RFC: privilege separation for ipa framework code #314

simo5 · 2016-12-06T16:02:45Z

As part of the External Authentication work this PR implements the privilege separation portion of the design available here: https://www.freeipa.org/page/V4/External_Authentication and implements tickets: https://fedorahosted.org/freeipa/ticket/5959 and https://fedorahosted.org/freeipa/ticket/4189

The update process from an old server has not been implemented yet, so this is just an RFC request at this stage. Please look at the code and let me know if you notice any major issue with it so we can correct mistakes early.

This PR depends on improvements and fixes to two dependencies: mod_auth_gssapi and gssproxy, which are not released/accepted upstream yet (all PRs filed, and will be available soon).
In order to allow trying the code, I made two copr repos with the necessary changes available here:

I tested a new install and both gssapi as well as password authentication work (via command line and web browser). I have not tested OTP authentication yet.

There are 2 fundamental changes in this code:

the session handling code has been dropped in favor of deferring session handling to mod_auth_gssapi, simplifying the code greatly. As part of this change we stop using memcached.
the framework configuration is changed to work as a different user from the Apache framework and depends on gssproxy in order to be able to access necessary credentials. (Apache itself is also using gssproxy and does not have direct access to the HTTP keytab.)
This required two changes in the form-based authentication workflow:
- The armor cache is obtained via anonymous pkinit as we do not have access anymore to the HTTP keytab. This means this PR depends on Configure Anonymous PKINIT on server install #62 (until it is accepted commits from that PR are in this PR)
- The actual authentication is done via a loopback HTTP request to apache after we obtain a TGT, this is done in order to obtain a session cookie from mod_auth_gssapi as well as to be able to immediately discard the TGT and just keep the HTTP ticket instead.

@jcholast @pvoborni Please provide comments on the framework changes.
@rcritten @abbra do you have ideas on how to deal with dropping a service (memcached) on upgrade ?

EDIT: Until a SeLinux policy is developed, this code needs to be run in permissive mode or it will fail.

tiran

First round of reviews.

tiran · 2016-12-06T17:29:02Z

ipalib/install/certmonger.py

    """
    Execute certmonger to request a server certificate.

    ``dns``
        A sequence of DNS names to appear in SAN request extension.
    """
+    if storage == 'FILE':
+        certfile, keyfile = certpath


The API for file based certmonger requests is counter intuitive. I'd rather have an additional argument keyfile=None with a check if storage == 'FILE' and keyfile is None: raise ValueError('keyfile is required for file storage')

Sorry I do not understand what this refers to.

tiran · 2016-12-06T17:34:29Z

install/share/ipa-httpd.conf.template

@@ -1,7 +1,7 @@
 # Do not edit. Created by IPA installer.

 [Service]
-Environment=KRB5CCNAME=$KRB5CC_HTTPD
+Environment=GSS_USE_PROXY=yes


Does the upgrade copy modified files like this one or ipa.service?

Read the PR decription, upgrade is not handled yet.

tiran · 2016-12-06T17:37:44Z

install/share/profiles/KDCs_PKINIT_Certs.cfg

@@ -0,0 +1,109 @@
+profileId=KDCs_PKINIT_Certs


I wonder, why do we need a special Dogtag profile for the pkinit certs? I couldn't find an explanation on https://www.freeipa.org/page/V4/External_Authentication

Please comment on #62 for this part, this commit is pulled in only because #62 is a dependency and it is not commited to master yet.

Btw, the reason why we depend on pkinit is also in the PR description.

tiran · 2016-12-06T17:42:07Z

ipaplatform/base/paths.py

@@ -49,7 +49,7 @@ class BasePathNamespace(object):
    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
    HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
    HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
-    IPA_KEYTAB = "/etc/httpd/conf/ipa.keytab"
+    HTTP_KEYTAB = "/etc/gssproxy/http.keytab"


I don't see code to remove and invalidate the old keytab /etc/httpd/conf/ipa.keytab. In case the principal should be disabled or invalidated, you can't useipa-rmkeytab. It does not invalidate the principal on the server side.

