search

htcondor / scitokens-credmon

HTCondor implementation of the Scitokens credential monitor
Apache License 2.0
3 stars 7 forks source link

webserver should write temp tokens, credmon should move and own tokens #11

Open jasoncpatton opened 5 years ago

jasoncpatton commented 5 years ago

The webserver should never run as root, but we should secure user's tokens by owning them as root (or HTCondor's real uid). The credmon should be forked by the credd, so it will be running as the correct uid. Current idea: The webserver writes tokens to a temp directory and then pings the credmon (how?) to move and own the tokens into the SEC_CREDENTIAL_DIRECTORY.

jasoncpatton commented 5 years ago

This problem goes a little deeper than first thought. The real issue is that there needs to be two-way, secure communications between all of the daemons involved -- the CredD, the CredMon, and the OAuthCredMon Flask app. Here's the list of what needs to needs to be sent securely that cannot be done without the Flask app running as root or using an underprivileged directory to store credentials (and other items):

  1. From CredD to Flask app: OAuth client_secrets (i.e. the "key file")
  2. From Flask app to CredMon: OAuth tokens

I'm considering writing a full design doc to help elicit feedback, but here's my current thinking:

We can always add more endpoints to the Flask app. For (1), have the CredD send the key file ClassAds over HTTPS. We can use filesystem authentication to prove that requests are coming from a rootly CredD. Similarly, for (2), have the CredD request a token pickup directory to have the CredMon watch* from the Flask app when it is launched. Again, use the filesystem to authenticate that the request is coming from a root-owned process.

*The biggest question remaining is how to have the CredMon watch a directory such that tokens are transferred ASAP to the SEC_CREDENTIAL_DIRECTORY after being written. First thought is to use inotify or (failing that) frequent polling. However, the python-inotify RHEL package is from an older implementation that is no longer being maintained (based on the Issues list, it's broken starting with Python 3.5) rather than a more current implementation. Another option would be allow some way for the Flask app to send the CredD or CredMon a command. One way to do this would be to drop the CredMon's euid to whatever the Flask app is running as so that the Flask app can send the CredMon a signal.

jasoncpatton commented 5 years ago

Working out of https://github.com/jasoncpatton/scitokens-credmon/tree/secure_creddir for this, will set up a PR after some commits.