Unexpected failure in realpath: 13 (Permission denied)

[gssapi]

Unexpected failure in realpath: 13 (Permission denied)

[jas4711]

I found a solution that silence the error. Isn't there a way to get the process name of a process without these permissions?

podman run --cap-add=SYS_PTRACE

Still not exactly clear why I don't get a final success in a container... I'm debugging more.

[simo5]

Note that generally the idea is to run the gssproxy in the host, and bind mount its socket in a container. This way container processes do not have direct access to keytabs/credentials, gssproxy does it for them.

I am also not sure this is an actual gssproxy issue, unless it is an RFE to make disableable the feature that reads the calling process name.

[jas4711]

I managed to track the problem down a bit more. Apache talks to gssproxy once as root and then as www-data in a container, but only as www-data on real systems. Thus I need two stanzas 'euid=root' and 'euid=www-data'. The script is below, run it in a container and remove one of the stanzas to see error messages about non-matching euid. Any ideas what is happening?

podman run --cap-add=SYS_PTRACE --rm -it debian:bullseye bash

https://salsa.debian.org/jas/gssproxy/-/blob/master/debian/tests/gssproxy-apache

Anyway, I'm closing this since I don't think it is a gssproxy issue. Sorry for the noise.

[simo5]

Sorry not having used debian for many years now I do not know if that distribution makes any assumption on how to run apache. At a glance I see nothing out of the ordinary.