krb5: make sure keytab is a FILE before checking for access#8556
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request modifies the copy_keytab_into_memory function in src/providers/krb5/krb5_keytab.c to ensure that the file accessibility check using faccessat is only performed when the keytab name is explicitly prefixed with "FILE:". This change prevents potential errors when dealing with non-file-based keytabs. I have no feedback to provide as there were no review comments to evaluate.
There was a problem hiding this comment.
Pull request overview
Updates Kerberos keytab handling in SSSD to avoid incorrectly applying filesystem readability checks to non-file keytab backends (e.g., KCM: / API:), addressing the regression described in #8555.
Changes:
- Restrict the
faccessat()readability check to onlyFILE:keytabs incopy_keytab_into_memory().
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
477139e to
e895edb
Compare
e895edb to
d50b0d2
Compare
KCM: and API: are other cases besides MEMORY: Resolves: SSSD#8555 Signed-off-by: Paymon MARANDI <[email protected]> Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Pavel Březina <[email protected]>
d50b0d2 to
94698ee
Compare
|
thanks and sorry about the |
KCM: and API: are other cases besides MEMORY:
Resolves: #8555
Signed-off-by: Paymon MARANDI [email protected]