There is none, once upgrade will be handle we'll mv and chown/chmod/chcon the file in the right place.

tiran · 2016-12-06T17:55:09Z

@simo5 TravisCI's pep8 checker is complaining about some PEP8 violations:

./ipalib/install/kinit.py:64:1: E302 expected 2 blank lines, found 1
./ipalib/rpc.py:702:80: E501 line too long (93 > 79 characters)
./ipaplatform/redhat/tasks.py:437:13: E128 continuation line under-indented for visual indent
./ipaserver/install/httpinstance.py:117:1: E302 expected 2 blank lines, found 1
./ipaserver/install/httpinstance.py:127:1: E302 expected 2 blank lines, found 1
./ipaserver/rpcserver.py:428:80: E501 line too long (83 > 79 characters)
./ipaserver/rpcserver.py:625:80: E501 line too long (82 > 79 characters)
./ipaserver/rpcserver.py:932:80: E501 line too long (111 > 79 characters)
./ipaserver/rpcserver.py:941:80: E501 line too long (80 > 79 characters)

simo5 · 2016-12-06T18:41:22Z

Yeah going through those right now

simo5 · 2016-12-07T10:24:17Z

Updated branch, hopefully lint will be happy.
While there I discovered dcerpc.py ws using the HTTP keytab, after discussing with @abbra we decided to just remove such use for now and see later if we need any changes. The use was rare and in the importnat cases we have already a better option in the code.

pspacek · 2016-12-07T11:33:46Z

@simo5 Please extend the design page with image description which explains each of the steps. There are numbers and letters in the image which are not explained anywhere. A detailed end-to-end example of interaction could be useful for detailed review. Thank you!

simo5 · 2016-12-07T12:13:49Z

Note: this PR also depends on and includes commits from #206

simo5 · 2016-12-08T12:59:47Z

@pspacek I added workflows to the Design page, please verify

simo5 · 2016-12-19T15:45:02Z

I think this code is ready to be included.
I am still playing with a minor change in mod_auth_gssapi, but that can also go in later.

HonzaCholasta

So far I have only reviewed the code (see inline comments), stay tuned for functional review.

HonzaCholasta · 2016-12-20T07:19:06Z

freeipa.spec.in

@@ -255,6 +253,7 @@ Requires: systemd-python
 Requires: %{etc_systemd_dir}
 Requires: gzip
 Requires: oddjob
+Requires: gssproxy >= 0.5.1


Could you please add a short comment about why 0.5.1 is the minimal required version (e.g. "0.5.1: https://ticket/url" or "0.5.1: has feature XYZ")?

This will change to something like 0.5.2 in any case, do you want the comment in the spec file or in the commit message ?

In the spec file please.

HonzaCholasta · 2016-12-20T07:32:57Z

install/conf/ipa-gssproxy.conf

+  cred_store = ccache:FILE:/var/lib/gssproxy/http.ccache
+  impersonate = allow
+  cred_usage = both
+  euid = apache


The httpd UID is platform-specific. This file should be a template and the value of ipaplatform.constants.constants.HTTPD_USER should be used for the UID.

HonzaCholasta · 2016-12-20T07:34:25Z

install/conf/ipa-gssproxy.conf

+  mechs = krb5
+  cred_store = keytab:/etc/gssproxy/http.keytab
+  cred_store = client_keytab:/etc/gssproxy/http.keytab
+  cred_store = ccache:FILE:/var/lib/gssproxy/http.ccache


Could we use an IPA-specific location (/etc/ipa/gssproxy, /var/lib/ipa/gssproxy) for the credentials? I think it would make things easier for IPA in containers, backup, etc. down the road.

/var/lib/ipa/ would be probably best for containers.

HonzaCholasta · 2016-12-20T07:41:19Z

ipaplatform/base/constants.py

@@ -8,15 +8,19 @@


 class BaseConstantsNamespace(object):
+    ANON_USER = 'WELLKNOWN/ANONYMOUS'


This is not a platform-specific constant, please move it to ipalib.constants.

HonzaCholasta · 2016-12-20T08:14:44Z

ipaserver/install/httpinstance.py

+    def request_anon_keytab(self):
+        parent = os.path.dirname(paths.ANON_KEYTAB)
+        if not os.path.exists(parent):
+            os.makedirs(parent, 0o755)  # pylint: disable=old-octal-literal


Please remove the superfluous pylint comment.

It was required to pass make pylint, will keep it until that stops complaining

The thing is, this is not an old octal literal, so I don't see why it would complain about it.

HonzaCholasta · 2016-12-20T08:49:00Z

ipaserver/install/plugins/update_ra_cert_store.py

+                path = os.path.join(root, f)
+                os.chmod(path, 0o640)
+                os.chown(path, pent.pw_uid, pent.pw_gid)
+                tasks.restore_context(path)


Again, please re-use HTTPInstance.create_cert_db() instead of duplicating its functionality.

