mart-w/kanidm
1
0
Fork 0
mirror of https://github.com/kanidm/kanidm.git synced 2025-02-23 12:37:00 +01:00
Code Issues Actions 16 Packages Projects Releases Wiki Activity

Fix block_on in ssh authorised keys (#1752)

Browse source
This commit is contained in:
Firstyear 2023-06-19 15:02:09 +10:00 committed by GitHub
parent 5e428c29e9
commit 32a7200305
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
platform/opensuse/kanidm-unixd-tasks.service
View file

@ -11,7 +11,6 @@ After=chronyd.service ntpd.service network-online.target kanidm-unixd.service
User=root User=root
Type=simple Type=simple
ExecStart=/usr/sbin/kanidm_unixd_tasks ExecStart=/usr/sbin/kanidm_unixd_tasks
KillSignal=SIGINT
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
# SystemCallFilter=@aio @basic-io @chown @file-system @io-event @network-io @sync # SystemCallFilter=@aio @basic-io @chown @file-system @io-event @network-io @sync

1
platform/opensuse/kanidm-unixd.service
View file

@ -14,7 +14,6 @@ RuntimeDirectory=kanidm-unixd
Type=simple Type=simple
ExecStart=/usr/sbin/kanidm_unixd ExecStart=/usr/sbin/kanidm_unixd
KillSignal=SIGINT
# Implied by dynamic user. # Implied by dynamic user.
# ProtectHome= # ProtectHome=

1
platform/opensuse/kanidmd.service
View file

@ -13,7 +13,6 @@ DynamicUser=yes
UMask=0027 UMask=0027
StateDirectory=kanidm StateDirectory=kanidm
ExecStart=/usr/sbin/kanidmd server -c /etc/kanidm/server.toml ExecStart=/usr/sbin/kanidmd server -c /etc/kanidm/server.toml
KillSignal=SIGINT
NoNewPrivileges=true NoNewPrivileges=true
PrivateTmp=true PrivateTmp=true

3
unix_integration/src/client.rs
View file

@ -50,12 +50,15 @@ impl ClientCodec {
/// Makes a call to kanidm_unixd via a unix socket at `path` /// Makes a call to kanidm_unixd via a unix socket at `path`
pub async fn call_daemon(path: &str, req: ClientRequest) -> Result<ClientResponse, Box<dyn Error>> { pub async fn call_daemon(path: &str, req: ClientRequest) -> Result<ClientResponse, Box<dyn Error>> {
trace!(?path, ?req);
let stream = UnixStream::connect(path).await?; let stream = UnixStream::connect(path).await?;
trace!("connected");
let mut reqs = Framed::new(stream, ClientCodec::new()); let mut reqs = Framed::new(stream, ClientCodec::new());
reqs.send(req).await?; reqs.send(req).await?;
reqs.flush().await?; reqs.flush().await?;
trace!("flushed, waiting ...");
match reqs.next().await { match reqs.next().await {
Some(Ok(res)) => { Some(Ok(res)) => {

5
unix_integration/src/daemon.rs
View file

@ -58,6 +58,7 @@ impl Decoder for ClientCodec {
type Item = ClientRequest; type Item = ClientRequest;
fn decode(&mut self, src: &mut BytesMut) -> Result<Option<Self::Item>, Self::Error> { fn decode(&mut self, src: &mut BytesMut) -> Result<Option<Self::Item>, Self::Error> {
trace!("Attempting to decode request ...");
match serde_json::from_slice::<ClientRequest>(src) { match serde_json::from_slice::<ClientRequest>(src) {
Ok(msg) => { Ok(msg) => {
// Clear the buffer for the next message. // Clear the buffer for the next message.
@ -73,7 +74,7 @@ impl Encoder<ClientResponse> for ClientCodec {
type Error = io::Error; type Error = io::Error;
fn encode(&mut self, msg: ClientResponse, dst: &mut BytesMut) -> Result<(), Self::Error> { fn encode(&mut self, msg: ClientResponse, dst: &mut BytesMut) -> Result<(), Self::Error> {
debug!("Attempting to send response -> {:?} ...", msg); trace!("Attempting to send response -> {:?} ...", msg);
let data = serde_json::to_vec(&msg).map_err(|e| { let data = serde_json::to_vec(&msg).map_err(|e| {
error!("socket encoding error -> {:?}", e); error!("socket encoding error -> {:?}", e);
io::Error::new(io::ErrorKind::Other, "JSON encode error") io::Error::new(io::ErrorKind::Other, "JSON encode error")
@ -194,9 +195,9 @@ async fn handle_client(
task_channel_tx: &Sender<AsyncTaskRequest>, task_channel_tx: &Sender<AsyncTaskRequest>,
) -> Result<(), Box<dyn Error>> { ) -> Result<(), Box<dyn Error>> {
debug!("Accepted connection"); debug!("Accepted connection");
let mut reqs = Framed::new(sock, ClientCodec::new()); let mut reqs = Framed::new(sock, ClientCodec::new());
trace!("Waiting for requests ...");
while let Some(Ok(req)) = reqs.next().await { while let Some(Ok(req)) = reqs.next().await {
let resp = match req { let resp = match req {
ClientRequest::SshKey(account_id) => { ClientRequest::SshKey(account_id) => {

3
unix_integration/src/ssh_authorizedkeys.rs
View file

@ -17,7 +17,6 @@ use std::path::PathBuf;
use std::process::ExitCode; use std::process::ExitCode;
use clap::Parser; use clap::Parser;
use futures::executor::block_on;
use kanidm_unix_common::client::call_daemon; use kanidm_unix_common::client::call_daemon;
use kanidm_unix_common::constants::DEFAULT_CONFIG_PATH; use kanidm_unix_common::constants::DEFAULT_CONFIG_PATH;
use kanidm_unix_common::unix_config::KanidmUnixdConfig; use kanidm_unix_common::unix_config::KanidmUnixdConfig;
@ -66,7 +65,7 @@ async fn main() -> ExitCode {
} }
let req = ClientRequest::SshKey(opt.account_id); let req = ClientRequest::SshKey(opt.account_id);
match block_on(call_daemon(cfg.sock_path.as_str(), req)) { match call_daemon(cfg.sock_path.as_str(), req).await {
Ok(r) => match r { Ok(r) => match r {
ClientResponse::SshKeys(sk) => sk.iter().for_each(|k| { ClientResponse::SshKeys(sk) => sk.iter().for_each(|k| {
println!("{}", k); println!("{}", k);