Skip to content

Commit 9f160b3

Browse files
committed
cmd/initContainer,utils/utils: added a check for kcm-socket
When configuring kerberos, it was assumed the sssd-kcm service and corresponding socket were active. Which is not necessarily true, as it can be disabled and not exist. #1771 Signed-off-by: om <omhpurohit@gmail.com>
1 parent 52ef378 commit 9f160b3

2 files changed

Lines changed: 54 additions & 0 deletions

File tree

src/cmd/initContainer.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -565,6 +565,16 @@ func configureKerberos() error {
565565
return nil
566566
}
567567

568+
kcmSocketEnabled, err := utils.IsKCMSocketEnabled()
569+
if err != nil {
570+
return fmt.Errorf("failed to check if kcm socket is enabled: %w", err)
571+
}
572+
if !kcmSocketEnabled {
573+
logrus.Debugf("%s: kcm socket not enabled", logPrefix)
574+
logrus.Debugf("%s: skipping", logPrefix)
575+
return nil
576+
}
577+
568578
var builder strings.Builder
569579
builder.WriteString("# Written by Toolbx\n")
570580
builder.WriteString("# https://containertoolbx.org/\n")

src/pkg/utils/utils.go

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package utils
1818

1919
import (
20+
"bufio"
2021
"errors"
2122
"fmt"
2223
"os"
@@ -892,3 +893,46 @@ func ResolveContainerAndImageNames(container, distroCLI, imageCLI, releaseCLI st
892893

893894
return container, image, release, nil
894895
}
896+
897+
// IsKCMSocketEnabled checks if the KCM cache is enabled or not, by verifying the unix domain socket used
898+
// by kcm exists. Normally, the default path is - /var/run/.heim_org.h5l.kcm-socket.
899+
//
900+
// However, we should be vary that this path is configurable. It can be overriden by setting the
901+
// kcm_socket field in the [libdefaults] section to point to the new path, inside /etc/krb5.conf.
902+
func IsKCMSocketEnabled() (bool, error) {
903+
kcmSocketPath := "/var/run/.heim_org.h5l.kcm-socket"
904+
905+
file, err := os.Open("/etc/krb5.conf")
906+
if err != nil && !errors.Is(err, os.ErrNotExist) {
907+
return false, err
908+
} else if err == nil {
909+
defer file.Close()
910+
911+
scanner := bufio.NewScanner(file)
912+
insideLibdefaultsSection := false
913+
914+
for scanner.Scan() {
915+
text := strings.TrimSpace(scanner.Text())
916+
if strings.HasPrefix(text, "[") {
917+
insideLibdefaultsSection = text == "[libdefaults]"
918+
continue
919+
}
920+
921+
if insideLibdefaultsSection {
922+
parts := strings.SplitN(text, "=", 2)
923+
if len(parts) == 2 && strings.TrimSpace(parts[0]) == "kcm_socket" {
924+
kcmSocketPath = strings.TrimSpace(parts[1])
925+
}
926+
}
927+
}
928+
}
929+
930+
info, err := os.Stat(kcmSocketPath)
931+
if err != nil && !errors.Is(err, os.ErrNotExist) {
932+
return false, err
933+
} else if errors.Is(err, os.ErrNotExist) {
934+
return false, nil
935+
}
936+
937+
return info.Mode()&os.ModeSocket != 0, nil
938+
}

0 commit comments

Comments
 (0)