diff options
21 files changed, 43 insertions, 2812 deletions
diff --git a/0001-In-ksu-merge-krb5_ccache_copy-and-_restricted.patch b/0001-In-ksu-merge-krb5_ccache_copy-and-_restricted.patch deleted file mode 100644 index ac7baa1..0000000 --- a/0001-In-ksu-merge-krb5_ccache_copy-and-_restricted.patch +++ /dev/null @@ -1,230 +0,0 @@ -From 74e775ac6d937c9d22be4fc1d429e5e62705fb7d Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@redhat.com> -Date: Thu, 24 Jul 2014 15:39:53 -0400 -Subject: [PATCH 1/7] In ksu, merge krb5_ccache_copy() and _restricted() - -Other than whether or not they limit the creds it stores to the new -ccache based on the principal name of the client for whom the creds were -issued, there's no meaningful difference between what these two -functions do. Merge them. ---- - src/clients/ksu/ccache.c | 106 ++++++----------------------------------------- - src/clients/ksu/ksu.h | 6 +-- - src/clients/ksu/main.c | 27 ++++-------- - 3 files changed, 22 insertions(+), 117 deletions(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index 9916c75..118fc53 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -47,12 +47,14 @@ void show_credential(); - */ - - krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, -- primary_principal, cc_out, stored, target_uid) -+ primary_principal, restrict_creds, cc_out, -+ stored, target_uid) - /* IN */ - krb5_context context; - krb5_ccache cc_def; - char *cc_other_tag; - krb5_principal primary_principal; -+ krb5_boolean restrict_creds; - uid_t target_uid; - /* OUT */ - krb5_ccache *cc_out; -@@ -83,9 +85,6 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - } - } - -- *stored = krb5_find_princ_in_cred_list(context, cc_def_creds_arr, -- primary_principal); -- - if (!lstat( cc_other_name, &st_temp)) - return EINVAL; - -@@ -98,8 +97,16 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - return retval; - } - -- retval = krb5_store_all_creds(context, * cc_other, cc_def_creds_arr, -- cc_other_creds_arr); -+ if (restrict_creds) { -+ retval = krb5_store_some_creds(context, *cc_other, cc_def_creds_arr, -+ cc_other_creds_arr, primary_principal, -+ stored); -+ } else { -+ *stored = krb5_find_princ_in_cred_list(context, cc_def_creds_arr, -+ primary_principal); -+ retval = krb5_store_all_creds(context, *cc_other, cc_def_creds_arr, -+ cc_other_creds_arr); -+ } - - if (cc_def_creds_arr){ - while (cc_def_creds_arr[i]){ -@@ -623,93 +630,6 @@ krb5_error_code krb5_store_some_creds(context, cc, creds_def, creds_other, prst, - *stored = temp_stored; - return 0; - } --/****************************************************************** --krb5_cache_copy_restricted -- --gets rid of any expired tickets in the secondary cache, --copies the default cache into the secondary cache, --only credentials that are for prst are copied. -- --the algorithm may look a bit funny, --but I had to do it this way, since cc_remove function did not come --with k5 beta 3 release. --************************************************************************/ -- --krb5_error_code krb5_ccache_copy_restricted (context, cc_def, cc_other_tag, -- prst, cc_out, stored, target_uid) -- krb5_context context; -- krb5_ccache cc_def; -- char *cc_other_tag; -- krb5_principal prst; -- uid_t target_uid; -- /* OUT */ -- krb5_ccache *cc_out; -- krb5_boolean *stored; --{ -- -- int i=0; -- krb5_ccache * cc_other; -- const char * cc_def_name; -- const char * cc_other_name; -- krb5_error_code retval=0; -- krb5_creds ** cc_def_creds_arr = NULL; -- krb5_creds ** cc_other_creds_arr = NULL; -- struct stat st_temp; -- -- cc_other = (krb5_ccache *) xcalloc(1, sizeof (krb5_ccache)); -- -- if ((retval = krb5_cc_resolve(context, cc_other_tag, cc_other))){ -- com_err(prog_name, retval, _("resolving ccache %s"), cc_other_tag); -- return retval; -- } -- -- cc_def_name = krb5_cc_get_name(context, cc_def); -- cc_other_name = krb5_cc_get_name(context, *cc_other); -- -- if ( ! stat(cc_def_name, &st_temp)){ -- if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){ -- return retval; -- } -- -- } -- -- if (!lstat( cc_other_name, &st_temp)) { -- return EINVAL; -- } -- -- if (krb5_seteuid(0)||krb5_seteuid(target_uid)) { -- return errno; -- } -- -- -- if ((retval = krb5_cc_initialize(context, *cc_other, prst))){ -- return retval; -- } -- -- retval = krb5_store_some_creds(context, * cc_other, -- cc_def_creds_arr, cc_other_creds_arr, prst, stored); -- -- -- -- if (cc_def_creds_arr){ -- while (cc_def_creds_arr[i]){ -- krb5_free_creds(context, cc_def_creds_arr[i]); -- i++; -- } -- } -- -- i=0; -- -- if(cc_other_creds_arr){ -- while (cc_other_creds_arr[i]){ -- krb5_free_creds(context, cc_other_creds_arr[i]); -- i++; -- } -- } -- -- *cc_out = *cc_other; -- return retval; --} - - krb5_error_code krb5_ccache_filter (context, cc, prst) - krb5_context context; -diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h -index f2c0811..9e0c613 100644 ---- a/src/clients/ksu/ksu.h -+++ b/src/clients/ksu/ksu.h -@@ -107,7 +107,7 @@ extern krb5_error_code get_best_principal - /* ccache.c */ - extern krb5_error_code krb5_ccache_copy - (krb5_context, krb5_ccache, char *, krb5_principal, -- krb5_ccache *, krb5_boolean *, uid_t); -+ krb5_boolean, krb5_ccache *, krb5_boolean *, uid_t); - - extern krb5_error_code krb5_store_all_creds - (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **); -@@ -141,10 +141,6 @@ extern krb5_error_code krb5_store_some_creds - (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **, - krb5_principal, krb5_boolean *); - --extern krb5_error_code krb5_ccache_copy_restricted --(krb5_context, krb5_ccache, char *, krb5_principal, -- krb5_ccache *, krb5_boolean *, uid_t); -- - extern krb5_error_code krb5_ccache_refresh - (krb5_context, krb5_ccache); - -diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 233eb52..62f3bc0 100644 ---- a/src/clients/ksu/main.c -+++ b/src/clients/ksu/main.c -@@ -117,6 +117,7 @@ main (argc, argv) - krb5_principal kdc_server; - krb5_boolean zero_password; - char * dir_of_cc_target; -+ krb5_boolean restrict_creds; - - options.opt = KRB5_DEFAULT_OPTIONS; - options.lifetime = KRB5_DEFAULT_TKT_LIFE; -@@ -464,25 +465,13 @@ main (argc, argv) - then only the credentials for that particular user - should be copied */ - -- if ((source_uid == 0) && (target_uid != 0)) { -- -- if ((retval = krb5_ccache_copy_restricted(ksu_context, cc_source, -- cc_target_tag, client, -- &cc_target, &stored, -- target_uid))){ -- com_err(prog_name, retval, _("while copying cache %s to %s"), -- krb5_cc_get_name(ksu_context, cc_source), cc_target_tag); -- exit(1); -- } -- -- } else { -- if ((retval = krb5_ccache_copy(ksu_context, cc_source, cc_target_tag, -- client,&cc_target, &stored, target_uid))) { -- com_err(prog_name, retval, _("while copying cache %s to %s"), -- krb5_cc_get_name(ksu_context, cc_source), cc_target_tag); -- exit(1); -- } -- -+ restrict_creds = (source_uid == 0) && (target_uid != 0); -+ retval = krb5_ccache_copy(ksu_context, cc_source, cc_target_tag, client, -+ restrict_creds, &cc_target, &stored, target_uid); -+ if (retval) { -+ com_err(prog_name, retval, _("while copying cache %s to %s"), -+ krb5_cc_get_name(ksu_context, cc_source), cc_target_tag); -+ exit(1); - } - - /* Become root for authentication*/ --- -2.0.4 - diff --git a/0002-In-ksu-don-t-stat-not-on-disk-ccache-residuals.patch b/0002-In-ksu-don-t-stat-not-on-disk-ccache-residuals.patch deleted file mode 100644 index 262e7c7..0000000 --- a/0002-In-ksu-don-t-stat-not-on-disk-ccache-residuals.patch +++ /dev/null @@ -1,369 +0,0 @@ -From 9ebae7cb434b9b177c0af85c67a6d6267f46bc68 Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@redhat.com> -Date: Fri, 1 Nov 2013 09:48:13 -0400 -Subject: [PATCH 2/7] In ksu, don't stat() not-on-disk ccache residuals - -Don't assume that ccache residual names are filenames which we can -stat() usefully. Instead, use helper functions to call the library -routines to try to read the default principal name from caches, and -use whether or not that succeeds as an indication of whether or not -there's a ccache in a given location. - -ticket: 7728 ---- - src/clients/ksu/ccache.c | 60 ++++++++++++++++++++-------------- - src/clients/ksu/heuristic.c | 13 ++------ - src/clients/ksu/ksu.h | 8 +++-- - src/clients/ksu/main.c | 79 +++++++++------------------------------------ - 4 files changed, 60 insertions(+), 100 deletions(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index 118fc53..5f57279 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -62,12 +62,9 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - { - int i=0; - krb5_ccache * cc_other; -- const char * cc_def_name; -- const char * cc_other_name; - krb5_error_code retval=0; - krb5_creds ** cc_def_creds_arr = NULL; - krb5_creds ** cc_other_creds_arr = NULL; -- struct stat st_temp; - - cc_other = (krb5_ccache *) xcalloc(1, sizeof (krb5_ccache)); - -@@ -76,16 +73,13 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - return retval; - } - -- cc_def_name = krb5_cc_get_name(context, cc_def); -- cc_other_name = krb5_cc_get_name(context, *cc_other); -- -- if ( ! stat(cc_def_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, cc_def)) { - if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){ - return retval; - } - } - -- if (!lstat( cc_other_name, &st_temp)) -+ if (ks_ccache_name_is_initialized(context, cc_other_tag)) - return EINVAL; - - if (krb5_seteuid(0)||krb5_seteuid(target_uid)) { -@@ -540,24 +534,18 @@ krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) - krb5_ccache cct; - krb5_principal primary_principal; - { -- const char * cct_name; -- const char * ccs_name; - krb5_error_code retval=0; - krb5_principal