Wed Oct 24 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-8
New upstream release 0.3.0: * Add support for impersonation (depends on s4u2self/s4u2proxy on the KDC) * Add support for new rpc.gssd mode of operation that forks and changes uid * Add 2 new options allow_any_uid and cred_usage
This commit is contained in:
Günther Deschner
parent
736164870b
commit
80253e6762
@ -1,79 +0,0 @@
|
|||||||
From b73a9a18cb2df0b39c30d3e03c66d2f24ec3f57d Mon Sep 17 00:00:00 2001
|
|
||||||
From: Simo Sorce <simo@redhat.com>
|
|
||||||
Date: Tue, 15 Oct 2013 15:45:59 -0400
|
|
||||||
Subject: [PATCH 1/2] Fix LOCAL_FIRST behavior
|
|
||||||
|
|
||||||
We were erroneously returning and never falling back if LOCAL_FIRST was
|
|
||||||
selected. Correct also the remote first fallback flow.
|
|
||||||
|
|
||||||
Resolves: https://fedorahosted.org/gss-proxy/ticket/105
|
|
||||||
---
|
|
||||||
proxy/src/mechglue/gpp_acquire_cred.c | 39 +++++++++++++++++------------------
|
|
||||||
1 file changed, 19 insertions(+), 20 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/proxy/src/mechglue/gpp_acquire_cred.c b/proxy/src/mechglue/gpp_acquire_cred.c
|
|
||||||
index a3290dd72ae2d97eaa05f250a4d2dd96824abebf..fb80677eed4680470e21b820633e87b94f36d6cc 100644
|
|
||||||
--- a/proxy/src/mechglue/gpp_acquire_cred.c
|
|
||||||
+++ b/proxy/src/mechglue/gpp_acquire_cred.c
|
|
||||||
@@ -109,7 +109,7 @@ OM_uint32 gssi_acquire_cred(OM_uint32 *minor_status,
|
|
||||||
maj = acquire_local(&min, name, time_req, desired_mechs, cred_usage,
|
|
||||||
out_cred_handle, actual_mechs, time_rec);
|
|
||||||
|
|
||||||
- if (maj != GSS_S_NO_CRED || behavior != GPP_LOCAL_FIRST) {
|
|
||||||
+ if (maj == GSS_S_COMPLETE || behavior == GPP_LOCAL_ONLY) {
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -119,31 +119,30 @@ OM_uint32 gssi_acquire_cred(OM_uint32 *minor_status,
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Then try with remote */
|
|
||||||
- if (behavior == GPP_REMOTE_ONLY || behavior == GPP_REMOTE_FIRST) {
|
|
||||||
-
|
|
||||||
- if (name && name->local && !name->remote) {
|
|
||||||
- maj = gpp_local_to_name(&min, name->local, &name->remote);
|
|
||||||
- if (maj) {
|
|
||||||
- goto done;
|
|
||||||
- }
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- maj = gpm_acquire_cred(&min,
|
|
||||||
- name ? name->remote : NULL,
|
|
||||||
- time_req,
|
|
||||||
- desired_mechs,
|
|
||||||
- cred_usage,
|
|
||||||
- &out_cred_handle->remote,
|
|
||||||
- actual_mechs,
|
|
||||||
- time_rec);
|
|
||||||
- if (maj == GSS_S_COMPLETE || behavior == GPP_REMOTE_ONLY) {
|
|
||||||
+ if (name && name->local && !name->remote) {
|
|
||||||
+ maj = gpp_local_to_name(&min, name->local, &name->remote);
|
|
||||||
+ if (maj) {
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
+ }
|
|
||||||
|
|
||||||
+ maj = gpm_acquire_cred(&min,
|
|
||||||
+ name ? name->remote : NULL,
|
|
||||||
+ time_req,
|
|
||||||
+ desired_mechs,
|
|
||||||
+ cred_usage,
|
|
||||||
+ &out_cred_handle->remote,
|
|
||||||
+ actual_mechs,
|
|
||||||
+ time_rec);
|
|
||||||
+ if (maj == GSS_S_COMPLETE || behavior == GPP_REMOTE_ONLY) {
|
|
||||||
+ goto done;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (behavior == GPP_REMOTE_FIRST) {
|
|
||||||
/* So remote failed, but we can fallback to local, try that */
|
|
||||||
maj = acquire_local(&min, name, time_req, desired_mechs, cred_usage,
|
|
||||||
out_cred_handle, actual_mechs, time_rec);
|
|
||||||
- }
|
|
||||||
+ }
|
|
||||||
|
|
||||||
done:
|
|
||||||
if (maj != GSS_S_COMPLETE &&
