|
 |
ecd8e1 |
From b927dc7c8d5d4f467749958d3e6330ff70fc3ea2 Mon Sep 17 00:00:00 2001
|
|
|
ecd8e1 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ecd8e1 |
Date: Mon, 1 Apr 2019 17:27:45 +0200
|
|
|
ecd8e1 |
Subject: [PATCH] ipa: ipa_getkeytab don't call libnss_sss
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
Resolves: https://pagure.io/SSSD/sssd/issue/3992
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
ipa-getkeytab is a help process which might even get called during
|
|
|
ecd8e1 |
the startup of SSSD. Hence it should not try to use any SSSD responder
|
|
|
ecd8e1 |
especially not the NSS responder.
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
Typically we call helpers with the environment of the calling SSSD
|
|
|
ecd8e1 |
component where then _SSS_LOOPS environment variable is set to 'NO' to
|
|
|
ecd8e1 |
skip calls to SSSD in libnss_sss. Since we have to set the KRB5CCNAME
|
|
|
ecd8e1 |
environment variable to the ccache with the current TGT for the host
|
|
|
ecd8e1 |
principal when calling ipa-getkeytab execle() is used to call
|
|
|
ecd8e1 |
ipa_getkeytab which unfortunately replaces the environment of the caller
|
|
|
ecd8e1 |
with the one provided in the last argument of the call. To make sure
|
|
|
ecd8e1 |
ipa_getkeytab does not call back into SSSD we have to set _SSS_LOOPS=NO
|
|
|
ecd8e1 |
here as well.
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
ecd8e1 |
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
|
ecd8e1 |
(cherry picked from commit d409c10d00101734d1af0c9e0256e607ee8b09c7)
|
|
|
ecd8e1 |
---
|
|
|
ecd8e1 |
src/providers/ipa/ipa_subdomains_server.c | 2 +-
|
|
|
ecd8e1 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
|
|
|
ecd8e1 |
index dd0933642..1d480e52b 100644
|
|
|
ecd8e1 |
--- a/src/providers/ipa/ipa_subdomains_server.c
|
|
|
ecd8e1 |
+++ b/src/providers/ipa/ipa_subdomains_server.c
|
|
|
ecd8e1 |
@@ -481,7 +481,7 @@ static void ipa_getkeytab_exec(const char *ccache,
|
|
|
ecd8e1 |
{
|
|
|
ecd8e1 |
errno_t ret;
|
|
|
ecd8e1 |
int debug_fd;
|
|
|
ecd8e1 |
- const char *gkt_env[2] = { NULL, NULL };
|
|
|
ecd8e1 |
+ const char *gkt_env[3] = { NULL, "_SSS_LOOPS=NO", NULL };
|
|
|
ecd8e1 |
|
|
|
ecd8e1 |
if (debug_level >= SSSDBG_TRACE_LIBS) {
|
|
|
ecd8e1 |
debug_fd = get_fd_from_debug_file();
|
|
|
ecd8e1 |
--
|
|
|
ecd8e1 |
2.19.1
|
|
|
ecd8e1 |
|