From a14cb37d199fec9227f668fe107bf38f99b8b842 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Sun, 22 Dec 2013 16:13:56 -0500
Subject: Add support for dropping privileges
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the 'proxy user' configuation option is set in the [gssproxy] section then
GSS Proxy will drop privileges to the specified after setting up all the
sockets.

Care must be taken to make sure all the resources the daemon need access to
(keytabs, ccache directories, etc..) are accessible as the proxy user.

Implements: https://fedorahosted.org/gss-proxy/ticket/102

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Günther Deschner <gdeschner@redhat.com>
---
 proxy/man/gssproxy.conf.5.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'proxy/man')

diff --git a/proxy/man/gssproxy.conf.5.xml b/proxy/man/gssproxy.conf.5.xml
index b4d5add..95fdb65 100644
--- a/proxy/man/gssproxy.conf.5.xml
+++ b/proxy/man/gssproxy.conf.5.xml
@@ -253,6 +253,15 @@
                     </listitem>
                     </varlistentry>
 
+                <varlistentry>
+                    <term>run_as_user (string)</term>
+                    <listitem>
+                        <para>The name of the user gssproxy will drop privileges to.</para>
+                        <para>This option is only available in the global section.</para>
+                        <para>Default: run_as_user = </para>
+                    </listitem>
+                </varlistentry>
+
                 <varlistentry>
                     <term>selinux_context (string)</term>
                     <listitem>
-- 
cgit