diff options
| author | Weston Andros Adamson <dros@netapp.com> | 2013-10-28 08:26:37 -0400 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2013-10-28 08:26:37 -0400 |
| commit | 74de1431adebb7780a2c4b9c122050e2fb7608b8 (patch) | |
| tree | 3616f10797fede1a107291efce2803bd21258ab3 /utils/exportfs/exportfs.c | |
| parent | 8a5da2b392bc25feb58a9de11cac411f5f8473bb (diff) | |
| download | nfs-utils-74de1431adebb7780a2c4b9c122050e2fb7608b8.tar.gz nfs-utils-74de1431adebb7780a2c4b9c122050e2fb7608b8.tar.xz nfs-utils-74de1431adebb7780a2c4b9c122050e2fb7608b8.zip | |
gssd: validate cred in gssd_acquire_user_cred
Call gss_inquire_cred after gssd_acquire_krb5_cred check for expired
credentials.
This fixes a recent regression (since 302de786930a2c533068f9d8909a)
that causes the user's ticket cache to grow unbounded with expired
service tickets when the user's credentials expire.
To reproduce this issue:
- mount kerberos nfs export
- kinit for a short lifetime (ie "kinit -l 1m")
- run a job that opens a file and writes for more than the lifetime
- run klist a few times after expiry and see the list grow, ie:
Ticket cache: DIR::/run/user/1749600001/krb5cc/tktYmpGlX
Default principal: dros@APIKIA.FAKE
Valid starting Expires Service principal
10/21/2013 15:39:38 10/21/2013 15:40:35 krbtgt/APIKIA.FAKE@APIKIA.FAKE
10/21/2013 15:39:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
Diffstat (limited to 'utils/exportfs/exportfs.c')
0 files changed, 0 insertions, 0 deletions