temp_principal; - krb5_creds ** ccs_creds_arr = NULL; - int i=0; -- struct stat st_temp; - -- ccs_name = krb5_cc_get_name(context, ccs); -- cct_name = krb5_cc_get_name(context, cct); -- -- if ( ! stat(ccs_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, ccs)) { - if ((retval = krb5_get_nonexp_tkts(context, ccs, &ccs_creds_arr))){ - return retval; - } - } - -- if ( ! stat(cct_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, cct)) { - if ((retval = krb5_cc_get_principal(context, cct, &temp_principal))){ - return retval; - } -@@ -643,12 +631,10 @@ krb5_error_code krb5_ccache_filter (context, cc, prst) - krb5_creds ** cc_creds_arr = NULL; - const char * cc_name; - krb5_boolean stored; -- struct stat st_temp; - - cc_name = krb5_cc_get_name(context, cc); - -- if ( ! stat(cc_name, &st_temp)){ -- -+ if (ks_ccache_is_initialized(context, cc)) { - if (auth_debug) { - fprintf(stderr,"putting cache %s through a filter for -z option\n", cc_name); - } -@@ -713,12 +699,8 @@ krb5_error_code krb5_find_princ_in_cache (context, cc, princ, found) - { - krb5_error_code retval; - krb5_creds ** creds_list = NULL; -- const char * cc_name; -- struct stat st_temp; -- -- cc_name = krb5_cc_get_name(context, cc); - -- if ( ! stat(cc_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, cc)) { - if ((retval = krb5_get_nonexp_tkts(context, cc, &creds_list))){ - return retval; - } -@@ -727,3 +709,33 @@ krb5_error_code krb5_find_princ_in_cache (context, cc, princ, found) - *found = krb5_find_princ_in_cred_list(context, creds_list, princ); - return 0; - } -+ -+krb5_boolean -+ks_ccache_name_is_initialized(krb5_context context, const char *cctag) -+{ -+ krb5_boolean result; -+ krb5_ccache cc; -+ -+ if (krb5_cc_resolve(context, cctag, &cc) != 0) -+ return FALSE; -+ result = ks_ccache_is_initialized(context, cc); -+ krb5_cc_close(context, cc); -+ -+ return result; -+} -+ -+krb5_boolean -+ks_ccache_is_initialized(krb5_context context, krb5_ccache cc) -+{ -+ krb5_principal princ; -+ krb5_error_code retval; -+ -+ if (cc == NULL) -+ return FALSE; -+ -+ retval = krb5_cc_get_principal(context, cc, &princ); -+ if (retval == 0) -+ krb5_free_principal(context, princ); -+ -+ return retval == 0; -+} -diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c -index 99b54e5..f73b8eb 100644 ---- a/src/clients/ksu/heuristic.c -+++ b/src/clients/ksu/heuristic.c -@@ -397,12 +397,8 @@ krb5_error_code find_either_ticket (context, cc, client, end_server, found) - krb5_principal kdc_server; - krb5_error_code retval; - krb5_boolean temp_found = FALSE; -- const char * cc_source_name; -- struct stat st_temp; - -- cc_source_name = krb5_cc_get_name(context, cc); -- -- if ( ! stat(cc_source_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, cc)) { - - retval = find_ticket(context, cc, client, end_server, &temp_found); - if (retval) -@@ -539,7 +535,6 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, - { - - princ_info princ_trials[10]; -- const char * cc_source_name; - krb5_principal cc_def_princ = NULL; - krb5_principal temp_client; - krb5_principal target_client; -@@ -551,7 +546,6 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, - struct stat tb; - int count =0; - int i; -- struct stat st_temp; - - *path_out = 0; - -@@ -559,10 +553,7 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, - if (options->princ) - return 0; - -- cc_source_name = krb5_cc_get_name(context, cc_source); -- -- -- if (! stat(cc_source_name, &st_temp)) { -+ if (ks_ccache_is_initialized(context, cc_source)) { - retval = krb5_cc_get_principal(context, cc_source, &cc_def_princ); - if (retval) - return retval; -diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h -index 9e0c613..e1e34f1 100644 ---- a/src/clients/ksu/ksu.h -+++ b/src/clients/ksu/ksu.h -@@ -141,6 +141,12 @@ extern krb5_error_code krb5_store_some_creds - (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **, - krb5_principal, krb5_boolean *); - -+extern krb5_boolean ks_ccache_name_is_initialized -+(krb5_context, const char *); -+ -+extern krb5_boolean ks_ccache_is_initialized -+(krb5_context, krb5_ccache); -+ - extern krb5_error_code krb5_ccache_refresh - (krb5_context, krb5_ccache); - -@@ -198,8 +204,6 @@ extern int standard_shell (char *); - - extern krb5_error_code get_params (int *, int, char **, char ***); - --extern char *get_dir_of_file (const char *); -- - /* heuristic.c */ - extern krb5_error_code get_all_princ_from_file (FILE *, char ***); - -diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 62f3bc0..8c49f94 100644 ---- a/src/clients/ksu/main.c -+++ b/src/clients/ksu/main.c -@@ -51,7 +51,6 @@ static void print_status( const char *fmt, ...) - __attribute__ ((__format__ (__printf__, 1, 2))) - #endif - ; --char * get_dir_of_file(); - - /* Note -e and -a options are mutually exclusive */ - /* insure the proper specification of target user as well as catching -@@ -96,7 +95,6 @@ main (argc, argv) - const char * cc_source_tag = NULL; - uid_t source_gid; - const char * cc_source_tag_tmp = NULL; -- char * cc_target_tag_tmp=NULL; - char * cmd = NULL, * exec_cmd = NULL; - int errflg = 0; - krb5_boolean auth_val; -@@ -112,11 +110,9 @@ main (argc, argv) - extern char * getpass(), *crypt(); - int pargc; - char ** pargv; -- struct stat st_temp; - krb5_boolean stored = FALSE; - krb5_principal kdc_server; - krb5_boolean zero_password; -- char * dir_of_cc_target; - krb5_boolean restrict_creds; - - options.opt = KRB5_DEFAULT_OPTIONS; -@@ -266,9 +262,10 @@ main (argc, argv) - if ( strchr(cc_source_tag, ':')){ - cc_source_tag_tmp = strchr(cc_source_tag, ':') + 1; - -- if( stat( cc_source_tag_tmp, &st_temp)){ -+ if (!ks_ccache_name_is_initialized(ksu_context, -+ cc_source_tag)) { - com_err(prog_name, errno, -- _("while looking for credentials file %s"), -+ _("while looking for credentials cache %s"), - cc_source_tag_tmp); - exit (1); - } -@@ -419,32 +416,18 @@ main (argc, argv) - exit(1); - } - -- if (cc_target_tag == NULL) { -- -- cc_target_tag = (char *)xcalloc(KRB5_SEC_BUFFSIZE ,sizeof(char)); -- /* make sure that the new ticket file does not already exist -- This is run as source_uid because it is reasonable to -- require the source user to have write to where the target -- cache will be created.*/ -- -- do { -- snprintf(cc_target_tag, KRB5_SEC_BUFFSIZE, "%s%ld.%d", -- KRB5_SECONDARY_CACHE, -- (long) target_uid, gen_sym()); -- cc_target_tag_tmp = strchr(cc_target_tag, ':') + 1; -- -- }while ( !stat ( cc_target_tag_tmp, &st_temp)); -- } -- -- -- dir_of_cc_target = get_dir_of_file(cc_target_tag_tmp); -- -- if (access(dir_of_cc_target, R_OK | W_OK )){ -- fprintf(stderr, -- _("%s does not have correct permissions for %s\n"), -- source_user, cc_target_tag); -- exit(1); -- } -+ /* -+ * Make sure that the new ticket file does not already exist. -+ * This is run as source_uid because it is reasonable to -+ * require the source user to have write to where the target -+ * cache will be created. -+ */ -+ cc_target_tag = (char *)xcalloc(KRB5_SEC_BUFFSIZE, sizeof(char)); -+ do { -+ snprintf(cc_target_tag, KRB5_SEC_BUFFSIZE, "%s%ld.%d", -+ KRB5_SECONDARY_CACHE, -+ (long)target_uid, gen_sym()); -+ } while (ks_ccache_name_is_initialized(ksu_context, cc_target_tag)); - - if (auth_debug){ - fprintf(stderr, " source cache = %s\n", cc_source_tag); -@@ -747,13 +730,6 @@ main (argc, argv) - exit(1); - } - -- if (access( cc_target_tag_tmp, R_OK | W_OK )){ -- com_err(prog_name, errno, -- _("%s does not have correct permissions for %s, %s aborted"), -- target_user, cc_target_tag_tmp, prog_name); -- exit(1); -- } -- - if ( cc_source) - krb5_cc_close(ksu_context, cc_source); - -@@ -873,8 +849,6 @@ static void sweep_up(context, cc) - krb5_ccache cc; - { - krb5_error_code retval; -- const char * cc_name; -- struct stat st_temp; - - krb5_seteuid(0); - if (krb5_seteuid(target_uid) < 0) { -@@ -883,8 +857,7 @@ static void sweep_up(context, cc) - exit(1); - } - -- cc_name = krb5_cc_get_name(context, cc); -- if ( ! stat(cc_name, &st_temp)){ -+ if (ks_ccache_is_initialized(context, cc)) { - if ((retval = krb5_cc_destroy(context, cc))) - com_err(prog_name, retval, _("while destroying cache")); - } -@@ -937,26 +910,6 @@ void print_status(const char *fmt, ...) - } - } - -- --char *get_dir_of_file(path) -- const char *path; --{ -- char * temp_path; -- char * ptr; -- -- temp_path = xstrdup(path); -- -- if ((ptr = strrchr( temp_path, '/'))) { -- *ptr = '\0'; -- } else { -- free (temp_path); -- temp_path = xmalloc(MAXPATHLEN); -- if (temp_path) -- getcwd(temp_path, MAXPATHLEN); -- } -- return temp_path; --} -- - krb5_error_code - ksu_tgtname(context, server, client, tgtprinc) - krb5_context context; --- -2.0.4 - diff --git a/0003-Use-an-intermediate-memory-cache-in-ksu.patch b/0003-Use-an-intermediate-memory-cache-in-ksu.patch deleted file mode 100644 index 4bef600..0000000 --- a/0003-Use-an-intermediate-memory-cache-in-ksu.patch +++ /dev/null @@ -1,417 +0,0 @@ -From dccc80a469b1925fcfe7697406a69912efe4baa1 Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@dahyabhai.net> -Date: Wed, 30 Oct 2013 21:45:35 -0400 -Subject: [PATCH 3/7] Use an intermediate memory cache in ksu - -Instead of copying source or obtained creds into the target cache and -changing ownership if everything succeeds, copy them into a MEMORY: -cache and then, if everything succeeds, create the target cache as the -target user. - -We no longer need to clean up the temporary ccache when exiting in -most error cases. - -Use a fake principal name ("_ksu/_ksu@_ksu") as the primary holder of -the temporary cache so that we won't accidentally select it when we -make a subsequent call to krb5_cc_cache_match() (to be added in a -later patch) to