[freeipa PR#5328][opened] Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches

[abbra]

   URL: https://github.com/freeipa/freeipa/pull/5328
Author: abbra
 Title: #5328: Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches
Action: opened

PR body:
"""
With commit c6644b8566f747fa80e2c1925b79bad9f8c92bd7 we default to
create unique credential caches in /run/ipa/ccaches for every client
that connects to IPA with a new session. On F34, mod_auth_gssapi process
running as 'apache' cannot create the ccache in /run/ipa/ccaches because
it has no access rights.

The core of the problem is that we have two different paths to obtaining
a ccache: one where 'apache' running httpd process creates it directly
and one where an internal redirect from 'ipaapi' running httpd process
is happening.

Since /run/ipa/ccaches is a temporary directory created in /run which is
mounted as tmpfs, POSIX ACLs can be used to add 'apache' group
permission to create the ccaches.

When '/run/ipa/ccaches' has SGID bit, created files inside it would
automatically get 'ipaapi' group assigned. So all we need is to mark the
directory as 02770 (SGID bit).

Fixes: https://pagure.io/freeipa/issue/8613

Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com&gt;
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5328/head:pr5328
git checkout pr5328

[freeipa PR#5328][closed] Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches

[abbra]

   URL: https://github.com/freeipa/freeipa/pull/5328
Author: abbra
 Title: #5328: Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5328/head:pr5328
git checkout pr5328