krb5_child: fix ccache replacement on concurrent logins#8342
krb5_child: fix ccache replacement on concurrent logins#8342ikerexxe wants to merge 2 commits intoSSSD:masterfrom
Conversation
Extract the privilege management and user identity setup logic from `privileged_krb5_setup()` into a new `k5c_drop_to_user()` function. In addition, refactor it to make it idempotent. Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
When session keep-alive was extended to all authentication methods, the ccache setup logic was no longer executed during SSS_PAM_AUTHENTICATE for kept-alive processes. This caused concurrent logins with the same user to create new random ccache filenames instead of reusing existing ones, resulting in ccache replacement. This restores the ccache reuse functionality that prevents concurrent logins from overwriting each other's credential caches. Fixes: 4cb99a2 (2025-12-04; "krb5_child: advertise authentication methods") Resolves: SSSD#8331 Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to fix an issue with ccache replacement during concurrent logins by restoring ccache setup logic for keep-alive processes. The refactoring of the privilege dropping logic is a good improvement. However, I've identified a critical security vulnerability in the implementation. The effective privileges are not dropped before performing ccache operations, which could lead to ccache files being created with root ownership. My review includes a specific comment and a code suggestion to address this vulnerability.
|
Imo, this won't work.
All capabilities are already dropped at this point. |
|
Superseded by #8344 |
alexey-tikhonov
added
superseded
3 participants
When session keep-alive was extended to all authentication methods,
the ccache setup logic was no longer executed during SSS_PAM_AUTHENTICATE
for kept-alive processes. This caused concurrent logins with the same
user to create new random ccache filenames instead of reusing existing
ones, resulting in ccache replacement.
This restores the ccache reuse functionality that prevents concurrent
logins from overwriting each other's credential caches.
Fixes: 4cb99a2 (2025-12-04; "krb5_child: advertise authentication methods")
Resolves: #8331