find the target location where the creds should be -stored for use while running as the target user. ---- - src/clients/ksu/ccache.c | 10 +-- - src/clients/ksu/ksu.h | 4 +- - src/clients/ksu/main.c | 156 ++++++++++++++++++++++++----------------------- - 3 files changed, 87 insertions(+), 83 deletions(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index 5f57279..d0fc389 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -47,14 +47,15 @@ void show_credential(); - */ - - krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, -- primary_principal, restrict_creds, cc_out, -- stored, target_uid) -+ primary_principal, restrict_creds, -+ target_principal, cc_out, stored, target_uid) - /* IN */ - krb5_context context; - krb5_ccache cc_def; - char *cc_other_tag; - krb5_principal primary_principal; - krb5_boolean restrict_creds; -+ krb5_principal target_principal; - uid_t target_uid; - /* OUT */ - krb5_ccache *cc_out; -@@ -86,10 +87,9 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - return errno; - } - -- -- if ((retval = krb5_cc_initialize(context, *cc_other, primary_principal))){ -+ retval = krb5_cc_initialize(context, *cc_other, target_principal); -+ if (retval) - return retval; -- } - - if (restrict_creds) { - retval = krb5_store_some_creds(context, *cc_other, cc_def_creds_arr, -diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h -index e1e34f1..08bf01b 100644 ---- a/src/clients/ksu/ksu.h -+++ b/src/clients/ksu/ksu.h -@@ -106,8 +106,8 @@ extern krb5_error_code get_best_principal - - /* ccache.c */ - extern krb5_error_code krb5_ccache_copy --(krb5_context, krb5_ccache, char *, krb5_principal, -- krb5_boolean, krb5_ccache *, krb5_boolean *, uid_t); -+(krb5_context, krb5_ccache, char *, krb5_principal, krb5_boolean, -+ krb5_principal, krb5_ccache *, krb5_boolean *, uid_t); - - extern krb5_error_code krb5_store_all_creds - (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **); -diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 8c49f94..d1bb8ca 100644 ---- a/src/clients/ksu/main.c -+++ b/src/clients/ksu/main.c -@@ -42,10 +42,13 @@ char * gb_err = NULL; - int quiet = 0; - /***********/ - -+#define KS_TEMPORARY_CACHE "MEMORY:_ksu" -+#define KS_TEMPORARY_PRINC "_ksu/_ksu@_ksu" - #define _DEF_CSH "/bin/csh" - static int set_env_var (char *, char *); - static void sweep_up (krb5_context, krb5_ccache); - static char * ontty (void); -+static krb5_error_code set_ccname_env(krb5_context, krb5_ccache); - static void print_status( const char *fmt, ...) - #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7) - __attribute__ ((__format__ (__printf__, 1, 2))) -@@ -84,8 +87,8 @@ main (argc, argv) - int option=0; - int statusp=0; - krb5_error_code retval = 0; -- krb5_principal client = NULL; -- krb5_ccache cc_target = NULL; -+ krb5_principal client = NULL, tmp_princ = NULL; -+ krb5_ccache cc_tmp = NULL, cc_target = NULL; - krb5_context ksu_context; - char * cc_target_tag = NULL; - char * target_user = NULL; -@@ -93,7 +96,6 @@ main (argc, argv) - - krb5_ccache cc_source = NULL; - const char * cc_source_tag = NULL; -- uid_t source_gid; - const char * cc_source_tag_tmp = NULL; - char * cmd = NULL, * exec_cmd = NULL; - int errflg = 0; -@@ -342,8 +344,6 @@ main (argc, argv) - /* allocate space and copy the usernamane there */ - source_user = xstrdup(pwd->pw_name); - source_uid = pwd->pw_uid; -- source_gid = pwd->pw_gid; -- - - if (!strcmp(SOURCE_USER_LOGIN, target_user)){ - target_user = xstrdup (source_user); -@@ -435,25 +435,32 @@ main (argc, argv) - } - - /* -- Only when proper authentication and authorization -- takes place, the target user becomes the owner of the cache. -- */ -- -- /* we continue to run as source uid until -- the middle of the copy, when becomewe become the target user -- The cache is owned by the target user.*/ -+ * After proper authentication and authorization, populate a cache for the -+ * target user. -+ */ - -+ /* -+ * We read the set of creds we want to copy from the source ccache as the -+ * source uid, become root for authentication, and then become the target -+ * user to handle authorization and creating the target user's cache. -+ */ - - /* if root ksu's to a regular user, then - then only the credentials for that particular user - should be copied */ - - restrict_creds = (source_uid == 0) && (target_uid != 0); -- retval = krb5_ccache_copy(ksu_context, cc_source, cc_target_tag, client, -- restrict_creds, &cc_target, &stored, target_uid); -+ retval = krb5_parse_name(ksu_context, KS_TEMPORARY_PRINC, &tmp_princ); -+ if (retval) { -+ com_err(prog_name, retval, _("while parsing temporary name")); -+ exit(1); -+ } -+ retval = krb5_ccache_copy(ksu_context, cc_source, KS_TEMPORARY_CACHE, -+ client, restrict_creds, tmp_princ, &cc_tmp, -+ &stored, 0); - if (retval) { - com_err(prog_name, retval, _("while copying cache %s to %s"), -- krb5_cc_get_name(ksu_context, cc_source), cc_target_tag); -+ krb5_cc_get_name(ksu_context, cc_source), KS_TEMPORARY_CACHE); - exit(1); - } - -@@ -473,7 +480,6 @@ main (argc, argv) - &kdc_server))){ - com_err(prog_name, retval, - _("while creating tgt for local realm")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -@@ -481,13 +487,12 @@ main (argc, argv) - "enter it here and are logged\n")); - fprintf(stderr, _(" in remotely using an unsecure " - "(non-encrypted) channel.\n")); -- if (krb5_get_tkt_via_passwd (ksu_context, &cc_target, client, -- kdc_server, &options, -- &zero_password) == FALSE){ -+ if (krb5_get_tkt_via_passwd(ksu_context, &cc_tmp, client, -+ kdc_server, &options, -+ &zero_password) == FALSE){ - - if (zero_password == FALSE){ - fprintf(stderr, _("Goodbye\n")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -@@ -506,48 +511,20 @@ main (argc, argv) - if (source_uid && (source_uid != target_uid)) { - char * client_name; - -- auth_val = krb5_auth_check(ksu_context, client, localhostname, &options, -- target_user,cc_target, &path_passwd, target_uid); -+ auth_val = krb5_auth_check(ksu_context, client, localhostname, -+ &options, target_user, cc_tmp, -+ &path_passwd, target_uid); - - /* if Kerberos authentication failed then exit */ - if (auth_val ==FALSE){ - fprintf(stderr, _("Authentication failed.\n")); - syslog(LOG_WARNING, "'%s %s' authentication failed for %s%s", - prog_name,target_user,source_user,ontty()); -- sweep_up(ksu_context, cc_target); - exit(1); - } - --#if 0 -- /* At best, this avoids a single kdc request -- It is hard to implement dealing with file permissions and -- is unnecessary. It is important -- to properly handle races in chown if this code is ever re-enabled. -- */ -- /* cache the tickets if possible in the source cache */ -- if (!path_passwd){ -- -- if ((retval = krb5_ccache_overwrite(ksu_context, cc_target, cc_source, -- client))){ -- com_err (prog_name, retval, -- "while copying cache %s to %s", -- krb5_cc_get_name(ksu_context, cc_target), -- krb5_cc_get_name(ksu_context, cc_source)); -- sweep_up(ksu_context, cc_target); -- exit(1); -- } -- if (chown(cc_source_tag_tmp, source_uid, source_gid)){ -- com_err(prog_name, errno, -- "while changing owner for %s", -- cc_source_tag_tmp); -- exit(1); -- } -- } --#endif /*0*/ -- - if ((retval = krb5_unparse_name(ksu_context, client, &client_name))) { - com_err(prog_name, retval, _("When unparsing name")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -@@ -560,7 +537,6 @@ main (argc, argv) - if (krb5_seteuid(target_uid)) { - com_err(prog_name, errno, _("while switching to target for " - "authorization check")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -@@ -568,14 +544,12 @@ main (argc, argv) - cmd, &authorization_val, &exec_cmd))){ - com_err(prog_name,retval, _("while checking authorization")); - krb5_seteuid(0); /*So we have some chance of sweeping up*/ -- sweep_up(ksu_context, cc_target); - exit(1); - } - - if (krb5_seteuid(0)) { - com_err(prog_name, errno, _("while switching back from target " - "after authorization check")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - if (authorization_val == TRUE){ -@@ -617,25 +591,25 @@ main (argc, argv) - - } - -- sweep_up(ksu_context, cc_target); - exit(1); - } - } - - if( some_rest_copy){ -- if ((retval = krb5_ccache_filter(ksu_context, cc_target, client))){ -+ retval = krb5_ccache_filter(ksu_context, cc_tmp, client); -+ if (retval) { - com_err(prog_name,retval, _("while calling cc_filter")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - } - - if (all_rest_copy){ -- if ((retval = krb5_cc_initialize(ksu_context, cc_target, client))){ -+ retval = krb5_cc_initialize(ksu_context, cc_tmp, tmp_princ); -+ if (retval) { - com_err(prog_name, retval, _("while erasing target cache")); - exit(1); - } -- -+ stored = FALSE; - } - - /* get the shell of the user, this will be the shell used by su */ -@@ -653,7 +627,6 @@ main (argc, argv) - - if (!standard_shell(target_pwd->pw_shell) && source_uid) { - fprintf(stderr, _("ksu: permission denied (shell).\n")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - #endif /* HAVE_GETUSERSHELL */ -@@ -663,43 +636,28 @@ main (argc, argv) - if(set_env_var("USER", target_pwd->pw_name)){ - fprintf(stderr, - _("ksu: couldn't set environment variable USER\n")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - } - - if(set_env_var( "HOME", target_pwd->pw_dir)){ - fprintf(stderr, _("ksu: couldn't set environment variable HOME\n")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - - if(set_env_var( "SHELL", shell)){ - fprintf(stderr, _("ksu: couldn't set environment variable SHELL\n")); -- sweep_up(ksu_context, cc_target); -- exit(1); -- } -- -- /* set the cc env name to target */ -- -- if(set_env_var( KRB5_ENV_CCNAME, cc_target_tag)){ -- fprintf(stderr, _("ksu: couldn't set environment variable %s\n"), -- KRB5_ENV_CCNAME); -- sweep_up(ksu_context, cc_target); - exit(1); - } - - /* set permissions */ - if (setgid(target_pwd->pw_gid) < 0) { - perror("ksu: setgid"); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -- - if (initgroups(target_user, target_pwd->pw_gid)) { - fprintf(stderr, _("ksu: initgroups failed.