HonzaCholasta · 2016-12-20T08:51:23Z

ipaserver/install/plugins/update_ra_cert_store.py

+                                 nickname='ipaCert')
+        certmonger.start_tracking(secdir=paths.IPA_RADB_DIR,
+                                  nickname='ipaCert',
+                                  password_file=paths.IPA_RADB_PWDFILE_TXT)


This duplicates functionality of certificate_renewal_upgrade().

No, this is about properly tracking the cert that has been moved from one place to another, certificate_reqnewal_upgrade() deals with renewing certs, but does not have conditional code to check if they moved, it would make things more complex and more obscure to do the re-tracking there instead of when and where the cert is being moved.

HonzaCholasta · 2016-12-20T08:56:55Z

ipaserver/install/plugins/update_ra_cert_store.py

+        pw = binascii.hexlify(os.urandom(10))
+        p12file = os.path.join(paths.IPA_RADB_DIR, 'ipaCert.p12')
+        olddb.export_pkcs12('ipaCert', p12file, paths.ALIAS_PWDFILE_TXT, pw)
+        newdb.import_pkcs12(p12file, paths.IPA_RADB_PWDFILE_TXT, pw)


IMO it would be preferrable to move this code to a function in ipaserver.install.server.upgrade and call it after creating the RA DB and before certificate_renewal_upgrade() is called, so that we can get rid of all of the duplicate code found in this method.

It seemed most upgrades should be done via plugins?
What's the rule ?

HonzaCholasta · 2016-12-20T08:59:14Z

ipaserver/install/server/upgrade.py

+    want to clean up sysrestore.state to remove all references to
+    ipa_kpasswd.
+    """
+    ipa_memcached = MemcachedInstance()


This is the only use of MemcachedInstance and thus can be replaced with SimpleServiceInstance('ipa_memcached') and MemcachedInstance removed.

Ok, I just followed the same code that was used for the old kpasswd instance, should someone change that one too ?

HonzaCholasta · 2016-12-20T09:02:25Z

ipaserver/install/httpinstance.py

-        pwd_file = os.path.join(database, 'pwdfile.txt')
+    def create_cert_dbs(self):
+        self.create_cert_db(paths.HTTPD_ALIAS_DIR, constants.HTTPD_USER)
+        self.create_cert_db(paths.IPA_RADB_DIR, constants.IPAAPI_USER)


I don't think HTTPInstance has any bussiness in creating the RA DB, it should in fact be done in CAInstance.

Also it shouldn't be created in CA-less mode.

I will look into whether moving it in the CA instance is feasible

Thinking about this, don't we get a RA cert also on replicas that do not have the CA installed ?
In that case the CAInstance is not run ...

Ok. I can give you a hand if you want.

HonzaCholasta · 2017-01-03T06:56:44Z

Dogtag certificates and RA certificate renewal is broken:

	ca-error: Server at "https://vm-226.abc.idm.lab.eng.brq.redhat.com:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation

This is because certmonger's /usr/libexec/certmonger/dogtag-ipa-renew-agent-submit expects an ipaCert in /etc/httpd/alias.

CA-less server install fails:

  [13/21]: publish CA cert
  [error] CalledProcessError: Command '/usr/bin/certutil -d /etc/httpd/alias -L -n ABC.IDM.LAB.ENG.BRQ.REDHAT.COM IPA CA -a' returned non-zero exit status 255
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    Command '/usr/bin/certutil -d /etc/httpd/alias -L -n ABC.IDM.LAB.ENG.BRQ.REDHAT.COM IPA CA -a' returned non-zero exit status 255
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

2017-01-03T05:21:43Z DEBUG Starting external process
2017-01-03T05:21:43Z DEBUG args=/usr/bin/certutil -d /var/lib/ipa/radb -L -n ABC.IDM.LAB.ENG.BRQ.REDHAT.COM IPA CA -a
2017-01-03T05:21:43Z DEBUG Process finished, return code=255
2017-01-03T05:21:43Z DEBUG stdout=
2017-01-03T05:21:43Z DEBUG stderr=certutil: Could not find cert: ABC.IDM.LAB.ENG.BRQ.REDHAT.COM IPA CA
: PR_FILE_NOT_FOUND_ERROR: File not found

If I work around the above, it fails further down with:

trying https://vm-058-236.abc.idm.lab.eng.brq.redhat.com/ipa/json
Forwarding 'schema' to json server 'https://vm-058-236.abc.idm.lab.eng.brq.redhat.com/ipa/json'
No valid Negotiate header in server response
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    Configuration of client side components failed!
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

simo5 · 2017-01-03T16:59:10Z

Why is dogtag-ipa-renew-agent-submit part of the certmonger package ?
And how do we fix it now ?

