|
 |
d6181b |
From 940002ca21abde53ad81df622d1f4dd3b5e8e014 Mon Sep 17 00:00:00 2001
|
|
|
d6181b |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
d6181b |
Date: Fri, 30 Nov 2018 13:34:22 +0100
|
|
|
d6181b |
Subject: [PATCH 20/23] SECRETS: Don't limit the global number of ccaches
|
|
|
d6181b |
MIME-Version: 1.0
|
|
|
d6181b |
Content-Type: text/plain; charset=UTF-8
|
|
|
d6181b |
Content-Transfer-Encoding: 8bit
|
|
|
d6181b |
|
|
|
d6181b |
Related:
|
|
|
d6181b |
https://pagure.io/SSSD/sssd/issue/3386
|
|
|
d6181b |
|
|
|
d6181b |
In the KCM context, the global number of ccaches would limit the number
|
|
|
d6181b |
of users who can store their ccaches in the KCM deamon.
|
|
|
d6181b |
|
|
|
d6181b |
In more detail, the options have the following semantics with KCM:
|
|
|
d6181b |
- DEFAULT_SEC_KCM_MAX_SECRETS - global number of secrets, would
|
|
|
d6181b |
cover both how many ccaches can a user store, but this is better
|
|
|
d6181b |
served with DEFAULT_SEC_KCM_MAX_UID_SECRETS
|
|
|
d6181b |
|
|
|
d6181b |
- DEFAULT_SEC_KCM_MAX_UID_SECRETS - how many 'principals' can a user
|
|
|
d6181b |
kinit with
|
|
|
d6181b |
|
|
|
d6181b |
- DEFAULT_SEC_KCM_MAX_PAYLOAD_SIZE - the payload size of service
|
|
|
d6181b |
tickets
|
|
|
d6181b |
|
|
|
d6181b |
With the above in mind, I think the most important limits are
|
|
|
d6181b |
max_uid_secrets to limit and the payload size to constraint how much
|
|
|
d6181b |
space can a user occupy and it doesn't make much sense to limit the
|
|
|
d6181b |
global quota.
|
|
|
d6181b |
|
|
|
d6181b |
Reviewed-by: Michal Židek <mzidek@redhat.com>
|
|
|
d6181b |
---
|
|
|
d6181b |
src/util/secrets/secrets.h | 2 +-
|
|
|
d6181b |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
d6181b |
|
|
|
d6181b |
diff --git a/src/util/secrets/secrets.h b/src/util/secrets/secrets.h
|
|
|
d6181b |
index 31164bd86..9cf397516 100644
|
|
|
d6181b |
--- a/src/util/secrets/secrets.h
|
|
|
d6181b |
+++ b/src/util/secrets/secrets.h
|
|
|
d6181b |
@@ -39,7 +39,7 @@
|
|
|
d6181b |
* but the secret size must be large because one secret in the /kcm
|
|
|
d6181b |
* hive holds the whole ccache which consists of several credentials
|
|
|
d6181b |
*/
|
|
|
d6181b |
-#define DEFAULT_SEC_KCM_MAX_SECRETS 256
|
|
|
d6181b |
+#define DEFAULT_SEC_KCM_MAX_SECRETS 0 /* unlimited */
|
|
|
d6181b |
#define DEFAULT_SEC_KCM_MAX_UID_SECRETS 64
|
|
|
d6181b |
#define DEFAULT_SEC_KCM_MAX_PAYLOAD_SIZE 65536
|
|
|
d6181b |
|
|
|
d6181b |
--
|
|
|
d6181b |
2.20.1
|
|
|
d6181b |
|