\n")); -- sweep_up(ksu_context, cc_target); - exit(1); - } - -@@ -719,13 +677,36 @@ main (argc, argv) - */ - if (setluid((uid_t) pwd->pw_uid) < 0) { - perror("setluid"); -- sweep_up(ksu_context, cc_target); - exit(1); - } - #endif /* HAVE_SETLUID */ - - if (setuid(target_pwd->pw_uid) < 0) { - perror("ksu: setuid"); -+ exit(1); -+ } -+ -+ retval = krb5_ccache_copy(ksu_context, cc_tmp, cc_target_tag, -+ client, FALSE, client, &cc_target, &stored, -+ target_pwd->pw_uid); -+ if (retval) { -+ com_err(prog_name, retval, _("while copying cache %s to %s"), -+ KS_TEMPORARY_CACHE, cc_target_tag); -+ exit(1); -+ } -+ -+ if (stored && !ks_ccache_is_initialized(ksu_context, cc_target)) { -+ com_err(prog_name, errno, -+ _("%s does not have correct permissions for %s, %s aborted"), -+ target_user, cc_target_tag, prog_name); -+ exit(1); -+ } -+ -+ free(cc_target_tag); -+ -+ /* Set the cc env name to target. */ -+ retval = set_ccname_env(ksu_context, cc_target); -+ if (retval != 0) { - sweep_up(ksu_context, cc_target); - exit(1); - } -@@ -799,6 +780,29 @@ main (argc, argv) - } - } - -+/* Set KRB5CCNAME in the environment to point to ccache. Print an error -+ * message on failure. */ -+static krb5_error_code -+set_ccname_env(krb5_context ksu_context, krb5_ccache ccache) -+{ -+ krb5_error_code retval; -+ char *ccname; -+ -+ retval = krb5_cc_get_full_name(ksu_context, ccache, &ccname); -+ if (retval) { -+ com_err(prog_name, retval, _("while reading cache name from ccache")); -+ return retval; -+ } -+ if (set_env_var(KRB5_ENV_CCNAME, ccname)) { -+ retval = errno; -+ fprintf(stderr, -+ _("ksu: couldn't set environment variable %s\n"), -+ KRB5_ENV_CCNAME); -+ } -+ krb5_free_string(ksu_context, ccname); -+ return retval; -+} -+ - #ifdef HAVE_GETUSERSHELL - - int standard_shell(sh) --- -2.0.4 - diff --git a/0004-Make-ksu-respect-the-default_ccache_name-setting.patch b/0004-Make-ksu-respect-the-default_ccache_name-setting.patch deleted file mode 100644 index cb45f1b..0000000 --- a/0004-Make-ksu-respect-the-default_ccache_name-setting.patch +++ /dev/null @@ -1,378 +0,0 @@ -From 3a456898af626dcab4e1ab0749ca2ccb9ad6162b Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@dahyabhai.net> -Date: Wed, 30 Oct 2013 21:47:14 -0400 -Subject: [PATCH 4/7] Make ksu respect the default_ccache_name setting - -Move the logic for resolving and initializing a cache that we're -copying creds into out of krb5_ccache_copy(), and let the caller deal -with it. Add a helper functions to select/resolve an output ccache in -the default location for the target user after we've switched to the -target user's privileges. If the destination is a collection, take -care not to change which subsidiary is its primary, and reuse a -subsidiary cache if we can. If the destination is not a collection, -append a unique value to its name to make a new ccache. - -[ghudson@mit.edu: some changes to variable names and comments; move -responsibility for getting target ccache name from -resolve_target_ccache to main] - -ticket: 7984 (new) ---- - src/clients/ksu/ccache.c | 35 +++------ - src/clients/ksu/ksu.h | 6 +- - src/clients/ksu/main.c | 181 ++++++++++++++++++++++++++++++++++++++--------- - 3 files changed, 157 insertions(+), 65 deletions(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index d0fc389..4693bd4 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -46,59 +46,41 @@ void show_credential(); - with k5 beta 3 release. - */ - --krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, -- primary_principal, restrict_creds, -- target_principal, cc_out, stored, target_uid) -+krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, -+ restrict_creds, primary_principal, stored) - /* IN */ - krb5_context context; - krb5_ccache cc_def; -- char *cc_other_tag; -- krb5_principal primary_principal; -- krb5_boolean restrict_creds; - krb5_principal target_principal; -- uid_t target_uid; -+ krb5_ccache cc_target; -+ krb5_boolean restrict_creds; -+ krb5_principal primary_principal; - /* OUT */ -- krb5_ccache *cc_out; - krb5_boolean *stored; - { - int i=0; -- krb5_ccache * cc_other; - krb5_error_code retval=0; - krb5_creds ** cc_def_creds_arr = NULL; - krb5_creds ** cc_other_creds_arr = NULL; - -- cc_other = (krb5_ccache *) xcalloc(1, sizeof (krb5_ccache)); -- -- if ((retval = krb5_cc_resolve(context, cc_other_tag, cc_other))){ -- com_err(prog_name, retval, _("resolving ccache %s"), cc_other_tag); -- return retval; -- } -- - if (ks_ccache_is_initialized(context, cc_def)) { - if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){ - return retval; - } - } - -- if (ks_ccache_name_is_initialized(context, cc_other_tag)) -- return EINVAL; -- -- if (krb5_seteuid(0)||krb5_seteuid(target_uid)) { -- return errno; -- } -- -- retval = krb5_cc_initialize(context, *cc_other, target_principal); -+ retval = krb5_cc_initialize(context, cc_target, target_principal); - if (retval) - return retval; - - if (restrict_creds) { -- retval = krb5_store_some_creds(context, *cc_other, cc_def_creds_arr, -+ retval = krb5_store_some_creds(context, cc_target, cc_def_creds_arr, - cc_other_creds_arr, primary_principal, - stored); - } else { - *stored = krb5_find_princ_in_cred_list(context, cc_def_creds_arr, - primary_principal); -- retval = krb5_store_all_creds(context, *cc_other, cc_def_creds_arr, -+ retval = krb5_store_all_creds(context, cc_target, cc_def_creds_arr, - cc_other_creds_arr); - } - -@@ -118,7 +100,6 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag, - } - } - -- *cc_out = *cc_other; - return retval; - } - -diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h -index 08bf01b..fbbf217 100644 ---- a/src/clients/ksu/ksu.h -+++ b/src/clients/ksu/ksu.h -@@ -44,8 +44,6 @@ - #define KRB5_DEFAULT_OPTIONS 0 - #define KRB5_DEFAULT_TKT_LIFE 60*60*12 /* 12 hours */ - --#define KRB5_SECONDARY_CACHE "FILE:/tmp/krb5cc_" -- - #define KRB5_LOGIN_NAME ".k5login" - #define KRB5_USERS_NAME ".k5users" - #define USE_DEFAULT_REALM_NAME "." -@@ -106,8 +104,8 @@ extern krb5_error_code get_best_principal - - /* ccache.c */ - extern krb5_error_code krb5_ccache_copy --(krb5_context, krb5_ccache, char *, krb5_principal, krb5_boolean, -- krb5_principal, krb5_ccache *, krb5_boolean *, uid_t); -+(krb5_context, krb5_ccache, krb5_principal, krb5_ccache, -+ krb5_boolean, krb5_principal, krb5_boolean *); - - extern krb5_error_code krb5_store_all_creds - (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **); -diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index d1bb8ca..41a3bf8 100644 ---- a/src/clients/ksu/main.c -+++ b/src/clients/ksu/main.c -@@ -54,6 +54,10 @@ static void print_status( const char *fmt, ...) - __attribute__ ((__format__ (__printf__, 1, 2))) - #endif - ; -+static krb5_error_code resolve_target_cache(krb5_context ksu_context, -+ krb5_principal princ, -+ krb5_ccache *ccache_out, -+ krb5_boolean *ccache_reused); - - /* Note -e and -a options are mutually exclusive */ - /* insure the proper specification of target user as well as catching -@@ -112,7 +116,7 @@ main (argc, argv) - extern char * getpass(), *crypt(); - int pargc; - char ** pargv; -- krb5_boolean stored = FALSE; -+ krb5_boolean stored = FALSE, cc_reused = FALSE; - krb5_principal kdc_server; - krb5_boolean zero_password; - krb5_boolean restrict_creds; -@@ -416,23 +420,8 @@ main (argc, argv) - exit(1); - } - -- /* -- * Make sure that the new ticket file does not already exist. -- * This is run as source_uid because it is reasonable to -- * require the source user to have write to where the target -- * cache will be created. -- */ -- cc_target_tag = (char *)xcalloc(KRB5_SEC_BUFFSIZE, sizeof(char)); -- do { -- snprintf(cc_target_tag, KRB5_SEC_BUFFSIZE, "%s%ld.%d", -- KRB5_SECONDARY_CACHE, -- (long)target_uid, gen_sym()); -- } while (ks_ccache_name_is_initialized(ksu_context, cc_target_tag)); -- -- if (auth_debug){ -+ if (auth_debug) - fprintf(stderr, " source cache = %s\n", cc_source_tag); -- fprintf(stderr, " target cache = %s\n", cc_target_tag); -- } - - /* - * After proper authentication and authorization, populate a cache for the -@@ -455,14 +444,19 @@ main (argc, argv) - com_err(prog_name, retval, _("while parsing temporary name")); - exit(1); - } -- retval = krb5_ccache_copy(ksu_context, cc_source, KS_TEMPORARY_CACHE, -- client, restrict_creds, tmp_princ, &cc_tmp, -- &stored, 0); -+ retval = krb5_cc_resolve(ksu_context, KS_TEMPORARY_CACHE, &cc_tmp); -+ if (retval) { -+ com_err(prog_name, retval, _("while creating temporary cache")); -+ exit(1); -+ } -+ retval = krb5_ccache_copy(ksu_context, cc_source, tmp_princ, cc_tmp, -+ restrict_creds, client, &stored); - if (retval) { - com_err(prog_name, retval, _("while copying cache %s to %s"), - krb5_cc_get_name(ksu_context, cc_source), KS_TEMPORARY_CACHE); - exit(1); - } -+ krb5_cc_close(ksu_context, cc_source); - - /* Become root for authentication*/ - -@@ -686,23 +680,38 @@ main (argc, argv) - exit(1); - } - -- retval = krb5_ccache_copy(ksu_context, cc_tmp, cc_target_tag, -- client, FALSE, client, &cc_target, &stored, -- target_pwd->pw_uid); -+ retval = resolve_target_cache(ksu_context, client, &cc_target, &cc_reused); -+ if (retval) -+ exit(1); -+ retval = krb5_cc_get_full_name(ksu_context, cc_target, &cc_target_tag); - if (retval) { -- com_err(prog_name, retval, _("while