rcritten · 2017-01-03T17:08:22Z

You can specify the nickname using -n/--nickname. You'll probably also want to set --cafile=/etc/ipa/ca.crt, --dbdir=/etc/httpd/alias and sslpinfile=/etc/httpd/alias/pwdfile.txt to maintain current behavior.

simo5 · 2017-01-04T15:14:22Z

Rebased on master and fixed a couple minor lint issues

HonzaCholasta · 2017-01-05T09:59:13Z

@simo5, I might have fixed the certmonger issue, see HonzaCholasta@907ef3cff2045edd4625d4c422d1d0ae473fe51c, however I'm hitting the "No valid Negotiate header in server response" error again. Any idea what might be causing it?

simo5 · 2017-01-05T14:20:36Z

I switched all endpoints to use GSSAPI (and transparently use a session cookie once one transation is successful), so there may be some parts of the code a bit surprised about it, do you have apache logs to chare that show the problem ? (enabling ipa debug would probably help too)

HonzaCholasta · 2017-01-12T08:00:18Z

@simo5, I can't reproduce the bug anymore with the latest update.

Pylint found one trivial issue:

ipaserver/install/server/upgrade.py:83: [E0602(undefined-variable), uninstall_ipa_memcached] Undefined variable 'SimpleServiceInstance')

(It should be service.SimpleServiceInstance.)

HonzaCholasta · 2017-02-14T13:09:37Z

ipalib/rpc.py

+                try:
+                    delattr(context, 'session_cookie')
+                except AttributeError:
+                    pass


I think we should delete context.session_cookie also in the except (errors.CCacheError, ValueError): branch of the try-except statement.

We can do that later for ticket 6543 though.

HonzaCholasta · 2017-02-14T13:37:06Z

@simo5, most of the commits do not have a ticket link, is this intentional?

simo5 · 2017-02-14T13:42:41Z

For some commits I was sure what ticket to use, for some I was not, so I elected not to put a specific ticket in there. If you have a good idea of what ticket (of the External Authentication project) to apply to specific commits let me know and I can amend commit messages.

HonzaCholasta · 2017-02-14T14:08:22Z

@simo5, is there an umbrella ticket? 5959 perhaps?

HonzaCholasta · 2017-02-14T14:55:29Z

I would personally go with:

Change session handling: 5959
Generate tmpfiles config at install time: 5959
Drop use of kinit_as_http from trust code: 5959
Use Anonymous user to obtain FAST armor ccache: 5959
Configure HTTPD to work via Gss-Proxy: 4189, 5959
Separate RA cert store from the HTTP cert store: 5959
Simplify NSSDatabase password file handling: 5959
Always use /etc/ipa/ca.crt as CA cert file: 5959
Add a new user to run the framework code: 5959
Rationalize creation of RA and HTTPD NSS databases: 5959
Fix uninstall stopping ipa.service: 5959
Allow rpc callers to pass ccache and service names: 6543
Explicitly pass down ccache names for connections: 6543
Insure removal of session on identity change: 6543

Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

The framework will not have direct access to the keytab anymore. This function was used in two places, to fetch the domain list and to re-initialize the PAC when enabling or disabling a domain trust. The domian list is normally fetched via oddjob anyway so this use is not necesary anymore, and the MS-PAC re-initialization can be moved later to oddjob if needed. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

It seem like ALIAS_CACERT_ASC was just a redundant location for the CA cert file which is always available in /etc/ipa/ca.crt Just use the canonical CA cert location in /etc/ipa for all cases and stop creating a separate cacert file. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

The RA database sould not be created by the HTTP instance, but in the code path that creates the CA instance. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

When uninstalling systemd is told to disable the service, but it is not told to sopt it, so it believes it is still running. This can cause issues in some cases if a reinstall is performed right after an uninstall, as systemd may decide to stop the disabled service while we are reinstalling, causing the new install to fail. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

This allows code to use multiple ccaches without having to muck with the process global environment variables (KRB5CCNAME). https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com>

Instead of relying on side effects (setting the KRB5CCNAME env var), explicitly pass the ccache name to be used if it is not the default ccache. This fixes some tests that sometimes fail to work properly due to the wrong ccache being used. https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com>

If we are changing identiy (different principal) insure we remove the session cookie stored on the rpc context so that we do not mistakenly connect with the previous identity credentials. https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com>

simo5 · 2017-02-14T22:38:45Z

Done

HonzaCholasta · 2017-02-15T06:06:49Z

Thank you.

