mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 07:33:27 -06:00
a1ed0ff77e
Only three remaining scripts used this form, two of which are for developers only and not shipped. The shebang in ipa-ccache-sweeper will be converted to "#!$(PYTHON) -I" in the build process. Fixes: https://pagure.io/freeipa/issue/8941 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
76 lines
2.6 KiB
Python
76 lines
2.6 KiB
Python
#!/usr/bin/python3
|
|
|
|
# Based heavily on
|
|
# https://github.com/gssapi/mod_auth_gssapi/blob/master/contrib/sweeper.py
|
|
|
|
# Copyright (C) 2016 mod_auth_gssapi contributors - See COPYING for (C) terms
|
|
|
|
# If one uses both sessions and unique ccache names, then the filesystem will
|
|
# become littered with ccache files unless the accessed application cleans
|
|
# them up itself. This script will minimize ccache file proliferation by
|
|
# removing any ccaches that have expired from the filesystem, and serves as an
|
|
# example of how this cleaning can be performed.
|
|
|
|
import argparse
|
|
import os
|
|
import stat
|
|
import sys
|
|
import time
|
|
|
|
from ipalib.krb_utils import get_credentials_if_valid
|
|
from ipaplatform.paths import paths
|
|
|
|
|
|
def should_delete(fname, t, minlife):
|
|
"""Process file as a ccache and indicate whether it is expired"""
|
|
# skip directories and other non-files
|
|
st = os.stat(fname)
|
|
if not stat.S_ISREG(st.st_mode):
|
|
return False
|
|
|
|
# ignore files that are newer than minlife minutes
|
|
if t - st.st_mtime < minlife * 60:
|
|
return False
|
|
|
|
# gssproxy inquires input credentials. If they are expired
|
|
# then gssproxy acquires creds from cred_store according to
|
|
# the configuration of gssproxy's service, which in this case
|
|
# hasn't cred_store(besides `keytab:`, used for decryption of
|
|
# ccache). If there is no ccache within cred_store then gssproxy
|
|
# adds its own one("MEMORY:internal_%d"), which hasn't
|
|
# any credentials, thus, scan_ccache fails with KRB5_FCC_NOFILE.
|
|
# Since the caller requires INITIATE-ONLY and the client keytab
|
|
# is not provided in cred_store the result of gss_acquire_cred_from
|
|
# is KRB5_FCC_NOFILE, which is mapped by gssproxy to
|
|
# 0x04200000 + KRB5_FCC_NOFILE.
|
|
creds = get_credentials_if_valid(ccache_name=fname)
|
|
return creds is None
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description="Sweep expired ccaches")
|
|
parser.add_argument("-m", dest="minlife", type=int,
|
|
help="ignore newer files than this (default: 30)",
|
|
default=30)
|
|
args = parser.parse_args()
|
|
|
|
os.environ["GSS_USE_PROXY"] = "yes"
|
|
os.environ["GSSPROXY_BEHAVIOR"] = "REMOTE_ONLY"
|
|
os.environ["GSSPROXY_SOCKET"] = paths.IPA_CCACHE_SWEEPER_GSSPROXY_SOCK
|
|
|
|
print("Running sweeper...")
|
|
|
|
t = time.time()
|
|
|
|
os.chdir(paths.IPA_CCACHES)
|
|
for fname in os.listdir(paths.IPA_CCACHES):
|
|
try:
|
|
if should_delete(fname, t, args.minlife):
|
|
os.unlink(fname)
|
|
except FileNotFoundError:
|
|
# someone else did the work for us
|
|
pass
|
|
|
|
print("Sweeper finished successfully!")
|
|
sys.exit(0)
|