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,39 +0,0 @@
|
|||||||
From 788132ea70522663efab652d8653e1eaa8819822 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Simo Sorce <simo@redhat.com>
|
|
||||||
Date: Tue, 15 Oct 2013 15:48:04 -0400
|
|
||||||
Subject: [PATCH 2/2] Fix documentation to match reality
|
|
||||||
|
|
||||||
LOCAL_FIRST is our default
|
|
||||||
---
|
|
||||||
proxy/man/gssproxy-mech.8.xml | 8 ++++----
|
|
||||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/proxy/man/gssproxy-mech.8.xml b/proxy/man/gssproxy-mech.8.xml
|
|
||||||
index b2d008cc8990c214027d2104bf72da776faf1b82..2249ced68af410d9f444ca479df1827712898354 100644
|
|
||||||
--- a/proxy/man/gssproxy-mech.8.xml
|
|
||||||
+++ b/proxy/man/gssproxy-mech.8.xml
|
|
||||||
@@ -74,10 +74,7 @@
|
|
||||||
<para>All commands received with this setting will cause
|
|
||||||
to immediately reenter the GSSAPI w/o any interaction
|
|
||||||
with the gssproxy daemon. When the request cannot be
|
|
||||||
- processed it will just fail. This is the default
|
|
||||||
- behavior when the
|
|
||||||
- <emphasis>GSSPROXY_BEHAVIOR</emphasis> environment
|
|
||||||
- variable is not set at all.
|
|
||||||
+ processed it will just fail.
|
|
||||||
</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
@@ -88,6 +85,9 @@
|
|
||||||
to immediately reenter the GSSAPI. When the local
|
|
||||||
GSSAPI cannot process the request, it will resend the
|
|
||||||
request to the gssproxy daemon.
|
|
||||||
+ This is the default behavior when the
|
|
||||||
+ <emphasis>GSSPROXY_BEHAVIOR</emphasis> environment
|
|
||||||
+ variable is not set.
|
|
||||||
</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,51 +0,0 @@
|
|||||||
From 7201cabaf0c59b2f50c1a86a47465daaafff6cb4 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Simo Sorce <simo@redhat.com>
|
|
||||||
Date: Wed, 19 Jun 2013 11:41:29 -0400
|
|
||||||
Subject: [PATCH] Split nfs server and client services
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
The NFS server uses a special socket for the kernel communication.
|
|
||||||
Split configuration in 2 distinct services so we can use specific options that
|
|
||||||
may be different between server and client.
|
|
||||||
|
|
||||||
The 3 main differences so far are:
|
|
||||||
1. socket: default for client, custom for server
|
|
||||||
2. kernel_nfd option only for server
|
|
||||||
3. ccache and client keytab options only for client
|
|
||||||
|
|
||||||
Signed-off-by: Simo Sorce <simo@redhat.com>
|
|
||||||
Reviewed-by: Günther Deschner <gdeschner@redhat.com>
|
|
||||||
---
|
|
||||||
proxy/examples/gssproxy.conf.in | 11 ++++++++---
|
|
||||||
1 file changed, 8 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/proxy/examples/gssproxy.conf.in b/proxy/examples/gssproxy.conf.in
|
|
||||||
index b30d39a..0f8339e 100644
|
|
||||||
--- a/proxy/examples/gssproxy.conf.in
|
|
||||||
+++ b/proxy/examples/gssproxy.conf.in
|
|
||||||
@@ -1,12 +1,17 @@
|
|
||||||
[gssproxy]
|
|
||||||
|
|
||||||
-[service/nfs]
|
|
||||||
+[service/nfs-server]
|
|
||||||
mechs = krb5
|
|
||||||
socket = /run/gssproxy.sock
|
|
||||||
cred_store = keytab:/etc/krb5.keytab
|
|
||||||
- cred_store = ccache:FILE:@gpstatedir@/clients/krb5cc_%U
|
|
||||||
- cred_store = client_keytab:@gpstatedir@/clients/%U.keytab
|
|
||||||
trusted = yes
|
|
||||||
kernel_nfsd = yes
|
|
||||||
euid = 0
|
|
||||||
|
|
||||||
+[service/nfs-client]
|
|
||||||
+ mechs = krb5
|
|
||||||
+ cred_store = keytab:/etc/krb5.keytab
|
|
||||||
+ cred_store = ccache:FILE:@gpstatedir@/clients/krb5cc_%U
|
|
||||||