copying cache %s to %s"), -- KS_TEMPORARY_CACHE, cc_target_tag); -+ com_err(prog_name, retval, _("while getting name of target ccache")); -+ sweep_up(ksu_context, cc_target); - exit(1); - } -+ if (auth_debug) -+ fprintf(stderr, " target cache = %s\n", cc_target_tag); -+ if (cc_reused) -+ keep_target_cache = TRUE; - -- if (stored && !ks_ccache_is_initialized(ksu_context, cc_target)) { -- com_err(prog_name, errno, -- _("%s does not have correct permissions for %s, %s aborted"), -- target_user, cc_target_tag, prog_name); -- exit(1); -+ if (stored) { -+ retval = krb5_ccache_copy(ksu_context, cc_tmp, client, cc_target, -+ FALSE, client, &stored); -+ if (retval) { -+ com_err(prog_name, retval, _("while copying cache %s to %s"), -+ KS_TEMPORARY_CACHE, cc_target_tag); -+ exit(1); -+ } -+ -+ if (!ks_ccache_is_initialized(ksu_context, cc_target)) { -+ com_err(prog_name, errno, -+ _("%s does not have correct permissions for %s, " -+ "%s aborted"), target_user, cc_target_tag, prog_name); -+ exit(1); -+ } - } - -- free(cc_target_tag); -+ krb5_free_string(ksu_context, cc_target_tag); - - /* Set the cc env name to target. */ - retval = set_ccname_env(ksu_context, cc_target); -@@ -711,9 +720,6 @@ main (argc, argv) - exit(1); - } - -- if ( cc_source) -- krb5_cc_close(ksu_context, cc_source); -- - if (cmd){ - if ((source_uid == 0) || (source_uid == target_uid )){ - exec_cmd = cmd; -@@ -803,6 +809,113 @@ set_ccname_env(krb5_context ksu_context, krb5_ccache ccache) - return retval; - } - -+/* -+ * Get the configured default ccache name. Unset KRB5CCNAME and force a -+ * recomputation so we don't use values for the source user. Print an error -+ * message on failure. -+ */ -+static krb5_error_code -+get_configured_defccname(krb5_context context, char **target_out) -+{ -+ krb5_error_code retval; -+ const char *defname; -+ char *target; -+ -+ *target_out = NULL; -+ -+ if (unsetenv(KRB5_ENV_CCNAME) != 0) { -+ retval = errno; -+ com_err(prog_name, retval, _("while clearing the value of %s"), -+ KRB5_ENV_CCNAME); -+ return retval; -+ } -+ -+ /* Make sure we don't have a cached value for a different uid. */ -+ retval = krb5_cc_set_default_name(context, NULL); -+ if (retval != 0) { -+ com_err(prog_name, retval, _("while resetting target ccache name")); -+ return retval; -+ } -+ -+ defname = krb5_cc_default_name(context); -+ target = (defname == NULL) ? NULL : strdup(defname); -+ if (target == NULL) { -+ com_err(prog_name, ENOMEM, _("while determining target ccache name")); -+ return ENOMEM; -+ } -+ *target_out = target; -+ return 0; -+} -+ -+/* Determine where the target user's creds should be stored. Print an error -+ * message on failure. */ -+static krb5_error_code -+resolve_target_cache(krb5_context context, krb5_principal princ, -+ krb5_ccache *ccache_out, krb5_boolean *ccache_reused) -+{ -+ krb5_error_code retval; -+ krb5_boolean switchable, reused = FALSE; -+ krb5_ccache ccache = NULL; -+ char *sep, *ccname = NULL, *target; -+ -+ *ccache_out = NULL; -+ *ccache_reused = FALSE; -+ -+ retval = get_configured_defccname(context, &target); -+ if (retval != 0) -+ return retval; -+ -+ /* Check if the configured default name uses a switchable type. */ -+ sep = strchr(target, ':'); -+ *sep = '\0'; -+ switchable = krb5_cc_support_switch(context, target); -+ *sep = ':'; -+ -+ if (!switchable) { -+ /* Try to avoid destroying an in-use target ccache by coming up with -+ * the name of a cache that doesn't exist yet. */ -+ do { -+ free(ccname); -+ if (asprintf(&ccname, "%s.%d", target, gen_sym()) < 0) { -+ retval = ENOMEM; -+ com_err(prog_name, ENOMEM, -+ _("while allocating memory for target ccache name")); -+ goto cleanup; -+ } -+ } while (ks_ccache_name_is_initialized(context, ccname)); -+ retval = krb5_cc_resolve(context, ccname, &ccache); -+ } else { -+ /* Look for a cache in the collection that we can reuse. */ -+ retval = krb5_cc_cache_match(context, princ, &ccache); -+ if (retval == 0) { -+ reused = TRUE; -+ } else { -+ /* There isn't one, so create a new one. */ -+ *sep = '\0'; -+ retval = krb5_cc_new_unique(context, target, NULL, &ccache); -+ *sep = ':'; -+ if (retval) { -+ com_err(prog_name, retval, -+ _("while creating new target ccache")); -+ goto cleanup; -+ } -+ retval = krb5_cc_initialize(context, ccache, princ); -+ if (retval) { -+ com_err(prog_name, retval, -+ _("while initializing target cache")); -+ goto cleanup; -+ } -+ } -+ } -+ -+ *ccache_out = ccache; -+ *ccache_reused = reused; -+ -+cleanup: -+ free(target); -+ return retval; -+} -+ - #ifdef HAVE_GETUSERSHELL - - int standard_shell(sh) --- -2.0.4 - diff --git a/0005-Copy-config-entries-to-the-ksu-target-ccache.patch b/0005-Copy-config-entries-to-the-ksu-target-ccache.patch deleted file mode 100644 index e004136..0000000 --- a/0005-Copy-config-entries-to-the-ksu-target-ccache.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 297496f0938955ba4aaf0ebecf4e393e527b8cbf Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@dahyabhai.net> -Date: Tue, 29 Oct 2013 16:27:20 -0400 -Subject: [PATCH 5/7] Copy config entries to the ksu target ccache - -When we try to screen out expired creds while reading them from one -ccache to eventually store in another, also keep configuration entries. - -ticket: 7986 (new) ---- - src/clients/ksu/ccache.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index 4693bd4..0f9e042 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -219,7 +219,8 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) - - while (!(retval = krb5_cc_next_cred(context, cc, &cur, &creds))){ - -- if ((retval = krb5_check_exp(context, creds.times))){ -+ if (!krb5_is_config_principal(context, creds.server) && -+ (retval = krb5_check_exp(context, creds.times))){ - if (retval != KRB5KRB_AP_ERR_TKT_EXPIRED){ - return retval; - } --- -2.0.4 - diff --git a/0006-Use-more-randomness-for-ksu-secondary-cache-names.patch b/0006-Use-more-randomness-for-ksu-secondary-cache-names.patch deleted file mode 100644 index da8a32a..0000000 --- a/0006-Use-more-randomness-for-ksu-secondary-cache-names.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 69c8e20b18577781e17c5959e23514134dfb5755 Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@redhat.com> -Date: Thu, 24 Jul 2014 16:43:21 -0400 -Subject: [PATCH 6/7] Use more randomness for ksu secondary cache names - -When generating a suffix to append to a ccache name that will hold the -credentials for a ksu-invoked process, instead of using integers -counting up from 1, use the result of base64-encoding six randomly- -generated octets. Tweak the output alphabet just a bit to avoid using -'+' or '/' in the generated names, the latter of which could really -confuse things. ---- - src/clients/ksu/ccache.c | 27 +++++++++++++++++++++++---- - src/clients/ksu/ksu.h | 2 +- - src/clients/ksu/main.c | 16 ++++++++++++---- - 3 files changed, 36 insertions(+), 9 deletions(-) - -diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index 0f9e042..a0736f2 100644 ---- a/src/clients/ksu/ccache.c -+++ b/src/clients/ksu/ccache.c -@@ -27,6 +27,7 @@ - */ - - #include "ksu.h" -+#include "k5-base64.h" - #include "adm_proto.h" - #include <sys/types.h> - #include <sys/stat.h> -@@ -504,10 +505,28 @@ show_credential(context, cred, cc) - free(sname); - } - --int gen_sym(){ -- static int i = 0; -- i ++; -- return i; -+/* Create a random string suitable for a filename extension. */ -+krb5_error_code -+gen_sym(krb5_context context, char **sym_out) -+{ -+ krb5_error_code retval; -+ char bytes[6], *p, *sym; -+ krb5_data data = make_data(bytes, sizeof(bytes)); -+ -+ *sym_out = NULL; -+ retval = krb5_c_random_make_octets(context, &data); -+ if (retval) -+ return retval; -+ sym = k5_base64_encode(data.data, data.length); -+ if (sym == NULL) -+ return ENOMEM; -+ /* Tweak the output alphabet just a bit. */ -+ while ((p = strchr(sym, '/')) != NULL) -+ *p = '_'; -+ while ((p = strchr(sym, '+')) != NULL) -+ *p = '-'; -+ *sym_out = sym; -+ return 0; - } - - krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) -diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h -index fbbf217..5ba5ceb 100644 ---- a/src/clients/ksu/ksu.h -+++ b/src/clients/ksu/ksu.h -@@ -130,7 +130,7 @@ extern krb5_error_code krb5_get_login_princ - extern void show_credential - (krb5_context, krb5_creds *, krb5_ccache); - --extern int gen_sym (void); -+krb5_error_code gen_sym(krb5_context context, char **sym); - - extern krb5_error_code krb5_ccache_overwrite - (krb5_context, krb5_ccache, krb5_ccache, krb5_principal); -diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 41a3bf8..47fa820 100644 ---- a/src/clients/ksu/main.c -+++ b/src/clients/ksu/main.c -@@ -856,7 +856,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, - krb5_error_code retval; - krb5_boolean switchable, reused = FALSE; - krb5_ccache ccache = NULL; -- char *sep, *ccname = NULL, *target; -+ char *sep, *ccname = NULL, *sym = NULL, *target; - - *ccache_out = NULL; - *ccache_reused = FALSE; -@@ -876,12 +876,20 @@ resolve_target_cache(krb5_context context, krb5_principal princ, - * the name of a cache that doesn't exist yet. */ - do { - free(ccname); -- if (asprintf(&ccname, "%s.%d", target, gen_sym()) < 0) { -+ retval = gen_sym(context, &sym); -+ if (retval) { -+ com_err(prog_name, retval, -+ _("while generating part of the target ccache name")); -+ return retval; -+ } -+ if (asprintf(&ccname, "%s.%s", target, sym) < 0) { - retval = ENOMEM; -- com_err(prog_name, ENOMEM, -- _("while allocating memory for target ccache name")); -+ free(sym); -+ com_err(prog_name, retval, _("while allocating memory for the " -+ "target ccache name")); - goto cleanup; - } -+ free(sym); - } while (ks_ccache_name_is_initialized(context, ccname)); - retval = krb5_cc_resolve(context, ccname, &ccache); - } else { --- -2.0.4 - diff --git a/0007-Make-krb5_cc_new_unique-create-DIR-directories.patch b/0007-Make-krb5_cc_new_unique-create-DIR-directories.patch deleted file mode 100644 index c0b8778..0000000 --- a/0007-Make-krb5_cc_new_unique-create-DIR-directories.patch +++ /dev/null @@ -1,37 +0,0 @@ -Context tweaked to apply to 1.12.1. - -From bca1191210eb582fe09e94486e2631d72b8a5ca5 Mon Sep 17 00:00:00 2001 -From: Nalin Dahyabhai <nalin@redhat.com> -Date: Fri, 8 Aug 2014 16:58:03 -0400 -Subject: [PATCH 7/7] Make krb5_cc_new_unique create DIR: directories - -When we use krb5_cc_new_unique to create a new cache in a directory -cache collection, we will fail if the directory doesn't exist yet. - -Go ahead and preemptively create it, as we do during krb5_cc_resolve, -before attempting to create a new file under it. - -ticket: 7988 (new) -target_version: 1.13 -tags: pullup ---- - src/lib/krb5/ccache/cc_dir.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c -index d82f335..b00a6bb 100644 ---- a/src/lib/krb5/ccache/cc_dir.c -+++ b/src/lib/krb5/ccache/cc_dir.c -@@ -401,6 +401,9 @@ dcc_gen_new(krb5_context context, krb5_ccache *cache_out) - "collection")); - return KRB5_DCC_CANNOT_CREATE; - } -+ ret = verify_dir(context, dirname); -+ if (ret) -+ goto cleanup; - ret = k5_path_join(dirname, "tktXXXXXX", &template); - if (ret) - goto cleanup; --- -2.0.4 - diff --git a/krb5-1.10-kpasswd_tcp.patch b/krb5-1.10-kpasswd_tcp.patch deleted file mode 100644 index fd8da8e..0000000 --- a/krb5-1.10-kpasswd_tcp.patch +++ /dev/null @@ -1,32 +0,0 @@ -Fall back to TCP on kdc-unresolvable/unreachable errors. We still have -to wait for UDP to fail, so this might not be ideal. RT #5868. - ---- krb5/src/lib/krb5/os/changepw.c -+++ krb5/src/lib/krb5/os/changepw.c -@@ -270,10 +270,22 @@ change_set_password(krb5_context context - &callback_info, &chpw_rep, ss2sa(&remote_addr), - &addrlen, NULL, NULL, NULL); - if (code) { -- /* -- * Here we may want to switch to TCP on some errors. -- * right? -- */ -+ /* if we're not using a stream socket, and it's an error which -+ * might reasonably be specific to a datagram "connection", try -+ * again with a stream socket */ -+ if (!use_tcp) { -+ switch (code) { -+ case KRB5_KDC_UNREACH: -+ case KRB5_REALM_CANT_RESOLVE: -+ case KRB5KRB_ERR_RESPONSE_TOO_BIG: -+ /* should we do this for more result codes than these? */ -+ k5_free_serverlist (&sl); -+ use_tcp = 1; -+ continue; -+ default: -+ break; -+ } -+ } - break; - } - diff --git a/krb5-1.10-kprop-mktemp.patch b/krb5-1.10-kprop-mktemp.patch deleted file mode 100644 index 62178df..0000000 --- a/krb5-1.10-kprop-mktemp.patch +++ /dev/null @@ -1,28 +0,0 @@ -Use an in-memory ccache to silence a compiler warning, for RT#6414. - ---- krb5/src/slave/kprop.c -+++ krb5/src/slave/kprop.c -@@ -202,9 +202,8 @@ void PRS(argc, argv) - void get_tickets(context) - krb5_context context; - { -- char buf[BUFSIZ], *def_realm; -+ char buf[] = "MEMORY:_kproptkt", *def_realm; - krb5_error_code retval; -- static char tkstring[] = "/tmp/kproptktXXXXXX"; - krb5_keytab keytab = NULL; - - /* -@@ -229,11 +228,8 @@ void get_tickets(context) - #endif - - /* -- * Initialize cache file which we're going to be using -+ * Initialize an in-memory cache for temporary use - */ -- (void) mktemp(tkstring); -- snprintf(buf, sizeof(buf), "FILE:%s", tkstring); -- - retval = krb5_cc_resolve(context, buf, &ccache); - if (retval) { - com_err(progname, retval, _("while opening credential cache %s"), buf); diff --git a/krb5-1.12-pwdch-fast.patch b/krb5-1.12-pwdch-fast.patch deleted file mode 100644 index 3b7d4bb..0000000 --- a/krb5-1.12-pwdch-fast.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 230858394d2dded001ef3d2029daa6c468aca097 Mon Sep 17 00:00:00 2001 -From: Greg Hudson <ghudson@mit.edu> -Date: Fri, 28 Feb 2014 14:49:35 -0500 -Subject: [PATCH] Use preauth options when changing password - -If we try to change the password in rb5_get_init_creds_password, we -must use all application-specified gic options which affect -preauthentication when getting the kadmin/changepw ticket. Create a -helper function make_chpw_options which copies the application's -options, unsets the options we don't want, and sets options -appropriate for a temporary ticket. - -ticket: 7868 - -npmccallum: - * include tests from 06817686bfdef99523f300464bcbb0c8b037a27d ---- - src/lib/krb5/krb/gic_pwd.c | 63 +++++++++++++++++++++++++++++++++++++--------- - src/tests/Makefile.in | 1 + - src/tests/t_changepw.py | 37 +++++++++++++++++++++++++++ - 3 files changed, 89 insertions(+), 12 deletions(-) - create mode 100644 src/tests/t_changepw.py - -diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c -index a97823f6b51b7393755e82f36612c30b64096754..6aec7c3a71f99d2194b09374b296327174e6d4b8 100644 ---- a/src/lib/krb5/krb/gic_pwd.c -+++ b/src/lib/krb5/krb/gic_pwd.c -@@ -242,6 +242,54 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, - (*prompter)(context, data, 0, banner, 0, 0); - } - -+/* -+ * Create a temporary options structure for getting a kadmin/changepw ticket, -+ * based on the appplication-specified options. Propagate all application -+ * options which affect preauthentication, but not options which affect the -+ * resulting ticket or how it is stored. Set lifetime and flags appropriate -+ * for a ticket which we will use immediately and then discard. -+ * -+ * storage1 and storage2 will be used to hold the temporary options. The -+ * caller must not free the result, as it will contain aliases into the -+ * application options. -+ */ -+static krb5_get_init_creds_opt * -+make_chpw_options(krb5_get_init_creds_opt *in, krb5_gic_opt_ext *storage1, -+ gic_opt_private *storage2) -+{ -+ krb5_gic_opt_ext *in_ext; -+ krb5_get_init_creds_opt *opt; -+ -+ /* Copy the application's options to storage. */ -+ if (in == NULL) { -+ storage1->flags = 0; -+ } else if (gic_opt_is_extended(in)) { -+ in_ext = (krb5_gic_opt_ext *)in; -+ *storage1 = *in_ext; -+ *storage2 = *in_ext->opt_private; -+ storage1->opt_private = storage2; -+ } else { -+ *(krb5_get_init_creds_opt *)storage1 = *in; -+ } -+ -+ /* Get a non-forwardable, non-proxiable, short-lifetime ticket. */ -+ opt = (krb5_get_init_creds_opt *)storage1; -+ krb5_get_init_creds_opt_set_tkt_life(opt, 5 * 60); -+ krb5_get_init_creds_opt_set_renew_life(opt, 0); -+ krb5_get_init_creds_opt_set_forwardable(opt, 0); -+ krb5_get_init_creds_opt_set_proxiable(opt, 0); -+ -+ /* Unset options which should only apply to the actual ticket. */ -+ opt->flags &= ~KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST; -+ opt->flags &= ~KRB5_GET_INIT_CREDS_OPT_ANONYMOUS; -+ -+ /* The output ccache should only be used for the actual ticket. */ -+ if (gic_opt_is_extended(opt)) -+ storage2->out_ccache = NULL; -+ -+ return opt; -+} -+ - krb5_error_code KRB5_CALLCONV - krb5_get_init_creds_password(krb5_context context, - krb5_creds *creds, -@@ -259,6 +307,8 @@ krb5_get_init_creds_password(krb5_context context, - int tries; - krb5_creds chpw_creds; - krb5_get_init_creds_opt *chpw_opts = NULL; -+ krb5_gic_opt_ext storage1; -+ gic_opt_private storage2; - struct gak_password gakpw; - krb5_data pw0, pw1; - char banner[1024], pw0array[1024], pw1array[1024]; -@@ -345,16 +395,7 @@ krb5_get_init_creds_password(krb5_context context, - /* ok, we have an expired password. Give the user a few chances - to change it */ - -- /* use a minimal set of options */ -- -- ret = krb5_get_init_creds_opt_alloc(context, &chpw_opts); -- if (ret) -- goto cleanup; -- krb5_get_init_creds_opt_set_tkt_life(chpw_opts, 5*60); -- krb5_get_init_creds_opt_set_renew_life(chpw_opts, 0); -- krb5_get_init_creds_opt_set_forwardable(chpw_opts, 0); -- krb5_get_init_creds_opt_set_proxiable(chpw_opts, 0); -- -+ chpw_opts = make_chpw_options(options, &storage1, &storage2); - ret = k5_get_init_creds(context, &chpw_creds, client, prompter, data, - start_time, "kadmin/changepw", chpw_opts, - krb5_get_as_key_password, &gakpw, &use_master, -@@ -471,8 +512,6 @@ cleanup: - warn_pw_expiry(context, options, prompter, data, in_tkt_service, - as_reply); - -- if (chpw_opts) -- krb5_get_init_creds_opt_free(context, chpw_opts); - zapfree(gakpw.storage.data, gakpw.storage.length); - memset(pw0array, 0, sizeof(pw0array)); - memset(pw1array, 0, sizeof(pw1array)); -diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index 62523895d53da24844141a6ada6cab23e77dd9e6..55f1d6419f8d924a6f9a2971d36f1eac6d293d32 100644 ---- a/src/tests/Makefile.in -+++ b/src/tests/Makefile.in -@@ -94,6 +94,7 @@ check-pytests:: t_init_creds t_localauth - $(RUNPYTEST) $(srcdir)/t_iprop.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kprop.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_policy.py $(PYTESTFLAGS) -+ $(RUNPYTEST) $(srcdir)/t_changepw.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_pkinit.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_otp.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_localauth.py $(PYTESTFLAGS) -diff --git a/src/tests/t_changepw.py b/src/tests/t_changepw.py -new file mode 100644 -index 0000000000000000000000000000000000000000..0b9832668e618b3db8d88cf388ec918898bb4df3 ---- /dev/null -+++ b/src/tests/t_changepw.py -@@ -0,0 +1,37 @@ -+#!