[19237] in Kerberos_V5_Development
krb5.conf and 32 vs 64-bit plugins
daemon@ATHENA.MIT.EDU (Tomas Kuthan)
Fri Aug 14 08:44:20 2015
Message-ID: <55CDE28D.8060202@oracle.com>
Date: Fri, 14 Aug 2015 14:43:57 +0200
From: Tomas Kuthan <tomas.kuthan@oracle.com>
MIME-Version: 1.0
To: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="------------000003000108080001080902"
Errors-To: krbdev-bounces@mit.edu
This is a multi-part message in MIME format.
--------------000003000108080001080902
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Hi team,
in Solaris we deliver 32-bit Kerberos libraries under /usr/lib and
64-bit libraries under /usr/lib/64. The same holds for plugins, which
reside in /usr/lib/krb5/plugins and /usr/lib/64/krb5/plugins respectively.
Specifying a plugin in krb5.conf works fine when relative paths and
default plugin_base_dir are used. The plugin_base_dir defaults to
/usr/lib/krb5/plugins on 32-bit and to /usr/lib/64/krb5/plugins on
64-bit and plugins with the correct ISA are used.
Things start falling apart, when user would like to either specify full
path to the plugin or set a non-default plugin_base_dir in their
krb5.conf. In that case only one of the paths can be specified in
krb5.conf, meaning plugins would fail dlopen-ing on the other architecture.
We would like to solve that by supporting $ISA place holder in the path,
that would translate to '/64/' on 64-bit and to '/' on 32-bit. Hence the
following (artificial) example would work fine for both:
module = pkinit:/lib/$ISA/site/preauth/pkinit.so
Would MIT be willing to accept a patch implementing something along
these lines?
If yes, I would prepare a platform-independent fix.
FYI, attached is a quick unix-only patch.
Thanks,
Tomas
--------------000003000108080001080902
Content-Type: text/x-patch;
name="plugins_isa.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="plugins_isa.patch"
diff -pur old/src/lib/krb5/krb/plugin.c new/src/lib/krb5/krb/plugin.c
--- old/src/lib/krb5/krb/plugin.c 2015-05-08 16:27:02.000000000 -0700
+++ new/src/lib/krb5/krb/plugin.c 2015-08-13 08:23:45.452248239 -0700
@@ -91,6 +91,33 @@ free_mapping_list(struct plugin_mapping
free(list);
}
+#include <sys/types.h>
+#ifdef _LP64
+#define ISA_DIR "/64/"
+#else
+#define ISA_DIR "/"
+#endif
+#define ISA "/$ISA/"
+
+/*
+ * Substitutes $ISA placeholder for architecture dependent path.
+ * "/$ISA/" --> "/64/" on 64-bit
+ * --> "/" on 32-bit
+ * Operates in place, assumes |real_path| <= |path_with_$ISA|.
+ */
+static void
+substitute_isa(char *path)
+{
+ char *isa;
+ size_t len = strlen(path);
+ while ((isa = strstr(path, ISA)) != NULL) {
+ memcpy(isa, ISA_DIR, sizeof (ISA_DIR));
+ memmove(isa + sizeof (ISA_DIR) - 2,
+ isa + sizeof (ISA) - 2,
+ len - (isa - path + sizeof (ISA) - 3));
+ }
+}
+
/* Construct a plugin mapping object. path may be NULL (for a built-in
* module), or may be relative to the plugin base directory. */
static krb5_error_code
@@ -100,6 +127,7 @@ make_plugin_mapping(krb5_context context
{
krb5_error_code ret;
struct plugin_mapping *map = NULL;
+ char *fullpath;
/* Create the mapping entry. */
map = k5alloc(sizeof(*map), &ret);
@@ -112,6 +140,7 @@ make_plugin_mapping(krb5_context context
if (path != NULL) {
if (k5_path_join(context->plugin_base_dir, path, &map->dyn_path))
goto oom;
+ substitute_isa(map->dyn_path);
}
map->module = module;
*map_out = map;
--------------000003000108080001080902
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--------------000003000108080001080902--
