krb5: make sure keytab is a FILE before checking for access#8556
krb5: make sure keytab is a FILE before checking for access#8556257 wants to merge 1 commit intoSSSD:masterfrom
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request modifies the copy_keytab_into_memory function in src/providers/krb5/krb5_keytab.c to ensure that the file accessibility check using faccessat is only performed when the keytab name is explicitly prefixed with "FILE:". This change prevents potential errors when dealing with non-file-based keytabs. I have no feedback to provide as there were no review comments to evaluate.
There was a problem hiding this comment.
Pull request overview
Updates Kerberos keytab handling in SSSD to avoid incorrectly applying filesystem readability checks to non-file keytab backends (e.g., KCM: / API:), addressing the regression described in #8555.
Changes:
- Restrict the
faccessat()readability check to onlyFILE:keytabs incopy_keytab_into_memory().
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
257
force-pushed
the
improve-reporting-when-running-as-sssd2
branch
from
477139e to
e895edb
Compare
KCM: and API: are other cases besides MEMORY: Resolves: SSSD#8555 Signed-off-by: Paymon MARANDI <paymon@encs.concordia.ca>
257
force-pushed
the
improve-reporting-when-running-as-sssd2
branch
from
e895edb to
d50b0d2
Compare
KCM: and API: are other cases besides MEMORY:
Resolves: #8555
Signed-off-by: Paymon MARANDI paymon@encs.concordia.ca