[PATCH] Add better checks on PAM socket

[Sumit Bose]

Hi,

this patch adds a check the public PAM socket it a socket that belongs
to root for all plattforms and uses a SCM_CREDENTIALS ancillary
message to identify the uid/gid/pid of the peer if these messages are
available.

bye,
Sumit

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/08/2010 08:55 AM, Sumit Bose wrote:
> Hi,
>
> this patch adds a check the public PAM socket it a socket that belongs
> to root for all plattforms and uses a SCM_CREDENTIALS ancillary
> message to identify the uid/gid/pid of the peer if these messages are
> available.

Ack.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkuXsuMACgkQeiVVYja6o6PBZwCdHovtOB1LN8cZdBfV4OjSDe0t
> dXEAnjAX7dP1gT3OZyp3ZgiTNKz+gYaw
> =0Fd4
> -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/10/2010 09:55 AM, Stephen Gallagher wrote:
> On 03/08/2010 08:55 AM, Sumit Bose wrote:
> > Hi,
> > this patch adds a check the public PAM socket it a socket that belongs
> > to root for all plattforms and uses a SCM_CREDENTIALS ancillary
> > message to identify the uid/gid/pid of the peer if these messages are
> > available.
>
> Ack.

Pushed to master and 1-1-0

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkuY+QMACgkQeiVVYja6o6N7qwCgkhzPj+aCXNXlla24c2zsDz/q
> 7/EAnjhAUw7YaNuAWDl2CUlYgxSeZK6x
> =aewB
> -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/11/2010 09:06 AM, Stephen Gallagher wrote:
> On 03/10/2010 09:55 AM, Stephen Gallagher wrote:
> > On 03/08/2010 08:55 AM, Sumit Bose wrote:
> > > Hi,
> > > this patch adds a check the public PAM socket it a socket that belongs
> > > to root for all plattforms and uses a SCM_CREDENTIALS ancillary
> > > message to identify the uid/gid/pid of the peer if these messages are
> > > available.
> > Ack.
>
> Pushed to master and 1-1-0

I have reverted this change from the 1-1-0 branch. It is causing some
instability on platforms such as ARM.

This patch remains applied in the master branch.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkueT1sACgkQeiVVYja6o6PvtACgraZAkevhJ1Zn2/W0g7lMNCal
> gLkAnA0PkqUnqRaSZDMDoEA3aWk5oXfe
> =CIBb
> -----END PGP SIGNATURE-----

[George McCollister]

I think char buf[CMSG_SPACE(sizeof(struct ucred))]; on
src/sss_client/common.c:66 needs to be aligned. I'll look at it more on
Monday.

George McCollister

On 03/08/2010 07:55 AM, Sumit Bose wrote:
> Hi,
>
> this patch adds a check the public PAM socket it a socket that belongs
> to root for all plattforms and uses a SCM_CREDENTIALS ancillary
> message to identify the uid/gid/pid of the peer if these messages are
> available.
>
> bye,
> Sumit
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Sumit Bose]

On Fri, Mar 12, 2010 at 04:50:19PM -0600, George McCollister wrote:
> I think char buf[CMSG_SPACE(sizeof(struct ucred))]; on
> src/sss_client/common.c:66 needs to be aligned. I'll look at it more on
> Monday.

While trying to find out where the alignment might go wrong I realized
that there might be a much simpler way to get the creds of the peer.
Please wait for a new patch.

bye,
Sumit
> George McCollister
>
> On 03/08/2010 07:55 AM, Sumit Bose wrote:
> > Hi,
> >
> > this patch adds a check the public PAM socket it a socket that belongs
> > to root for all plattforms and uses a SCM_CREDENTIALS ancillary
> > message to identify the uid/gid/pid of the peer if these messages are
> > available.
> >
> > bye,
> > Sumit
> >
> > sssd-devel mailing list
> > [e-mail]
> > https://fedorahosted.org/mailman/listinfo/sssd-devel
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel