From: Jim Rees <rees@umich.edu>
To: Orion Poplawski <orion@cora.nwra.com>
Cc: "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Subject: Re: Any way to allow setuid daemon to access krb5 automounted nfs directories?
Date: Tue, 25 Sep 2012 13:50:25 -0400 [thread overview]
Message-ID: <20120925175025.GA8020@umich.edu> (raw)
In-Reply-To: <5061DF69.8030606@cora.nwra.com>
Orion Poplawski wrote:
Is there any way to allow setuid daemon to access krb5 automounted
nfs directories? Specifically I'm looking to run spamassassin's
spamd on a remote server and access user's home directories via krb5
nfs4. spamd changes user to the user receiving the email being
processes and needs to modify files in the user's home directory.
Is there any reasonably secure way to give this daemon the ability
to do this? Any way to tell rpc.gssd to use a specific credential
cache for this type of access rather than the default for that
effective uid?
You don't want to give spamd the user's credentials. You want to acl the
user's files so that spamd can do what it wants. Spamd will need its own
krb5 principal.
But I hope you're not planning to deliver mail over nfs. I think that would
be a mistake.
next prev parent reply other threads:[~2012-09-25 17:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-25 16:44 Any way to allow setuid daemon to access krb5 automounted nfs directories? Orion Poplawski
2012-09-25 17:50 ` Jim Rees [this message]
2012-09-25 20:11 ` Orion Poplawski
2012-09-25 20:52 ` Myklebust, Trond
2012-09-26 11:45 ` Jim Rees
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120925175025.GA8020@umich.edu \
--to=rees@umich.edu \
--cc=linux-nfs@vger.kernel.org \
--cc=orion@cora.nwra.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).