search for: cachenam

...LL_ENV_PATH_FMT "/proc/%d/environ" +#define CIFS_UPCALL_ENV_PATH_MAXLEN (6 + 10 + 8 + 1) + +#define ENV_NAME "KRB5CCNAME" +#define ENV_PREFIX "KRB5CCNAME=" +#define ENV_PREFIX_LEN 11 + +#define ENV_BUF_START (4096) +#define ENV_BUF_MAX (131072) + +/** + * get_cachename_from_process_env - scrape value of $KRB5CCNAME out of the + * initiating process' environment. + * @pid: initiating pid value from the upcall string + * + * Open the /proc/<pid>/environ file for the given pid, and scrape it for + * KRB5CCNAME entries. + * + * We start with a page...

...+#define ENV_PATH_FMT "/proc/%d/environ" +#define ENV_PATH_MAXLEN (6 + 10 + 8 + 1) + +#define ENV_NAME "KRB5CCNAME" +#define ENV_PREFIX "KRB5CCNAME=" +#define ENV_PREFIX_LEN 11 + +#define ENV_BUF_START (4096) +#define ENV_BUF_MAX (131072) + +/** + * get_cachename_from_process_env - scrape value of $KRB5CCNAME out of the + * initiating process' environment. + * @pid: initiating pid value from the upcall string + * + * Open the /proc/<pid>/environ file for the given pid, and scrape it for + * KRB5CCNAME entries. + * + * We start with a page...

Third respin of this series. Reordered for better safety for bisecting. The environment scraping is now on by default, but can be disabled with "-E" in environments where it's not needed. Also, I've added a patch to make cifs.upcall drop capabilities before doing most of its work. This may help reduce the attack surface of the program. Jeff Layton (4): cifs.upcall: convert

...at samba.org> --- cifs.upcall.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cifs.upcall.c b/cifs.upcall.c index 8f146c92b4a5..dd0843e358b1 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -159,6 +159,7 @@ get_default_cc(void) { krb5_error_code ret; krb5_ccache cc; + char *cachename; ret = krb5_cc_default(context, &cc); if (ret) { @@ -166,6 +167,14 @@ get_default_cc(void) return NULL; } + ret = krb5_cc_get_full_name(context, cc, &cachename); + if (ret) { + syslog(LOG_DEBUG, "%s: krb5_cc_get_full_name failed: %d\n", __func__, ret); + } else { +...

Small respin of the patches that I posted a few days ago. The main difference is the reordering of the series to make it do the group and grouplist manipulation first, and then the patch that makes it grab the KRB5CCNAME from the initiating process. I think the code is sound, my main question is whether we really need the command-line switch for this. Should this just be the default mode of

Apologies for v3 series, I had some extra patches in there. This is the one that should have been sent. Relabeled as v4 for clarity. Third respin of this series. Reordered for better safety for bisecting. The environment scraping is now on by default, but can be disabled with "-E" in environments where it's not needed. Also, I've added a patch to make cifs.upcall drop

On Thu, 2017-02-09 at 14:45 -0600, Chad William Seys wrote: > Hi Jeff, > Could you look at the following mailing list posting? > > https://lists.samba.org/archive/samba/2017-February/206468.html > > It looks like cifs.upcall has changed its behavior. As described in > that post, I can mount with root / kerberos, but then cannot access with > another user who has

...ec=1 > Jan 7 17:11:36 memberserver-45 cifs.upcall: uid=2028 > Jan 7 17:11:36 memberserver-45 cifs.upcall: creduid=2028 > Jan 7 17:11:36 memberserver-45 cifs.upcall: user=root > Jan 7 17:11:36 memberserver-45 cifs.upcall: pid=2162 > Jan 7 17:11:36 memberserver-45 cifs.upcall: get_cachename_from_process_env: pathname=/proc/2162/environ > Jan 7 17:11:36 memberserver-45 cifs.upcall: get_cachename_from_process_env: cachename = FILE:/tmp/krb5cc_2028 > Jan 7 17:11:36 memberserver-45 cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_2028 > Jan 7 17:11:36 memberse...

...fs.upcall: ip=192.168.0.36 Oct 11 22:45:32 pc-jm cifs.upcall: sec=1 Oct 11 22:45:32 pc-jm cifs.upcall: uid=337001591 Oct 11 22:45:32 pc-jm cifs.upcall: creduid=337001591 Oct 11 22:45:32 pc-jm cifs.upcall: user=tester Oct 11 22:45:32 pc-jm cifs.upcall: pid=2728 Oct 11 22:45:32 pc-jm cifs.upcall: get_cachename_from_process_env: pathname=/proc/2728/environ Oct 11 22:45:32 pc-jm cifs.upcall: get_cachename_from_process_env: cachename = FILE:/tmp/krb5cc_337001591 Oct 11 22:45:32 pc-jm cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_337001591 Oct 11 22:45:32 pc-jm kernel: [ 13.764725] CIFS...

Hi, very sporadic and non-reproducible, I get the following type of errors: Error in get(name, envir = envir) : formal argument "envir" matched by multiple actual arguments Error in exists(cacheName, envir = envir, inherit = FALSE) : formal argument "envir" matched by multiple actual arguments Error in paste(..., sep = sep) : formal argument "sep" matched by multiple actual arguments I cannot see how these errors can occur. Note, in the third example "..." does...

...memberserver-45 cifs.upcall: uid=2028 > > Jan 7 17:11:36 memberserver-45 cifs.upcall: creduid=2028 > > Jan 7 17:11:36 memberserver-45 cifs.upcall: user=root > > Jan 7 17:11:36 memberserver-45 cifs.upcall: pid=2162 > > Jan 7 17:11:36 memberserver-45 cifs.upcall: > get_cachename_from_process_env: pathname=/proc/2162/environ > > Jan 7 17:11:36 memberserver-45 cifs.upcall: > get_cachename_from_process_env: cachename = FILE:/tmp/krb5cc_2028 > > Jan 7 17:11:36 memberserver-45 cifs.upcall: > get_existing_cc: default ccache is FILE:/tmp/krb5cc_2028 > &g...

...rt_time]     [-r renewable_life] [-f | -F | --forwardable | --noforwardable]     [-p | -P | --proxiable | --noproxiable]     -n [-a | -A | --addresses | --noaddresses]     [--request-pac | --no-request-pac]     [-C | --canonicalize]     [-E | --enterprise]     [-v] [-R] [-k [-i|-t keytab_file]] [-c cachename]     [-S service_name] [-T ticket_armor_cache]     [-X <attribute>[=<value>]] [principal]     options:     -V verbose     -l lifetime     -s start time     -r renewable lifetime     -f forwardable     -F not forwardable     -p proxiable     -P not proxiable     -n anonymous     -a inc...