HonzaCholasta · 2017-02-15T06:07:54Z

tiran · 2017-02-15T13:17:32Z

FYI, KRA and vault are broken because KRA cert is not migrated: https://fedorahosted.org/freeipa/ticket/6675

tiran · 2017-02-15T13:38:09Z

Cookie parsing bug with FreeIPA 4.4 client:
https://fedorahosted.org/freeipa/ticket/6676

stlaz · 2017-02-15T17:27:02Z

I would put broken KRA cert migration to lowest priority since #367 moves the original KRA cert anyway.

simo5 force-pushed the webui_isolate branch from 24301ae to 0cd36a1 Compare December 6, 2016 16:39

tiran reviewed Dec 6, 2016

View reviewed changes

simo5 force-pushed the webui_isolate branch from 0cd36a1 to 4de7bcd Compare December 7, 2016 10:22

simo5 force-pushed the webui_isolate branch 2 times, most recently from f27c461 to ccd0f34 Compare December 8, 2016 11:05

simo5 force-pushed the webui_isolate branch 5 times, most recently from 6a0e382 to 8958770 Compare December 15, 2016 10:34

simo5 force-pushed the webui_isolate branch 2 times, most recently from a41dea5 to 898ed1f Compare December 19, 2016 15:43

HonzaCholasta previously requested changes Dec 20, 2016

View reviewed changes

simo5 force-pushed the webui_isolate branch from 898ed1f to 3255320 Compare December 22, 2016 23:28

simo5 force-pushed the webui_isolate branch from 3255320 to e0bd4f0 Compare January 4, 2017 15:13

HonzaCholasta mentioned this pull request Jan 9, 2017

dogtaginstance: track server certificate with our renew agent #377

Closed

HonzaCholasta reviewed Feb 14, 2017

View reviewed changes

simo5 added 14 commits February 14, 2017 17:36

Configure HTTPD to work via Gss-Proxy

43233c3

https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

Simplify NSSDatabase password file handling

78ec63b

https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

Rationalize creation of RA and HTTPD NSS databases

6101ef1

The RA database sould not be created by the HTTP instance, but in the code path that creates the CA instance. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com>

Allow rpc callers to pass ccache and service names

cb4b388

This allows code to use multiple ccaches without having to muck with the process global environment variables (KRB5CCNAME). https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com>

simo5 force-pushed the webui_isolate branch from 4bb215d to ea0e7cf Compare February 14, 2017 22:38

HonzaCholasta added the ack Pull Request approved, can be merged label Feb 15, 2017

HonzaCholasta added the pushed Pull Request has already been pushed label Feb 15, 2017

HonzaCholasta closed this Feb 15, 2017

tiran mentioned this pull request Feb 15, 2017

display_status wrappers go cyclic pythongssapi/python-gssapi#111

Closed

		@@ -8,15 +8,19 @@


		class BaseConstantsNamespace(object):
		ANON_USER = 'WELLKNOWN/ANONYMOUS'

RFC: privilege separation for ipa framework code #314

RFC: privilege separation for ipa framework code #314

Conversation

simo5 commented Dec 6, 2016 • edited by HonzaCholasta

tiran left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tiran commented Dec 6, 2016

simo5 commented Dec 6, 2016

simo5 commented Dec 7, 2016

pspacek commented Dec 7, 2016

simo5 commented Dec 7, 2016

simo5 commented Dec 8, 2016

simo5 commented Dec 19, 2016

HonzaCholasta left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HonzaCholasta commented Jan 3, 2017

simo5 commented Jan 3, 2017

rcritten commented Jan 3, 2017

simo5 commented Jan 4, 2017

HonzaCholasta commented Jan 5, 2017

simo5 commented Jan 5, 2017

HonzaCholasta commented Jan 12, 2017

HonzaCholasta Feb 14, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HonzaCholasta commented Feb 14, 2017

simo5 commented Feb 14, 2017

HonzaCholasta commented Feb 14, 2017

HonzaCholasta commented Feb 14, 2017

simo5 commented Feb 14, 2017

HonzaCholasta commented Feb 15, 2017

HonzaCholasta commented Feb 15, 2017

tiran commented Feb 15, 2017

tiran commented Feb 15, 2017

stlaz commented Feb 15, 2017

simo5 commented Dec 6, 2016 •

edited by HonzaCholasta

HonzaCholasta Feb 14, 2017 •

edited