* [PATCH 2/2] Use /run/user/${UID} instead of /run/user/${USER}
@ 2012-08-21 20:52 Nalin Dahyabhai
2012-08-23 16:35 ` Steve Dickson
0 siblings, 1 reply; 2+ messages in thread
From: Nalin Dahyabhai @ 2012-08-21 20:52 UTC (permalink / raw)
To: linux-nfs
Newer versions of systemd create a /run/user/${UID} directory
instead of the /run/user/${USER} directory, so switch to
scanning for that. To make the per-user directory bit a little
less magical, change the default to incorporate a "%U", which
gets dynamically expanded to the user's UID when needed.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
---
utils/gssd/gssd.h | 2 +-
utils/gssd/gssd.man | 9 ++++++---
utils/gssd/gssd_proc.c | 36 ++----------------------------------
utils/gssd/krb5_util.c | 30 ++++++++++++++++++++++++++----
4 files changed, 35 insertions(+), 42 deletions(-)
diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h
index 1d923d7..86472a1 100644
--- a/utils/gssd/gssd.h
+++ b/utils/gssd/gssd.h
@@ -45,7 +45,7 @@
#define DNOTIFY_SIGNAL (SIGRTMIN + 3)
#define GSSD_DEFAULT_CRED_DIR "/tmp"
-#define GSSD_USER_CRED_DIR "/run/user"
+#define GSSD_USER_CRED_DIR "/run/user/%U"
#define GSSD_DEFAULT_CRED_PREFIX "krb5cc"
#define GSSD_DEFAULT_MACHINE_CRED_SUFFIX "machine"
#define GSSD_DEFAULT_KEYTAB_FILE "/etc/krb5.keytab"
diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man
index d8138fa..c74b7e8 100644
--- a/utils/gssd/gssd.man
+++ b/utils/gssd/gssd.man
@@ -103,9 +103,12 @@ where to look for the rpc_pipefs filesystem. The default value is
.B -d directory
Tells
.B rpc.gssd
-where to look for Kerberos credential files. The default value is "/tmp".
-This can also be a colon separated list of directories to be searched
-for Kerberos credential files. Note that if machine credentials are being
+where to look for Kerberos credential files. The default value is
+"/tmp:/run/user/%U".
+This can also be a colon separated list of directories to be searched for
+Kerberos credential files. The sequence "%U", if used, is replaced with
+the UID of the user for whom credentials are being searched.
+Note that if machine credentials are being
stored in files, then the first directory on this list is where the
machine credentials are stored.
.TP
diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
index e393d59..336f3e9 100644
--- a/utils/gssd/gssd_proc.c
+++ b/utils/gssd/gssd_proc.c
@@ -937,23 +937,6 @@ int create_auth_rpc_client(struct clnt_info *clp,
goto out;
}
-static char *
-user_cachedir(char *dirname, uid_t uid)
-{
- struct passwd *pw;
- char *ptr;
-
- if ((pw = getpwuid(uid)) == NULL) {
- printerr(0, "user_cachedir: Failed to find '%d' uid"
- " for cache directory\n");
- return NULL;
- }
- ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2);
- if (ptr)
- sprintf(ptr, "%s/%s", dirname, pw->pw_name);
-
- return ptr;
-}
/*
* this code uses the userland rpcsec gss library to create a krb5
* context on behalf of the kernel
@@ -968,7 +951,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
gss_buffer_desc token;
char **credlist = NULL;
char **ccname;
- char **dirname, *dir, *userdir;
+ char **dirname;
int create_resp = -1;
int err, downcall_err = -EACCES;
@@ -1011,22 +994,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
service == NULL)) {
/* Tell krb5 gss which credentials cache to use */
for (dirname = ccachesearch; *dirname != NULL; dirname++) {
- /* See if the user name is needed */
- if (strncmp(*dirname, GSSD_USER_CRED_DIR,
- strlen(GSSD_USER_CRED_DIR)) == 0) {
- userdir = user_cachedir(*dirname, uid);
- if (userdir == NULL)
- continue;
- dir = userdir;
- } else
- dir = *dirname;
-
- err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir);
-
- if (userdir) {
- free(userdir);
- userdir = NULL;
- }
+ err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
if (err == -EKEYEXPIRED)
downcall_err = -EKEYEXPIRED;
else if (!err)
diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 2389276..60ba594 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -1036,16 +1036,38 @@ err_cache:
* Returns 0 if a ccache was found, and a non-zero error code otherwise.
