[autobackport: sssd-2-9] KCM: root can't access arbitrary KCM cache#8311
Conversation
There was a problem hiding this comment.
Code Review
This pull request correctly removes the special handling for the root user, preventing it from accessing arbitrary Kerberos credential caches in KCM. The changes are consistent across the implementation, documentation, and code comments. The core logic change in kcmsrv_ccache.c removes the privileged access, and the corresponding updates in sssd-kcm.8.xml and kcmsrv_ccache.h accurately reflect this new, more secure behavior. The changes are correct and well-executed.
so remove confusing traces suggesting otherwise See: SSSD#7274 (comment) Resolves: SSSD#7274 Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com> (cherry picked from commit 87e72fd)
|
The pull request was accepted by @ikerexxe with the following PR CI status: 🟢 CodeQL (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
0023b1d to
6eb3980
Compare
This is an automatic backport of PR#8301 KCM: root can't access arbitrary KCM cache to branch sssd-2-9, created by @alexey-tikhonov.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
87e72fd - KCM: root can't access arbitrary KCM cache
Backported commits
Original Pull Request Body
so remove confusing traces suggesting otherwise
See: #7274 (comment)
Resolves: #7274