate, this means gssproxy needs to allow connection from any euid. When this is done though, the trusted flag needs to be dropped, if the connecting euid does not match the default trusted uid to prevent improper impersonation. Resolves: https://fedorahosted.org/gss-proxy/ticket/103 Reviewed-by: Günther Deschner <gdeschner@redhat.com
* Add service match using SeLinux ContextSimo Sorce2013-07-021-0/+3
| | | | | | | | | | | | Using getpeercon we can know the elinux context of the process talking to gssproxy. Use this information as an optional additional filter to match processes to service definitions. If a selinux_context option with a full user;role;type context is specified into a service section, then the connecting process must also be running under the specified selinux context in order to be allowed to connect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Use const string in config functionsSimo Sorce2013-04-231-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add support for per-service socketsSimo Sorce2013-04-231-1/+10
| | | | | | | | This way different processes running as the same user can be configured as different servervices Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Use mutivalued "cred_store" parameter, deprecate unused parameters.Günther Deschner2013-04-231-3/+2
| | | | | | | | | | | | | | | | The krb5_{ccache,keytab,client_keytab} parameters are replaced with a multivalued "cred_store" parameter instead. krb5_keytab = /etc/krb5.keytab becomes: cred_store = keytab:/etc/krb5.keytab Likewise for the "krb5_ccache" and "krb5_client_keytab" parameters. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Add krb5_client_keytab config optionSimo Sorce2013-04-101-0/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Fix resource leaks found by CoveritySimo Sorce2013-04-031-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Write pid file at startup.Simo Sorce2013-03-221-0/+1
|
* Enable kernel support.Simo Sorce2013-03-221-0/+4
| | | | | | | | The Linux kernel now requires the gss-proxy to signal when it is available. This is done by writing 1 to the file /proc/net/rpc/use-gss-proxy Once this happens the kernel will try to attach to the gss-proxy socket and use it instead of the classic rpc.svcgssd daemon.
* Use new gss_import/export_cred functionsSimo Sorce2012-10-251-8/+7
| | | | | | | This allows us to remove the ring_buffer hack and become completely stateless as well as remove a possible DoS avenue. R.I.P. Ring Buffer :-)
* Add free_config() and call it when server shuts down.Günther Deschner2012-06-251-0/+1
| | | | | | Guenther Signed-off-by: Simo Sorce <simo@redhat.com>
* Add gp_service_get_ring_buffer to retrieve buffer from a service.Günther Deschner2012-06-251-0/+1
| | | | | | Guenther Signed-off-by: Simo Sorce <simo@redhat.com>
* Add gp_ring_buffer pointer to struct gp_service.Günther Deschner2012-06-251-0/+4
| | | | | | Guenther Signed-off-by: Simo Sorce <simo@redhat.com>
* Add two ring_buffers to gp_config struct.Günther Deschner2012-06-251-0/+5
| | | | | | Guenther Signed-off-by: Simo Sorce <simo@redhat.com>
* creds: add code to import krb5 credentials based on configuration.Simo Sorce2012-04-051-0/+6
|
* config: Rework configuration syntaxSimo Sorce2012-04-051-20/+6
| | | | | | | Keeping 2 separate sections for credentials and services seem to just make things really confusing. The off chance of reusing a 'credential' section is dwarfed by the confusion cause by keeping them separate. Having to copy a full service section is not a big deal so KISS wins here.
* config: parse credential/service config sectionsSimo Sorce2012-02-231-0/+34
|
* Split gp_utils.h into proxy headers and commonly useful headersSimo Sorce2012-01-291-0/+80
generated by cgit (git 2.34.1) at 2025-09-26 09:54:26 +0000