+ cred_store = client_keytab:@gpstatedir@/clients/%U.keytab
|
|
||||||
+ trusted = yes
|
|
||||||
+ euid = 0
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,5 +1,5 @@
|
|||||||
Name: gssproxy
|
Name: gssproxy
|
||||||
Version: 0.2.3
|
Version: 0.3.0
|
||||||
Release: 8%{?dist}
|
Release: 8%{?dist}
|
||||||
Summary: GSSAPI Proxy
|
Summary: GSSAPI Proxy
|
||||||
|
|
||||||
@ -8,9 +8,6 @@ License: MIT
|
|||||||
URL: http://fedorahosted.org/gss-proxy
|
URL: http://fedorahosted.org/gss-proxy
|
||||||
Source0: http://fedorahosted.org/released/gss-proxy/%{name}-%{version}.tar.gz
|
Source0: http://fedorahosted.org/released/gss-proxy/%{name}-%{version}.tar.gz
|
||||||
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
|
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
|
||||||
Patch0: gssproxy-conf.patch
|
|
||||||
Patch1: 0001-Fix-LOCAL_FIRST-behavior.patch
|
|
||||||
Patch2: 0002-Fix-documentation-to-match-reality.patch
|
|
||||||
|
|
||||||
%global servicename gssproxy
|
%global servicename gssproxy
|
||||||
%global pubconfpath %{_sysconfdir}/gssproxy
|
%global pubconfpath %{_sysconfdir}/gssproxy
|
||||||
@ -20,7 +17,7 @@ Patch2: 0002-Fix-documentation-to-match-reality.patch
|
|||||||
|
|
||||||
### Dependencies ###
|
### Dependencies ###
|
||||||
|
|
||||||
Requires: krb5-libs >= 1.11.2
|
Requires: krb5-libs >= 1.11.3-25
|
||||||
Requires: keyutils-libs
|
Requires: keyutils-libs
|
||||||
Requires: libverto-tevent
|
Requires: libverto-tevent
|
||||||
Requires(post): systemd-units
|
Requires(post): systemd-units
|
||||||
@ -39,7 +36,7 @@ BuildRequires: docbook-style-xsl
|
|||||||
BuildRequires: doxygen
|
BuildRequires: doxygen
|
||||||
BuildRequires: gettext-devel
|
BuildRequires: gettext-devel
|
||||||
BuildRequires: pkgconfig
|
BuildRequires: pkgconfig
|
||||||
BuildRequires: krb5-devel >= 1.11.2
|
BuildRequires: krb5-devel >= 1.11.3-25
|
||||||
BuildRequires: libselinux-devel
|
BuildRequires: libselinux-devel
|
||||||
BuildRequires: keyutils-libs-devel
|
BuildRequires: keyutils-libs-devel
|
||||||
BuildRequires: libini_config-devel >= 1.0.0.1
|
BuildRequires: libini_config-devel >= 1.0.0.1
|
||||||
@ -55,10 +52,6 @@ A proxy for GSSAPI credential handling
|
|||||||
%prep
|
%prep
|
||||||
%setup -q
|
%setup -q
|
||||||
|
|
||||||
%patch0 -p2 -b .gssproxy_conf
|
|
||||||
%patch1 -p2 -b .gpp_default_behavior
|
|
||||||
%patch2 -p2 -b .gpp_default_behavior_doc
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
autoreconf -f -i
|
autoreconf -f -i
|
||||||
%configure \
|
%configure \
|
||||||
@ -110,6 +103,12 @@ rm -rf %{buildroot}
|
|||||||
%systemd_postun_with_restart gssproxy.service
|
%systemd_postun_with_restart gssproxy.service
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Oct 24 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-8
|
||||||
|
- New upstream release 0.3.0:
|
||||||
|
* Add support for impersonation (depends on s4u2self/s4u2proxy on the KDC)
|
||||||
|
* Add support for new rpc.gssd mode of operation that forks and changes uid
|
||||||
|
* Add 2 new options allow_any_uid and cred_usage
|
||||||
|
|
||||||
* Fri Oct 18 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.3-8
|
* Fri Oct 18 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.3-8
|
||||||
- Fix default proxymech documentation and fix LOCAL_FIRST implementation
|
- Fix default proxymech documentation and fix LOCAL_FIRST implementation
|
||||||
- resolves: https://fedorahosted.org/gss-proxy/ticket/105
|
- resolves: https://fedorahosted.org/gss-proxy/ticket/105
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user