IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't configure KEYRING ccache in containers

Browse Source 
Kernel keyrings are not namespaced yet. Keyrings can leak into other
containers. Therefore keyrings should not be used in containerized
environment.

Don't configure Kerberos to use KEYRING ccache backen when a container
environment is detected by systemd-detect-virt --container.

Fixes: https://pagure.io/freeipa/issue/7807
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
This commit is contained in:
Christian Heimes
2018-12-12 17:32:06 +01:00
committed by Tibor Dudlák
parent 49cc72d5c9
commit 165a941109
5 changed files with 64 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ipapython/kernel_keyring.py
View File

@@ -23,6 +23,7 @@ import os
from ipapython.ipautil import run
from ipaplatform.paths import paths
from ipaplatform.tasks import tasks
# NOTE: Absolute path not required for keyctl since we reset the environment
# in ipautil.run.
@@ -73,10 +74,14 @@ def get_persistent_key(key):
return result.raw_output.rstrip()
def is_persistent_keyring_supported():
"""
Returns True if the kernel persistent keyring is supported.
def is_persistent_keyring_supported(check_container=True):
"""Returns True if the kernel persistent keyring is supported.
If check_container is True and a containerized environment is detected,
return False. There is no support for keyring namespace isolation yet.
"""
if check_container and tasks.detect_container() is not None:
return False
uid = os.geteuid()
try:
get_persistent_key(str(uid))