Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IPA: don't bother checking keytab ownership #7847

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

IPA: don't bother checking keytab ownership #7847

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
644fc3a
IPA: fixed misleading messages
alexey-tikhonov Feb 24, 2025
5aad328
IPA: cosmetics
alexey-tikhonov Feb 24, 2025
49a5175
IPA: don't bother checking keytab ownership
alexey-tikhonov Feb 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions src/providers/ipa/ipa_subdomains.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,9 +145,6 @@ struct ipa_server_mode_ctx {

struct ipa_subdom_server_ctx *trusts;
struct ipa_ext_groups *ext_groups;

uid_t kt_owner_uid;
uid_t kt_owner_gid;
};

int ipa_trusted_subdom_init(struct be_ctx *be_ctx,
Expand Down
61 changes: 10 additions & 51 deletions src/providers/ipa/ipa_subdomains_server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -955,35 +955,15 @@ static errno_t ipa_getkeytab_recv(struct tevent_req *req, int *child_status)
return EOK;
}

static errno_t ipa_check_keytab(const char *keytab,
uid_t kt_owner_uid,
gid_t kt_owner_gid)
static errno_t ipa_check_keytab(const char *keytab)
{
errno_t ret;

ret = check_file(keytab, getuid(), getgid(), S_IFREG|0600, 0, NULL, false);
if (ret == ENOENT) {
DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
goto done;
} else if (ret != EOK) {
if (kt_owner_uid) {
ret = check_file(keytab, kt_owner_uid, kt_owner_gid,
S_IFREG|0600, 0, NULL, false);
}

if (ret != EOK) {
if (ret != ENOENT) {
DEBUG(SSSDBG_OP_FAILURE, "Failed to check for %s\n", keytab);
} else {
DEBUG(SSSDBG_TRACE_FUNC, "Keytab %s is not present\n", keytab);
}
}
goto done;
ret = check_file(keytab, -1, -1, S_IFREG|0600, 0, NULL, false);
if (ret != EOK) {
DEBUG(SSSDBG_TRACE_FUNC, "check_file(%s) failed: [%d]\n", keytab, ret);
}

DEBUG(SSSDBG_TRACE_ALL, "keytab %s already exists\n", keytab);
ret = EOK;
done:
return ret;
}

Expand Down Expand Up @@ -1156,9 +1136,7 @@ static void ipa_server_trust_1way_kt_done(struct tevent_req *subreq)
"Keytab successfully retrieved to %s\n", state->new_keytab);
}

ret = ipa_check_keytab(state->new_keytab,
state->id_ctx->server_mode->kt_owner_uid,
state->id_ctx->server_mode->kt_owner_gid);
ret = ipa_check_keytab(state->new_keytab);
if (ret == EOK) {
ret = rename(state->new_keytab, state->keytab);
if (ret == -1) {
Expand All @@ -1169,16 +1147,13 @@ static void ipa_server_trust_1way_kt_done(struct tevent_req *subreq)
return;
}
DEBUG(SSSDBG_TRACE_INTERNAL, "Keytab renamed to %s\n", state->keytab);
} else if (ret != EOK) {
} else {
DEBUG(SSSDBG_MINOR_FAILURE,
"Trying to recover and use the previous keytab, if available\n");
ret = ipa_check_keytab(state->keytab,
state->id_ctx->server_mode->kt_owner_uid,
state->id_ctx->server_mode->kt_owner_gid);
ret = ipa_check_keytab(state->keytab);
if (ret == EOK) {
DEBUG(SSSDBG_TRACE_FUNC,
"The previous keytab %s contains the expected principal\n",
state->keytab);
"Fell back to the previous keytab '%s'\n", state->keytab);
} else {
DEBUG(SSSDBG_OP_FAILURE,
"Cannot use the old keytab: %d\n", ret);
Expand All @@ -1189,10 +1164,8 @@ static void ipa_server_trust_1way_kt_done(struct tevent_req *subreq)
}

DEBUG(SSSDBG_TRACE_FUNC,
"Keytab %s contains the expected principals\n", state->new_keytab);

DEBUG(SSSDBG_TRACE_FUNC,
"Established trust context for %s\n", state->subdom->name);
"Established trust context for %s using keytab '%s'\n",
state->subdom->name, state->new_keytab);
tevent_req_done(req);
}

Expand Down Expand Up @@ -1560,20 +1533,6 @@ int ipa_trusted_subdom_init(struct be_ctx *be_ctx,
id_ctx->server_mode->hostname = hostname;
id_ctx->server_mode->trusts = NULL;
id_ctx->server_mode->ext_groups = NULL;
id_ctx->server_mode->kt_owner_uid = 0;
id_ctx->server_mode->kt_owner_gid = 0;

if (getuid() == 0) {
/* We need to handle keytabs created by IPA oddjob script gracefully
* even if we're running as root and IPA creates them as the SSSD user
*/
ret = sss_user_by_name_or_uid(SSSD_USER,
&id_ctx->server_mode->kt_owner_uid,
&id_ctx->server_mode->kt_owner_gid);
if (ret != EOK) {
DEBUG(SSSDBG_MINOR_FAILURE, "Failed to get ID of %s\n", SSSD_USER);
}
}

ret = ipa_trusted_subdom_reinit(be_ctx, be_ctx->ev,
be_ctx, id_ctx, be_ctx->domain);
Expand Down
Loading