[PATCH] Use SO_PEERCRED on the PAM socket

[Sumit Bose]

Hi,

please find attached my second attempt to exchange uid, gid and pid
between PAM client and responder. This new apporoach does not require
any communication between the client and the responder and should behave
much better than the previous one based on SO_PASSCRED and
SCM_CREDENTIALS.

To make the review easier the first patch reverts the previous attempt.

bye,
Sumit

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/29/2010 05:23 AM, Sumit Bose wrote:
> Hi,
>
> please find attached my second attempt to exchange uid, gid and pid
> between PAM client and responder. This new apporoach does not require
> any communication between the client and the responder and should behave
> much better than the previous one based on SO_PASSCRED and
> SCM_CREDENTIALS.
>
> To make the review easier the first patch reverts the previous attempt.
>
> bye,
> Sumit

Nack. Please make the strings in ssscli_err2string() translatable.
strerror() is already internationalized, we should be consistent. (Also,
we may eventually use these in places other than logger())

Otherwise, this looks great (and much less intrusive than the first
attempt).

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkuzorYACgkQeiVVYja6o6O7hwCfYgyIzEYx7HrSOudn6KXEGT4I
> sMYAn2UKunxU2JGP8w3PBJAhxX7gaL+J
> =4PZ7
> -----END PGP SIGNATURE-----

[Simo Sorce]

On Wed, 31 Mar 2010 15:29:58 -0400
Stephen Gallagher  wrote:
> Nack. Please make the strings in ssscli_err2string() translatable.
> strerror() is already internationalized, we should be consistent.
> (Also, we may eventually use these in places other than logger())
>
> Otherwise, this looks great (and much less intrusive than the first
> attempt).

I thought we said we would translate only log messages not debug
messages, what am I missing ?

Simo.

[Stephen Gallagher]

This goes to syslog, not debug logs.

On Mar 31, 2010, at 4:38 PM, Simo Sorce  wrote:
> On Wed, 31 Mar 2010 15:29:58 -0400
> Stephen Gallagher  wrote:
> > Nack. Please make the strings in ssscli_err2string() translatable.
> > strerror() is already internationalized, we should be consistent.
> > (Also, we may eventually use these in places other than logger())
> >
> > Otherwise, this looks great (and much less intrusive than the first
> > attempt).
>
> I thought we said we would translate only log messages not debug
> messages, what am I missing ?
>
> Simo.
>
> --
> Simo Sorce * Red Hat, Inc * New York
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Sumit Bose]

On Wed, Mar 31, 2010 at 03:29:58PM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 03/29/2010 05:23 AM, Sumit Bose wrote:
> > Hi,
> >
> > please find attached my second attempt to exchange uid, gid and pid
> > between PAM client and responder. This new apporoach does not require
> > any communication between the client and the responder and should behave
> > much better than the previous one based on SO_PASSCRED and
> > SCM_CREDENTIALS.
> >
> > To make the review easier the first patch reverts the previous attempt.
> >
> > bye,
> > Sumit
>
> Nack. Please make the strings in ssscli_err2string() translatable.
> strerror() is already internationalized, we should be consistent. (Also,
> we may eventually use these in places other than logger())
>
> Otherwise, this looks great (and much less intrusive than the first
> attempt).

New version attached.

bye,
Sumit
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkuzorYACgkQeiVVYja6o6O7hwCfYgyIzEYx7HrSOudn6KXEGT4I
> sMYAn2UKunxU2JGP8w3PBJAhxX7gaL+J
> =4PZ7
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On 04/15/2010 07:49 AM, Sumit Bose wrote:
> New version attached.
>
> bye,
> Sumit

Nack.

Warnings seen while compiling on Fedora 13:

../../src/responder/common/responder_common.c: In function 
‘get_client_cred’:
../../src/responder/common/responder_common.c:80: warning: passing 
argument 5 of ‘getsockopt’ from incompatible pointer type
/usr/include/sys/socket.h:190: note: expected ‘socklen_t * __restrict__’ 
but argument is of type ‘size_t *’
../../src/sss_client/common.c: In function ‘check_server_cred’:
../../src/sss_client/common.c:650: warning: passing argument 5 of 
‘getsockopt’ from incompatible pointer type
/usr/include/sys/socket.h:190: note: expected ‘socklen_t * __restrict__’ 
but argument is of type ‘size_t *’

[Sumit Bose]

On Thu, Apr 15, 2010 at 08:24:59AM -0400, Stephen Gallagher wrote:
> On 04/15/2010 07:49 AM, Sumit Bose wrote:
> > New version attached.
> >
> > bye,
> > Sumit
>
> Nack.
>
> Warnings seen while compiling on Fedora 13:
>
> ../../src/responder/common/responder_common.c: In function 
> ‘get_client_cred’:
> ../../src/responder/common/responder_common.c:80: warning: passing 
> argument 5 of ‘getsockopt’ from incompatible pointer type
> /usr/include/sys/socket.h:190: note: expected ‘socklen_t * __restrict__’ 
> but argument is of type ‘size_t *’
> ../../src/sss_client/common.c: In function ‘check_server_cred’:
> ../../src/sss_client/common.c:650: warning: passing argument 5 of 
> ‘getsockopt’ from incompatible pointer type
> /usr/include/sys/socket.h:190: note: expected ‘socklen_t * __restrict__’ 
> but argument is of type ‘size_t *’

ah, sorry, looks like it is time to upgrade :-)

New version attached.

bye,
Sumit
> -- 
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On 04/15/2010 09:06 AM, Sumit Bose wrote:
> ah, sorry, looks like it is time to upgrade :-)
>
> New version attached.
>
> bye,
> Sumit
> >

Ack.

[Stephen Gallagher]

On 04/15/2010 09:32 AM, Stephen Gallagher wrote:
> On 04/15/2010 09:06 AM, Sumit Bose wrote:
> > ah, sorry, looks like it is time to upgrade :-)
> >
> > New version attached.
> >
> > bye,
> > Sumit
> > >
>
> Ack.

Pushed to master and sssd-1-2.