*/
int
-gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirname)
+gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern)
{
- char buf[MAX_NETOBJ_SZ];
+ char buf[MAX_NETOBJ_SZ], dirname[PATH_MAX];
const char *cctype;
struct dirent *d;
- int err;
+ int err, i, j;
printerr(2, "getting credentials for client with uid %u for "
"server %s\n", uid, servername);
- memset(buf, 0, sizeof(buf));
+
+ for (i = 0, j = 0; dirpattern[i] != '\0'; i++) {
+ switch (dirpattern[i]) {
+ case '%':
+ switch (dirpattern[i + 1]) {
+ case '%':
+ dirname[j++] = dirpattern[i];
+ i++;
+ break;
+ case 'U':
+ j += sprintf(dirname + j, "%lu",
+ (unsigned long) uid);
+ i++;
+ break;
+ }
+ break;
+ default:
+ dirname[j++] = dirpattern[i];
+ break;
+ }
+ }
+ dirname[j] = '\0';
+
err = gssd_find_existing_krb5_ccache(uid, dirname, &cctype, &d);
if (err)
return err;
--
1.7.11.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 2/2] Use /run/user/${UID} instead of /run/user/${USER}
2012-08-21 20:52 [PATCH 2/2] Use /run/user/${UID} instead of /run/user/${USER} Nalin Dahyabhai
@ 2012-08-23 16:35 ` Steve Dickson
0 siblings, 0 replies; 2+ messages in thread
From: Steve Dickson @ 2012-08-23 16:35 UTC (permalink / raw)
To: Nalin Dahyabhai; +Cc: linux-nfs
On 08/21/2012 04:52 PM, Nalin Dahyabhai wrote:
> Newer versions of systemd create a /run/user/${UID} directory
> instead of the /run/user/${USER} directory, so switch to
> scanning for that. To make the per-user directory bit a little
> less magical, change the default to incorporate a "%U", which
> gets dynamically expanded to the user's UID when needed.
>
> Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Committed...
steved.
> ---
> utils/gssd/gssd.h | 2 +-
> utils/gssd/gssd.man | 9 ++++++---
> utils/gssd/gssd_proc.c | 36 ++----------------------------------
> utils/gssd/krb5_util.c | 30 ++++++++++++++++++++++++++----
> 4 files changed, 35 insertions(+), 42 deletions(-)
>
> diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h
> index 1d923d7..86472a1 100644
> --- a/utils/gssd/gssd.h
> +++ b/utils/gssd/gssd.h
> @@ -45,7 +45,7 @@
> #define DNOTIFY_SIGNAL (SIGRTMIN + 3)
>
> #define GSSD_DEFAULT_CRED_DIR "/tmp"
> -#define GSSD_USER_CRED_DIR "/run/user"
> +#define GSSD_USER_CRED_DIR "/run/user/%U"
> #define GSSD_DEFAULT_CRED_PREFIX "krb5cc"
> #define GSSD_DEFAULT_MACHINE_CRED_SUFFIX "machine"
> #define GSSD_DEFAULT_KEYTAB_FILE "/etc/krb5.keytab"
> diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man
> index d8138fa..c74b7e8 100644
> --- a/utils/gssd/gssd.man
> +++ b/utils/gssd/gssd.man
> @@ -103,9 +103,12 @@ where to look for the rpc_pipefs filesystem. The default value is
> .B -d directory
> Tells
> .B rpc.gssd
> -where to look for Kerberos credential files. The default value is "/tmp".
