gssproxy

#77 directory permissions for /var/lib/gssproxy/ should allow read access
Closed: Fixed Opened by gd.

Closed: Fixed
Reopen Issue

Otherwise consumers cannot access the deault socket location.

Simo, does this look correct ?

 gssproxy.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/gssproxy.spec b/gssproxy.spec
index 3a7a05b..23d1cd7 100644
--- a/gssproxy.spec
+++ b/gssproxy.spec
@@ -82,8 +82,8 @@ rm -rf %{buildroot}
 %{_unitdir}/gssproxy.service
 %{_sbindir}/gssproxy
 %attr(755,root,root) %dir %{pubconfpath}
-%attr(700,root,root) %dir %{gpstatedir}
-%attr(700,root,root) %dir %{gpstatedir}/clients
+%attr(755,root,root) %dir %{gpstatedir}
+%attr(755,root,root) %dir %{gpstatedir}/clients
 %attr(0600,root,root) %config(noreplace) /%{_sysconfdir}/gssproxy/gssproxy.conf
 %attr(0644,root,root) %config(noreplace) /%{_sysconfdir}/gss/mech
 %{_libdir}/gssproxy/proxymech.so

No,
%{gpstatedir}/clients contains keytabs and ccaches gssproxy creates on behalf of users for privilege separation.
Those files should enver be accessible to anyone but gssproxy.

Ok, only pushed the +%attr(755,root,root) %dir %{gpstatedir} change and left the clients directory as it is.

Fixed with v0.2.1

Metadata Update from @gd:
- Issue assigned to gd
- Issue set to the milestone: 2013 April
Metadata
None
None
None
Normal
task
gssproxy daemon
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.