gssapi / gssapi/gssproxy

Httpd has no permission to access /var/lib/gssproxy/default.sock

Open
#118 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
54
Forks
32
Avg merge
3d 2h
Merged PRs (30d)
2

Description

The directory /var/lib/gssproxy is listed in StateDirectory, and the permission will be changed to 0700 after starting gssproxy.service because of StateDirectoryMode=0700. Httpd's children run by user apache, they can't access /var/lib/gssproxy/default.sock.
https://github.com/gssapi/gssproxy/blob/main/systemd/gssproxy.service.in#L8
```

httpd.log.14723:connect(5, {sa_family=AF_UNIX, sun_path="/var/lib/gssproxy/default.sock"}, 110) = -1 EACCES (Permission denied)
httpd.log.14725:connect(13, {sa_family=AF_UNIX, sun_path="/var/lib/gssproxy/default.sock"}, 110) = -1 EACCES (Permission denied)
```

```

[root@localhost ~]# getfacl /var/lib/gssproxy
getfacl: Removing leading '/' from absolute path names
# file: var/lib/gssproxy
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

[root@localhost ~]# systemctl start gssproxy
[root@localhost ~]# getfacl /var/lib/gssproxy
getfacl: Removing leading '/' from absolute path names
# file: var/lib/gssproxy
# owner: root
# group: root
user::rwx
group::---
other::---
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.