diff options
| author | Simo Sorce <simo@redhat.com> | 2013-08-31 22:44:06 -0400 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2013-09-19 23:01:22 -0400 |
| commit | f43d0bbb4bd51271b3c1b1c56c4eb680d6e00438 (patch) | |
| tree | e8d571ea65a1284e4b4bcd50378f5be66922fa19 /src/tests/krb5_child-test.c | |
| parent | 85822e46c1d26204b022a8c6cdbbb0b478235754 (diff) | |
| download | sssd-ccname.tar.gz sssd-ccname.tar.xz sssd-ccname.zip | |
krb5: More correct approach to public dir expansionccname
Commit 29752834fbf3a19e4e117668abfce4e4c7c48ee4 (Add expandable sequences
to krb5_ccachedir) introduce a new behavior that tried to take in account
the fact that parent directories may need to be created as accessible to
anyone by setting them to 01777 permissions.
However the test that determines whether the path shuld be public or not
is flawed and bleeds into pure file templates with undeiserable consequences.
Theis patch corrects thi behavior by clearly returning a specific path if it
need to be made public and preserves any subdir in the template with user
private ownership.
Resolves:
https://fedorahosted.org/sssd/ticket/2071
Diffstat (limited to 'src/tests/krb5_child-test.c')
| -rw-r--r-- | src/tests/krb5_child-test.c | 22 |
1 files changed, 10 insertions, 12 deletions
diff --git a/src/tests/krb5_child-test.c b/src/tests/krb5_child-test.c index 959b1bd6..5181f1b5 100644 --- a/src/tests/krb5_child-test.c +++ b/src/tests/krb5_child-test.c @@ -198,7 +198,7 @@ create_dummy_req(TALLOC_CTX *mem_ctx, const char *user, { struct krb5child_req *kr; struct passwd *pwd; - bool private = false; + char *pubdir = NULL; errno_t ret; /* The top level child request */ @@ -243,15 +243,13 @@ create_dummy_req(TALLOC_CTX *mem_ctx, const char *user, } if (!ccname) { - kr->ccname = expand_ccname_template(kr, kr, - dp_opt_get_cstring(kr->krb5_ctx->opts, - KRB5_CCNAME_TMPL), - true, true, &private); - if (!kr->ccname) goto fail; - - DEBUG(SSSDBG_FUNC_DATA, ("ccname [%s] uid [%llu] gid [%llu]\n", - kr->ccname, (unsigned long long) kr->uid, - (unsigned long long) kr->gid)); + ret = expand_ccname_template(kr, kr, tmpl, true, &pubdir, &kr->ccname); + if (ret) goto fail; + + DEBUG(SSSDBG_FUNC_DATA, + ("ccname [%s] pubdir [%s] uid [%llu] gid [%llu]\n", + kr->ccname, pubdir ? pubdir : "NULL", + (unsigned long long) kr->uid, (unsigned long long) kr->gid)); } else { kr->ccname = talloc_strdup(kr, ccname); } @@ -260,9 +258,9 @@ create_dummy_req(TALLOC_CTX *mem_ctx, const char *user, DEBUG(SSSDBG_FUNC_DATA, ("ccname [%s] uid [%u] gid [%u]\n", kr->ccname, kr->uid, kr->gid)); - ret = sss_krb5_precreate_ccache(kr->ccname, + ret = sss_krb5_precreate_ccache(kr->ccname, pubdir, kr->krb5_ctx->illegal_path_re, - kr->uid, kr->gid, private); + kr->uid, kr->gid); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, ("create_ccache_dir failed.\n")); goto fail; |