| MUNGE_CTX(3) | MUNGE Uid 'N' Gid Emporium | MUNGE_CTX(3) |
munge_ctx_create, munge_ctx_copy, munge_ctx_destroy, munge_ctx_strerror, munge_ctx_get, munge_ctx_set - MUNGE context functions
#include <munge.h> munge_ctx_t munge_ctx_create (void); munge_ctx_t munge_ctx_copy (munge_ctx_t ctx); void munge_ctx_destroy (munge_ctx_t ctx); const char * munge_ctx_strerror (munge_ctx_t ctx); munge_err_t munge_ctx_get (munge_ctx_t ctx, munge_opt_t opt, ...); munge_err_t munge_ctx_set (munge_ctx_t ctx, munge_opt_t opt, ...); cc `pkg-config --cflags --libs munge` -o foo foo.c
The munge_ctx_create() function creates and returns a new MUNGE context, or NULL on error.
The munge_ctx_copy() function copies the context ctx and returns a new MUNGE context, or NULL on error.
The munge_ctx_destroy() function destroys the context ctx.
The munge_ctx_strerror() function returns a descriptive text string describing the MUNGE error number according to the context ctx, or NULL if no error condition exists. This may provide a more detailed error message than that returned by munge_strerror().
The munge_ctx_get() function gets the value for the option opt associated with the MUNGE context ctx, storing the result in the subsequent pointer argument. If the result is a string, that string should not be freed or modified by the caller.
The munge_ctx_set() function sets the value for the option opt associated with the MUNGE context ctx, using the value of the subsequent argument.
The munge_ctx_create() and munge_ctx_copy() functions return a newly allocated MUNGE context, or NULL on error.
The munge_ctx_strerror() function returns a pointer to a NUL-terminated constant text string, or NULL if no error condition exists. This string should not be freed or modified by the caller.
The munge_ctx_get() and munge_ctx_set() functions return EMUNGE_SUCCESS on success, or a MUNGE error number otherwise.
The following context options can be queried via munge_ctx_get() or specified via munge_ctx_set(). The type following each enumeration is the variable type used for the subsequent argument in munge_ctx_set(), or the variable type of a pointer used for the subsequent argument in munge_ctx_get().
Credentials can be encrypted using the secret key shared by all munged daemons within a security realm. Anyone having access to this key can use it to decrypt a credential, thereby bypassing any restrictions being imposed by munged.
The message authentication code (MAC) is a required component of the credential; consequently, it cannot be disabled.
If a compression type is specified, a payload-bearing credential will be compressed accordingly. However, if the resulting compressed data is larger than the original uncompressed data, the uncompressed data will be restored and compression will be disabled for that credential.
The time-to-live value specifies the number of seconds after the encode-time that the credential is considered valid. In addition to specifying an integer value, the following types are available.
The UID and GID restrictions can be used to restrict the decoding of the credential based on the effective user and group ID of the requesting process. In addition to specifying an integer value, the following types are available.
Refer to munge(3) for a complete list of errors.
The following example program illustrates the use of the MUNGE context to query the location of the munged domain socket.
#include <stdio.h> /* for printf() */
#include <stdlib.h> /* for exit() */
#include <munge.h>
int
main (int argc, char *argv[])
{
munge_ctx_t ctx;
munge_err_t err;
char *str;
if (!(ctx = munge_ctx_create ())) {
fprintf (stderr, "ERROR: Unable to create MUNGE context\n");
exit (1);
}
err = munge_ctx_get (ctx, MUNGE_OPT_SOCKET, &str);
if (err != EMUNGE_SUCCESS) {
fprintf (stderr, "ERROR: %s\n", munge_ctx_strerror (ctx));
exit (1);
}
printf ("socket=%s\n", str);
/*
* Note that 'str' is not to be free()d since
* it points to a string within the 'ctx'.
*/
munge_ctx_destroy (ctx);
exit (0);
}
Abandoning a new or copied MUNGE context without destroying it will result in a memory leak.
The context passed to munge_encode() is treated read-only except for the error message that is set when an error is returned. The context passed to munge_decode() is set according to the context used to encode the credential; however, on error, its settings may be in a state which is invalid for encoding. Consequently, separate contexts should be used for encoding and decoding.
A context should not be shared between threads unless it is protected by a mutex; however, a better alternative is to use a separate context (or two) for each thread, either by creating a new one via munge_ctx_create() or copying an existing one via munge_ctx_copy().
Chris Dunlap <cdunlap@llnl.gov>
Copyright (C) 2007-2017 Lawrence Livermore National Security, LLC.
Copyright (C) 2002-2007 The Regents of the University of California.
MUNGE is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
Additionally for the MUNGE library (libmunge), you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
munge(1), remunge(1), unmunge(1), munge(3), munge_enum(3), munge(7), munged(8).
https://dun.github.io/munge/
| 2017-09-26 | munge-0.5.13 |