[19238] in Kerberos_V5_Development
Re: krb5.conf and 32 vs 64-bit plugins
daemon@ATHENA.MIT.EDU (Roland Mainz)
Fri Aug 14 09:02:36 2015
MIME-Version: 1.0
In-Reply-To: <55CDE28D.8060202@oracle.com>
Date: Fri, 14 Aug 2015 15:02:20 +0200
Message-ID: <CAEwwj8_DkCsd297Y-1gEx7_U1qdzPdL6QpyJ_p-TBXhSmkWdyg@mail.gmail.com>
From: Roland Mainz <rmainz@redhat.com>
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 14 August 2015 at 14:43, Tomas Kuthan <tomas.kuthan@oracle.com> wrote:
> Hi team,
>
> in Solaris we deliver 32-bit Kerberos libraries under /usr/lib and 64-bit
> libraries under /usr/lib/64. The same holds for plugins, which reside in
> /usr/lib/krb5/plugins and /usr/lib/64/krb5/plugins respectively.
>
> Specifying a plugin in krb5.conf works fine when relative paths and default
> plugin_base_dir are used. The plugin_base_dir defaults to
> /usr/lib/krb5/plugins on 32-bit and to /usr/lib/64/krb5/plugins on 64-bit
> and plugins with the correct ISA are used.
>
> Things start falling apart, when user would like to either specify full path
> to the plugin or set a non-default plugin_base_dir in their krb5.conf. In
> that case only one of the paths can be specified in krb5.conf, meaning
> plugins would fail dlopen-ing on the other architecture.
Note that KRB5_CONF and KRB5_KDC_PROFILE can be a (POSIX-shell style)
$PATH, so in *theory* you could provide ISA-specifc configs that
way... :-)
> We would like to solve that by supporting $ISA place holder in the path,
> that would translate to '/64/' on 64-bit and to '/' on 32-bit. Hence the
> following (artificial) example would work fine for both:
>
> module = pkinit:/lib/$ISA/site/preauth/pkinit.so
>
> Would MIT be willing to accept a patch implementing something along these
> lines?
>
> If yes, I would prepare a platform-independent fix.
> FYI, attached is a quick unix-only patch.
IMHO it would be better to look at the options provided by the POSIX
standard (e.g. see $ ksh -c 'builtin uname ; uname --help #) for a
list of keys.
Otherwise it will be tricky from the scripting (or any POSIX API-based
application) to figure out the correct values (remember, there isn't
only 32bit and 64bit, for example on Solaris/SPARC you have more
architectural choices (see $ isalist # output and the isaexec stuff))
- unless you want to either hardcode the values for every possible
combination OR limit the choices to 32bit vs. 64bit (not wise - see
SPARC example).
----
Bye,
Roland
--
__ . . __
(o.\ \/ /.o) rmainz@redhat.com
\__\/\/__/ IPA/Identity Management/Kerberos 5
/O /==\ O\
(;O/ \/ \O;)
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