> -This can also be a colon separated list of directories to be searched
> -for Kerberos credential files. Note that if machine credentials are being
> +where to look for Kerberos credential files. The default value is
> +"/tmp:/run/user/%U".
> +This can also be a colon separated list of directories to be searched for
> +Kerberos credential files. The sequence "%U", if used, is replaced with
> +the UID of the user for whom credentials are being searched.
> +Note that if machine credentials are being
> stored in files, then the first directory on this list is where the
> machine credentials are stored.
> .TP
> diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
> index e393d59..336f3e9 100644
> --- a/utils/gssd/gssd_proc.c
> +++ b/utils/gssd/gssd_proc.c
> @@ -937,23 +937,6 @@ int create_auth_rpc_client(struct clnt_info *clp,
> goto out;
> }
>
> -static char *
> -user_cachedir(char *dirname, uid_t uid)
> -{
> - struct passwd *pw;
> - char *ptr;
> -
> - if ((pw = getpwuid(uid)) == NULL) {
> - printerr(0, "user_cachedir: Failed to find '%d' uid"
> - " for cache directory\n");
> - return NULL;
> - }
> - ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2);
> - if (ptr)
> - sprintf(ptr, "%s/%s", dirname, pw->pw_name);
> -
> - return ptr;
> -}
> /*
> * this code uses the userland rpcsec gss library to create a krb5
> * context on behalf of the kernel
> @@ -968,7 +951,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
> gss_buffer_desc token;
> char **credlist = NULL;
> char **ccname;
> - char **dirname, *dir, *userdir;
> + char **dirname;
> int create_resp = -1;
> int err, downcall_err = -EACCES;
>
> @@ -1011,22 +994,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
> service == NULL)) {
> /* Tell krb5 gss which credentials cache to use */
> for (dirname = ccachesearch; *dirname != NULL; dirname++) {
> - /* See if the user name is needed */
> - if (strncmp(*dirname, GSSD_USER_CRED_DIR,
> - strlen(GSSD_USER_CRED_DIR)) == 0) {
> - userdir = user_cachedir(*dirname, uid);
> - if (userdir == NULL)
> - continue;
> - dir = userdir;
> - } else
> - dir = *dirname;
> -
> - err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir);
> -
> - if (userdir) {
> - free(userdir);
> - userdir = NULL;
> - }
> + err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
> if (err == -EKEYEXPIRED)
> downcall_err = -EKEYEXPIRED;
> else if (!err)
> diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
> index 2389276..60ba594 100644
> --- a/utils/gssd/krb5_util.c
> +++ b/utils/gssd/krb5_util.c
> @@ -1036,16 +1036,38 @@ err_cache:
> * Returns 0 if a ccache was found, and a non-zero error code otherwise.
> */
> int
> -gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirname)
> +gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern)
> {
> - char buf[MAX_NETOBJ_SZ];
> + char buf[MAX_NETOBJ_SZ], dirname[PATH_MAX];
> const char *cctype;
> struct dirent *d;
> - int err;
> + int err, i, j;
>
> printerr(2, "getting credentials for client with uid %u for "
> "server %s\n", uid, servername);
> - memset(buf, 0, sizeof(buf));
> +
> + for (i = 0, j = 0; dirpattern[i] != '\0'; i++) {
> + switch (dirpattern[i]) {
> + case '%':
> + switch (dirpattern[i + 1]) {
> + case '%':
> + dirname[j++] = dirpattern[i];
> + i++;
> + break;
> + case 'U':
> + j += sprintf(dirname + j, "%lu",
> + (unsigned long) uid);
> + i++;
> + break;
> + }
> + break;
> + default:
> + dirname[j++] = dirpattern[i];
> + break;
> + }
> + }
> + dirname[j] = '\0';
> +
> err = gssd_find_existing_krb5_ccache(uid, dirname, &cctype, &d);
> if (err)
> return err;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-08-23 16:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-21 20:52 [PATCH 2/2] Use /run/user/${UID} instead of /run/user/${USER} Nalin Dahyabhai
2012-08-23 16:35 ` Steve Dickson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).