{"action":"created","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3407","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3407/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3407/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3407/events","html_url":"https://github.com/cockpit-project/cockpit/issues/3407","id":124739003,"number":3407,"title":"GSS-PROXY support","user":{"login":"abbra","id":2066,"avatar_url":"https://avatars.githubusercontent.com/u/2066?v=3","gravatar_id":"","url":"https://api.github.com/users/abbra","html_url":"https://github.com/abbra","followers_url":"https://api.github.com/users/abbra/followers","following_url":"https://api.github.com/users/abbra/following{/other_user}","gists_url":"https://api.github.com/users/abbra/gists{/gist_id}","starred_url":"https://api.github.com/users/abbra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abbra/subscriptions","organizations_url":"https://api.github.com/users/abbra/orgs","repos_url":"https://api.github.com/users/abbra/repos","events_url":"https://api.github.com/users/abbra/events{/privacy}","received_events_url":"https://api.github.com/users/abbra/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-04T11:07:20Z","updated_at":"2016-01-04T11:12:52Z","closed_at":null,"body":"Cockpit session helper does not work with gss-proxy due to the way it calls into GSSAPI.\r\n\r\nWhen gss-proxy is installed, it provides an interposer plugin in GSSAPI. Upon first use of GSSAPI, the library loads all interposer plugins and runs them. An interposer plugin has ability to route GSSAPI calls differently. In case of gss-proxy, the plugin first checks if GSS_USE_PROXY environmental variable is set to (1, true, or yes) and then activates the processing. To check environmental variables the interposer plugin uses secure_getenv() which returns NULL for applications where effective uid and gid are not the same as real uid and gid.\r\n\r\nAs result, even if GSS_USE_PROXY is set to 'yes', gss-proxy interposer plugin considers it cannot work with cockpit-session.\r\n\r\nWe need to change this situation because when gss-proxy is in use, cockpit does not need to access any keytab directly and we can keep HTTP/hostname@REALM keytab in possession of gss-proxy, without copying it into /etc/krb5.keytab. The latter is certainly a security issue for FreeIPA.\r\n"},"comment":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/comments/168648795","html_url":"https://github.com/cockpit-project/cockpit/issues/3407#issuecomment-168648795","issue_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3407","id":168648795,"user":{"login":"stefwalter","id":795070,"avatar_url":"https://avatars.githubusercontent.com/u/795070?v=3","gravatar_id":"","url":"https://api.github.com/users/stefwalter","html_url":"https://github.com/stefwalter","followers_url":"https://api.github.com/users/stefwalter/followers","following_url":"https://api.github.com/users/stefwalter/following{/other_user}","gists_url":"https://api.github.com/users/stefwalter/gists{/gist_id}","starred_url":"https://api.github.com/users/stefwalter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefwalter/subscriptions","organizations_url":"https://api.github.com/users/stefwalter/orgs","repos_url":"https://api.github.com/users/stefwalter/repos","events_url":"https://api.github.com/users/stefwalter/events{/privacy}","received_events_url":"https://api.github.com/users/stefwalter/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T11:12:52Z","updated_at":"2016-01-04T11:12:52Z","body":"Any ideas on how to change this? Why is an environment variable used here? setuid programs (like cockpit-session) should not trust their environment, and typically clear it wholesale when starting."}}