[PATCH] Open the PAC socket from krb5_child before dropping root

[Jakub Hrozek]

Hi,

the attached patch adds a public function that opens the PAC responder
socket. The krb5_child uses this call to open a fd towards PAC before
becoming user so that PAC responder is contacted for users from trusted
domains.

[Sumit Bose]

On Wed, Jan 21, 2015 at 09:51:29AM +0100, Jakub Hrozek wrote:
> Hi,
>
> the attached patch adds a public function that opens the PAC responder
> socket. The krb5_child uses this call to open a fd towards PAC before
> becoming user so that PAC responder is contacted for users from trusted
> domains.

Patch looks good and is working as expected. Since this patch is the fix
for #2559 I wonder if you want to revive the ticket and add a link to
the commit message?

bye,
Sumit

[Jakub Hrozek]

On Wed, Jan 21, 2015 at 10:09:11AM +0100, Sumit Bose wrote:
> On Wed, Jan 21, 2015 at 09:51:29AM +0100, Jakub Hrozek wrote:
> > Hi,
> >
> > the attached patch adds a public function that opens the PAC responder
> > socket. The krb5_child uses this call to open a fd towards PAC before
> > becoming user so that PAC responder is contacted for users from trusted
> > domains.
>
> Patch looks good and is working as expected. Since this patch is the fix
> for #2559 I wonder if you want to revive the ticket and add a link to
> the commit message?
>
> bye,
> Sumit

Sure, attached is a patch with a better commit message and a link to the
ticket. I moved the ticket to 1.12.4 as well without triage as I think
it's a side-task of #2560.

[Sumit Bose]

On Wed, Jan 21, 2015 at 11:07:25AM +0100, Jakub Hrozek wrote:
> On Wed, Jan 21, 2015 at 10:09:11AM +0100, Sumit Bose wrote:
> > On Wed, Jan 21, 2015 at 09:51:29AM +0100, Jakub Hrozek wrote:
> > > Hi,
> > >
> > > the attached patch adds a public function that opens the PAC responder
> > > socket. The krb5_child uses this call to open a fd towards PAC before
> > > becoming user so that PAC responder is contacted for users from trusted
> > > domains.
> >
> > Patch looks good and is working as expected. Since this patch is the fix
> > for #2559 I wonder if you want to revive the ticket and add a link to
> > the commit message?
> >
> > bye,
> > Sumit
>
> Sure, attached is a patch with a better commit message and a link to the
> ticket. I moved the ticket to 1.12.4 as well without triage as I think
> it's a side-task of #2560.

Thanks, ACK.

bye,
Sumit

[Jakub Hrozek]

On Wed, Jan 21, 2015 at 11:13:11AM +0100, Sumit Bose wrote:
> On Wed, Jan 21, 2015 at 11:07:25AM +0100, Jakub Hrozek wrote:
> > On Wed, Jan 21, 2015 at 10:09:11AM +0100, Sumit Bose wrote:
> > > On Wed, Jan 21, 2015 at 09:51:29AM +0100, Jakub Hrozek wrote:
> > > > Hi,
> > > >
> > > > the attached patch adds a public function that opens the PAC responder
> > > > socket. The krb5_child uses this call to open a fd towards PAC before
> > > > becoming user so that PAC responder is contacted for users from trusted
> > > > domains.
> > >
> > > Patch looks good and is working as expected. Since this patch is the fix
> > > for #2559 I wonder if you want to revive the ticket and add a link to
> > > the commit message?
> > >
> > > bye,
> > > Sumit
> >
> > Sure, attached is a patch with a better commit message and a link to the
> > ticket. I moved the ticket to 1.12.4 as well without triage as I think
> > it's a side-task of #2560.
>
> Thanks, ACK.

master: 858e750c3d4fe54e50616a1ed1e101469503c070
sssd-1-12: bfdd8d2b828d0decb3730879f328bcde95dc584b