Comments (4)
I found a solution that silence the error. Isn't there a way to get the process name of a process without these permissions?
podman run --cap-add=SYS_PTRACE
Still not exactly clear why I don't get a final success in a container... I'm debugging more.
from gssproxy.
Note that generally the idea is to run the gssproxy in the host, and bind mount its socket in a container. This way container processes do not have direct access to keytabs/credentials, gssproxy does it for them.
I am also not sure this is an actual gssproxy issue, unless it is an RFE to make disableable the feature that reads the calling process name.
from gssproxy.
I managed to track the problem down a bit more. Apache talks to gssproxy once as root and then as www-data in a container, but only as www-data on real systems. Thus I need two stanzas 'euid=root' and 'euid=www-data'. The script is below, run it in a container and remove one of the stanzas to see error messages about non-matching euid. Any ideas what is happening?
podman run --cap-add=SYS_PTRACE --rm -it debian:bullseye bash
https://salsa.debian.org/jas/gssproxy/-/blob/master/debian/tests/gssproxy-apache
Anyway, I'm closing this since I don't think it is a gssproxy issue. Sorry for the noise.
from gssproxy.
Sorry not having used debian for many years now I do not know if that distribution makes any assumption on how to run apache. At a glance I see nothing out of the ordinary.
from gssproxy.
Related Issues (20)
- Reference that libidmap interface is not implemented and that one hat to use the krb5.conf for id-mapping requirements. HOT 4
- Add a document with all the options gss-proxy accept and their meaning HOT 1
- krb5 traces missing from journald logs at debug level 3
- A "usermode" to use gssproxy with flatpaks
- User mode proxy should quit after a short timeout
- [0.9.0] doesn't allow disabled systemd HOT 8
- gssproxy 0.9.0 exits when idle and crashes HOT 3
- Multi-homed NFS client does not select correct service principal HOT 13
- gssproxy breaks no_root_squash export option with knfsd HOT 2
- Crash in gssrpc_xdr_free() HOT 9
- Make check failed to execute normally. HOT 2
- Figure out how to proxy multiple ticket caches
- error messages from kerberos are not logged HOT 1
- Can we get a 0.9.2 release? HOT 1
- Variable substitution for hostname / FDQN HOT 5
- Autoconf complains about obsolete options HOT 4
- The gp_workers_free function in gp_workers.c has a wrong param issue HOT 1
- The purpose of Encrypted/Credentials/v1@X-GSSPROXY:
- static idmapping is working different whe gssproxy is installed on the nfs server HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gssproxy.