Re: [SSSD] [PATCH] Collect krb5 trace on high debug levels

2012-10-12 Thread Jakub Hrozek
On Thu, Oct 11, 2012 at 03:21:21PM +0200, Ondrej Kos wrote: > >>I would much prefer finding a different way to do the logging; > >>perhaps we could have the krb5_child log to krb5_child.$USER.log > >>instead? > > > >You're right, that wasn't my brightest patch. > > > >I've checked the krb5 API agai

Re: [SSSD] [PATCH] Collect krb5 trace on high debug levels

2012-10-11 Thread Ondrej Kos
On 10/09/2012 07:15 PM, Jakub Hrozek wrote: On Tue, Oct 02, 2012 at 10:53:54AM -0400, Stephen Gallagher wrote: On 10/02/2012 09:32 AM, Jakub Hrozek wrote: https://fedorahosted.org/sssd/ticket/1539 If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set Kerberos tracing with krb5_

Re: [SSSD] [PATCH] Collect krb5 trace on high debug levels

2012-10-09 Thread Jakub Hrozek
On Tue, Oct 02, 2012 at 10:53:54AM -0400, Stephen Gallagher wrote: > On 10/02/2012 09:32 AM, Jakub Hrozek wrote: > >https://fedorahosted.org/sssd/ticket/1539 > > > >If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set > >Kerberos tracing with krb5_set_trace_filename. > > > >There's

Re: [SSSD] [PATCH] Collect krb5 trace on high debug levels

2012-10-02 Thread Stephen Gallagher
On 10/02/2012 09:32 AM, Jakub Hrozek wrote: https://fedorahosted.org/sssd/ticket/1539 If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set Kerberos tracing with krb5_set_trace_filename. There's one catch, though. The krb5_child and ldap_child logs are only writable by root, but

[SSSD] [PATCH] Collect krb5 trace on high debug levels

2012-10-02 Thread Jakub Hrozek
https://fedorahosted.org/sssd/ticket/1539 If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set Kerberos tracing with krb5_set_trace_filename. There's one catch, though. The krb5_child and ldap_child logs are only writable by root, but the krb5_child process drops privileges to th