/usr/bin/python -+from k5test import * -+ -+# This file is intended to cover any password-changing mechanism. For -+# now it only contains a regression test for #7868. -+ -+realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True) -+ -+# Mark a principal as expired and change its password through kinit. -+realm.run_kadminl('modprinc -pwexpire "1 day ago" user') -+pwinput = password('user') + '\nabcd\nabcd\n' -+realm.run([kinit, realm.user_princ], input=pwinput) -+ -+# Do the same thing with FAST, with tracing turned on. -+realm.run_kadminl('modprinc -pwexpire "1 day ago" user') -+pwinput = 'abcd\nefgh\nefgh\n' -+tracefile = os.path.join(realm.testdir, 'trace') -+realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-T', realm.ccache, -+ realm.user_princ], input=pwinput) -+ -+# Read the trace and check that FAST was used when getting the -+# kadmin/changepw ticket. -+f = open(tracefile, 'r') -+trace = f.read() -+f.close() -+getting_changepw = fast_used_for_changepw = False -+for line in trace.splitlines(): -+ if 'Getting initial credentials for user@' in line: -+ getting_changepw_ticket = False -+ if 'Setting initial creds service to kadmin/changepw' in line: -+ getting_changepw_ticket = True -+ if getting_changepw_ticket and 'Using FAST' in line: -+ fast_used_for_changepw = True -+if not fast_used_for_changepw: -+ fail('FAST was not used to get kadmin/changepw ticket') -+ -+success('Password change tests') --- -1.8.5.3 - diff --git a/krb5-1.11-dirsrv-accountlock.patch b/krb5-1.13-dirsrv-accountlock.patch index 12d201d..0a6661c 100644 --- a/krb5-1.11-dirsrv-accountlock.patch +++ b/krb5-1.13-dirsrv-accountlock.patch @@ -23,9 +23,9 @@ diff -up krb5-1.8/src/aclocal.m4.dirsrv-accountlock krb5-1.8/src/aclocal.m4 diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountlock krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c --- krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountlock 2009-11-24 18:52:25.000000000 -0500 +++ krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c 2010-03-05 11:03:10.000000000 -0500 -@@ -2101,6 +2101,22 @@ populate_krb5_db_entry(krb5_context cont - goto cleanup; - if ((st=krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data)) != 0) +@@ -1546,6 +1546,23 @@ populate_krb5_db_entry(krb5_context cont + ret = krb5_dbe_update_tl_data(context, entry, &userinfo_tl_data); + if (ret) goto cleanup; +#ifdef HAVE_DIRSRV_ACCOUNT_LOCKING + { @@ -33,8 +33,9 @@ diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountloc + char *is_login_disabled=NULL; + + /* LOGIN DISABLED */ -+ if ((st=krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled, -+ &attr_present)) != 0) ++ ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled, ++ &attr_present); ++ if (ret) + goto cleanup; + if (attr_present == TRUE) { + if (strcasecmp(is_login_disabled, "TRUE")== 0) @@ -44,7 +45,8 @@ diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c.dirsrv-accountloc + } +#endif - if ((st=krb5_read_tkt_policy (context, ldap_context, entry, tktpolname)) !=0) + ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname); + if (ret) goto cleanup; diff -up krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c.dirsrv-accountlock krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c --- krb5-1.8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c.dirsrv-accountlock 2009-11-24 18:52:25.000000000 -0500 diff --git a/krb5-1.12-selinux-label.patch b/krb5-1.13-selinux-label.patch index 395f5f7..1cd86c0 100644 --- a/krb5-1.12-selinux-label.patch +++ b/krb5-1.13-selinux-label.patch @@ -125,10 +125,10 @@ which we used earlier, is some improvement. localedir='$(datadir)/locale' --- krb5/src/include/k5-int.h +++ krb5/src/include/k5-int.h -@@ -133,6 +133,7 @@ typedef unsigned char u_char; - typedef UINT64_TYPE krb5_ui_8; - typedef INT64_TYPE krb5_int64; +@@ -129,6 +129,7 @@ typedef unsigned char u_char; + + #include "k5-platform.h" +#include "k5-label.h" #define KRB5_KDB_MAX_LIFE (60*60*24) /* one day */ @@ -289,8 +289,8 @@ which we used earlier, is some improvement. --- krb5/src/plugins/kdb/db2/libdb2/btree/bt_open.c +++ krb5/src/plugins/kdb/db2/libdb2/btree/bt_open.c @@ -60,6 +60,7 @@ static char sccsid[] = "@(#)bt_open.c 8. - - #include "k5-platform.h" /* mkstemp? */ + #include <string.h> + #include <unistd.h> +#include "k5-int.h" #include "db-int.h" @@ -364,7 +364,7 @@ which we used earlier, is some improvement. @@ -437,6 +437,9 @@ void doit(fd) krb5_enctype etype; int database_fd; - char host[INET6_ADDRSTRLEN+1]; + char host[INET6_ADDRSTRLEN + 1]; +#ifdef USE_SELINUX + void *selabel; +#endif @@ -379,13 +379,13 @@ which we used earlier, is some improvement. + selabel = krb5int_push_fscreatecon_for(file); +#endif omask = umask(077); - lock_fd = open(temp_file_name, O_RDWR|O_CREAT, 0600); - (void) umask(omask); + lock_fd = open(temp_file_name, O_RDWR | O_CREAT, 0600); + (void)umask(omask); +#ifdef USE_SELINUX + krb5int_pop_fscreatecon(selabel); +#endif retval = krb5_lock_file(kpropd_context, lock_fd, - KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK); + KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK); if (retval) { --- krb5/src/util/profile/prof_file.c +++ krb5/src/util/profile/prof_file.c @@ -884,9 +884,9 @@ which we used earlier, is some improvement. + if (status == 0) + return 0; + } - krb5_set_error_message(context, KRB5_FCC_NOFILE, - _("Credential cache directory %s does not " - "exist"), dirname); + k5_setmsg(context, KRB5_FCC_NOFILE, + _("Credential cache directory %s does not exist"), + dirname); --- krb5/src/lib/krb5/os/trace.c +++ krb5/src/lib/krb5/os/trace.c @@ -401,7 +401,7 @@ krb5_set_trace_filename(krb5_context con @@ -944,10 +944,10 @@ which we used earlier, is some improvement. pid = (unsigned long) getpid(); --- krb5/src/lib/kdb/kdb_log.c +++ krb5/src/lib/kdb/kdb_log.c -@@ -566,7 +566,7 @@ ulog_map(krb5_context context, const cha - if (caller == FKPROPLOG) - return errno; +@@ -456,7 +456,7 @@ ulog_map(krb5_context context, const cha + int ulogfd = -1; + if (stat(logname, &st) == -1) { - ulogfd = open(logname, O_RDWR | O_CREAT, 0600); + ulogfd = THREEPARAMOPEN(logname, O_RDWR | O_CREAT, 0600); if (ulogfd == -1) diff --git a/krb5-1.3.4-send-pr-tempfile.patch b/krb5-1.3.4-send-pr-tempfile.patch deleted file mode 100644 index a9ffa31..0000000 --- a/krb5-1.3.4-send-pr-tempfile.patch +++ /dev/null @@ -1,41 +0,0 @@ -Use mktemp to create our temporary files instead of basing them on our PID. -Only portable if you assume the presence of a mktemp helper. -diff -ur krb5-1.3.4/src/util/send-pr/send-pr.sh krb5-1.3.4/src/util/send-pr/send-pr.sh ---- krb5-1.3.4/src/util/send-pr/send-pr.sh 1997-03-20 01:13:56.000000000 +0100 -+++ krb5-1.3.4/src/util/send-pr/send-pr.sh 2004-09-20 11:28:56.000000000 +0200 -@@ -96,9 +96,9 @@ - fi - fi - --TEMP=$TMPDIR/p$$ --BAD=$TMPDIR/pbad$$ --REF=$TMPDIR/pf$$ -+TEMP=`mktemp "$TMPDIR"/p.XXXXXX` || exit 1 -+BAD=`mktemp "$TMPDIR"/pbad.XXXXXX` || exit 1 -+REF=`mktemp "$TMPDIR"/pf.XXXXXX` || exit 1 - - # find a user name - if [ "$LOGNAME" = "" ]; then -@@ -122,9 +122,10 @@ - else - # Must use temp file due to incompatibilities in quoting behavior - # and to protect shell metacharacters in the expansion of $LOGNAME -- $PASSWD | grep "^$LOGNAME:" | awk -F: '{print $5}' | sed -e 's/,.*//' > $TEMP -- ORIGINATOR="`cat $TEMP`" -- rm -f $TEMP -+ TEMP2=`mktemp "$TMPDIR"/plogname.XXXXXX` || exit 1 -+ $PASSWD | grep "^$LOGNAME:" | awk -F: '{print $5}' | sed -e 's/,.*//' > $TEMP2 -+ ORIGINATOR="`cat $TEMP2`" -+ rm -f $TEMP2 - fi - - if [ -n "$ORGANIZATION" ]; then -@@ -280,7 +281,7 @@ - # Catch some signals. ($xs kludge needed by Sun /bin/sh) - xs=0 - trap 'rm -f $REF $TEMP; exit $xs' 0 --trap 'echo "$COMMAND: Aborting ..."; rm -f $REF $TEMP; xs=1; exit' 1 2 3 13 15 -+trap 'echo "$COMMAND: Aborting ..."; rm -f "$REF" "$BAD" "$TEMP"; xs=1; exit' 1 2 3 13 15 - - # If they told us to use a specific file, then do so. - if [ -n "$IN_FILE" ]; then diff --git a/krb5-master-mechd.patch b/krb5-master-mechd.patch deleted file mode 100644 index 965a436..0000000 --- a/krb5-master-mechd.patch +++ /dev/null @@ -1,275 +0,0 @@ -commit 123c14fd8862ee8f11f6084d25958cb380655f35 -Author: Günther Deschner <gdeschner@redhat.com> -Date: Wed Mar 5 16:21:55 2014 +0100 - - Remove dead code from the mechglue initialization - - The stat check in gss_indicate_mechs had no consequent and would have - been redundant with logic in updateMechList if it did. - - [ghudson@mit.edu: elaborated commit message; removed unused - g_mechSetTime and now-irrelevant comment] - -diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c -index 48a825e..c6904e0 100644 ---- a/src/lib/gssapi/mechglue/g_initialize.c -+++ b/src/lib/gssapi/mechglue/g_initialize.c -@@ -91,7 +91,6 @@ static gss_mech_info g_mechListTail = NULL; - static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; - static time_t g_confFileModTime = (time_t)0; - --static time_t g_mechSetTime = (time_t)0; - static gss_OID_set_desc g_mechSet = { 0, NULL }; - static k5_mutex_t g_mechSetLock = K5_MUTEX_PARTIAL_INITIALIZER; - -@@ -213,8 +212,6 @@ gss_indicate_mechs(minorStatus, mechSet_out) - OM_uint32 *minorStatus; - gss_OID_set *mechSet_out; - { -- char *fileName; -- struct stat fileInfo; - OM_uint32 status; - - /* Initialize outputs. */ -@@ -233,16 +230,6 @@ gss_OID_set *mechSet_out; - if (*minorStatus != 0) - return (GSS_S_FAILURE); - -- fileName = MECH_CONF; -- -- /* -- * If we have already computed the mechanisms supported and if it -- * is still valid; make a copy and return to caller, -- * otherwise build it first. -- */ -- if ((stat(fileName, &fileInfo) == 0 && -- fileInfo.st_mtime > g_mechSetTime)) { -- } /* if g_mechSet is out of date or not initialized */ - if (build_mechSet()) - return GSS_S_FAILURE; - -@@ -289,20 +276,6 @@ build_mechSet(void) - */ - k5_mutex_lock(&g_mechListLock); - --#if 0 -- /* -- * this checks for the case when we need to re-construct the -- * g_mechSet structure, but the mechanism list is upto date -- * (because it has been read by someone calling -- * gssint_get_mechanism) -- */ -- if (fileInfo.st_mtime > g_confFileModTime) -- { -- g_confFileModTime = fileInfo.st_mtime; -- loadConfigFile(fileName); -- } --#endif -- - updateMechList(); - - /* - -commit 05cbef80d53f49d30a5d0563501226dc173734d4 -Author: Günther Deschner <gdeschner@redhat.com> -Date: Wed Mar 5 15:25:43 2014 +0100 - - Load mechglue config files from /etc/gss/mech.d - - In addition to loading /etc/gss/mech, glob for *.conf files in - /etc/gss/mech.d. Load only config files which have changed since the - highest mtime we saw in the previous scan. Scan at most once per - second to avoid excessive numbers of filesystem syscalls for busy - GSSAPI applications. - - [ghudson@mit.edu: rewrote commit message; style changes; added - once-per-second throttle on glob/stat calls] - - ticket: 7882 (new) - -diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c -index c6904e0..f0acf1a 100644 ---- a/src/lib/gssapi/mechglue/g_initialize.c -+++ b/src/lib/gssapi/mechglue/g_initialize.c -@@ -41,6 +41,7 @@ - #include <string.h> - #include <ctype.h> - #include <errno.h> -+#include <glob.h> - - #define M_DEFAULT "default" - -@@ -58,6 +59,7 @@ - #ifndef MECH_CONF - #define MECH_CONF "/etc/gss/mech" - #endif -+#define MECH_CONF_PATTERN MECH_CONF ".d/*.conf" - - /* Local functions */ - static void addConfigEntry(const char *oidStr, const char *oid, -@@ -90,6 +92,7 @@ static gss_mech_info g_mechList = NULL; - static gss_mech_info g_mechListTail = NULL; - static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; - static time_t g_confFileModTime = (time_t)0; -+static time_t g_confLastCall = (time_t)0; - - static gss_OID_set_desc g_mechSet = { 0, NULL }; - static k5_mutex_t g_mechSetLock = K5_MUTEX_PARTIAL_INITIALIZER; -@@ -383,6 +386,56 @@ const gss_OID oid; - return (modOptions); - } /* gssint_get_modOptions */ - -+/* Return the mtime of filename or its eventual symlink target (if it is a -+ * symlink), whichever is larger. Return (time_t)-1 if lstat or stat fails. */ -+static time_t -+check_link_mtime(const char *filename, time_t *mtime_out) -+{ -+ struct stat st1, st2; -+ -+ if (lstat(filename, &st1) != 0) -+ return (time_t)-1; -+ if (!S_ISLNK(st1.st_mode)) -+ return st1.st_mtime; -+ if (stat(filename, &st2) != 0) -+ return (time_t)-1; -+ return (st1.st_mtime > st2.st_mtime) ? st1.st_mtime : st2.st_mtime; -+} -+ -+/* Try to load any config files which have changed since the last call. Config -+ * files are MECH_CONF and any files matching MECH_CONF_PATTERN. */ -+static void -+loadConfigFiles() -+{ -+ glob_t globbuf; -+ time_t highest_mtime = 0, mtime, now; -+ char **pathptr; -+ -+ /* Don't glob and stat more than once per second. */ -+ if (time(&now) == (time_t)-1 || now == g_confLastCall) -+ return; -+ g_confLastCall = now; -+ -+ globbuf.gl_offs = 1; -+ if (glob(MECH_CONF_PATTERN, GLOB_DOOFFS, NULL, &globbuf) != 0) -+ return; -+ globbuf.gl_pathv[0] = MECH_CONF; -+ -+ for (pathptr = globbuf.gl_pathv; *pathptr != NULL; pathptr++) { -+ mtime = check_link_mtime(*pathptr, &mtime); -+ if (mtime == (time_t)-1) -+ continue; -+ if (mtime > highest_mtime) -+ highest_mtime = mtime; -+ if (mtime > g_confFileModTime) -+ loadConfigFile(*pathptr); -+ } -+ g_confFileModTime = highest_mtime; -+ -+ globbuf.gl_pathv[0] = NULL; -+ globfree(&globbuf); -+} -+ - /* - * determines if the mechList needs to be updated from file - * and performs the update. -@@ -401,17 +454,7 @@ updateMechList(void) - loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); - loadConfigFromRegistry(HKEY_LOCAL_MACHINE, MECH_KEY); - #else /* _WIN32 */ -- char *fileName; -- struct stat fileInfo; -- -- fileName = MECH_CONF; -- -- /* check if mechList needs updating */ -- if (stat(fileName, &fileInfo) != 0 || -- g_confFileModTime >= fileInfo.st_mtime) -- return; -- g_confFileModTime = fileInfo.st_mtime; -- loadConfigFile(fileName); -+ loadConfigFiles(); - #endif /* !_WIN32 */ - - /* Load any unloaded interposer mechanisms immediately, to make sure we - -commit ac98187641f6943ae571606c0b6a97f236f9b60c -Author: Greg Hudson <ghudson@mit.edu> -Date: Wed May 28 23:51:49 2014 -0400 - - Read /etc/gss/mech if no mech.d/*.conf found - - Always read /etc/gss/mech, even if globbing /etc/gss/mech.d/*.conf - doesn't work. Doing this using GLOB_DOOFFS proved error-prone, so use - a simpler approach: factor out the per-pathname handling into a helper - function load_if_changed, call it with MECH_CONF before the glob, then - pass each glob result through the helper. - - ticket: 7925 - -diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c -index f0acf1a..8bce14c 100644 ---- a/src/lib/gssapi/mechglue/g_initialize.c -+++ b/src/lib/gssapi/mechglue/g_initialize.c -@@ -402,38 +402,45 @@ check_link_mtime(const char *filename, time_t *mtime_out) - return (st1.st_mtime > st2.st_mtime) ? st1.st_mtime : st2.st_mtime; - } - -+/* Load pathname if it is newer than last. Update *highest to the maximum of -+ * its current value and pathname's mod time. */ -+static void -+load_if_changed(const char *pathname, time_t last, time_t *highest) -+{ -+ time_t mtime; -+ -+ mtime = check_link_mtime(pathname, &mtime); -+ if (mtime == (time_t)-1) -+ return; -+ if (mtime > *highest) -+ *highest = mtime; -+ if (mtime > last) -+ loadConfigFile(pathname); -+} -+ - /* Try to load any config files which have changed since the last call. Config - * files are MECH_CONF and any files matching MECH_CONF_PATTERN. */ - static void - loadConfigFiles() - { - glob_t globbuf; -- time_t highest_mtime = 0, mtime, now; -- char **pathptr; -+ time_t highest = 0, now; -+ char **path; - - /* Don't glob and stat more than once per second. */ - if (time(&now) == (time_t)-1 || now == g_confLastCall) - return; - g_confLastCall = now; - -- globbuf.gl_offs = 1; -- if (glob(MECH_CONF_PATTERN, GLOB_DOOFFS, NULL, &globbuf) != 0) -- return; -- globbuf.gl_pathv[0] = MECH_CONF; -+ load_if_changed(MECH_CONF, g_confFileModTime, &highest); - -- for (pathptr = globbuf.gl_pathv; *pathptr != NULL; pathptr++) { -- mtime = check_link_mtime(*pathptr, &mtime); -- if (mtime == (time_t)-1) -- continue; -- if (mtime > highest_mtime) -- highest_mtime = mtime; -- if (mtime > g_confFileModTime) -- loadConfigFile(*pathptr); -+ if (glob(MECH_CONF_PATTERN, 0, NULL, &globbuf) == 0) { -+ for (path = globbuf.gl_pathv; *path != NULL; path++) -+ load_if_changed(*path, g_confFileModTime, &highest); -+ globfree(&globbuf); - } -- g_confFileModTime = highest_mtime; - -- globbuf.gl_pathv[0] = NULL; -- globfree(&globbuf); -+ g_confFileModTime = highest; - } - - /* diff --git a/krb5-master-move-otp-sockets.patch b/krb5-master-move-otp-sockets.patch deleted file mode 100644 index 350a818..0000000 --- a/krb5-master-move-otp-sockets.patch +++ /dev/null @@ -1,203 +0,0 @@ -Adjusted to apply to 1.12.2. - -commit 1e4bdcfed2c7bda94d5c135cc32a5993ca032501 -Author: Nathaniel McCallum <npmccallum@redhat.com> -Date: Wed Feb 5 10:59:46 2014 -0500 - - Move OTP sockets to KDC_RUN_DIR - - Some system configurations expect Unix-domain sockets to live under - /run or /var/run, and not other parts of /var where persistent - application state lives. Define a new directory KDC_RUN_DIR using - $runstatedir (new in autoconf 2.70, so fall back to $localstatedir/run - if it's not set) and use that for the default socket path. - - [ghudson@mit.edu: commit message, otp.rst formatting fix] - - ticket: 7859 (new) - -diff --git a/doc/admin/otp.rst b/doc/admin/otp.rst -index 0abd5ff..f12c36d 100644 ---- a/doc/admin/otp.rst -+++ b/doc/admin/otp.rst -@@ -23,7 +23,7 @@ the following format:: - - [otp] - <name> = { -- server = <host:port or filename> (default: $KDCDIR/<name>.socket) -+ server = <host:port or filename> (default: see below) - secret = <filename> - timeout = <integer> (default: 5 [seconds]) - retries = <integer> (default: 3) -@@ -33,7 +33,8 @@ the following format:: - If the server field begins with '/', it will be interpreted as a UNIX - socket. Otherwise, it is assumed to be in the format host:port. When - a UNIX domain socket is specified, the secret field is optional and an --empty secret is used by default. -+empty secret is used by default. If the server field is not -+specified, it defaults to |kdcrundir|\ ``/<name>.socket``. - - When forwarding the request over RADIUS, by default the principal is - used in the User-Name attribute of the RADIUS packet. The strip_realm -diff --git a/doc/conf.py b/doc/conf.py -index f015fc8..bc8b2bd 100644 ---- a/doc/conf.py -+++ b/doc/conf.py -@@ -231,6 +231,7 @@ if 'mansubs' in tags: - sbindir = '``@SBINDIR@``' - libdir = '``@LIBDIR@``' - localstatedir = '``@LOCALSTATEDIR@``' -+ runstatedir = '``@RUNSTATEDIR@``' - sysconfdir = '``@SYSCONFDIR@``' - ccache = '``@CCNAME@``' - keytab = '``@KTNAME@``' -@@ -243,6 +244,7 @@ else: - sbindir = ':ref:`SBINDIR <paths>`' - libdir = ':ref:`LIBDIR <paths>`' - localstatedir = ':ref:`LOCALSTATEDIR <paths>`' -+ runstatedir = ':ref:`RUNSTATEDIR <paths>`' - sysconfdir = ':ref:`SYSCONFDIR <paths>`' - ccache = ':ref:`DEFCCNAME <paths>`' - keytab = ':ref:`DEFKTNAME <paths>`' -@@ -262,6 +264,7 @@ else: - rst_epilog += '.. |sbindir| replace:: %s\n' % sbindir - rst_epilog += '.. |libdir| replace:: %s\n' % libdir - rst_epilog += '.. |kdcdir| replace:: %s\\ ``/krb5kdc``\n' % localstatedir -+ rst_epilog += '.. |kdcrundir| replace:: %s\\ ``/krb5kdc``\n' % runstatedir - rst_epilog += '.. |sysconfdir| replace:: %s\n' % sysconfdir - rst_epilog += '.. |ccache| replace:: %s\n' % ccache - rst_epilog += '.. |keytab| replace:: %s\n' % keytab -diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst -index 89b8f4c..838dabb 100644 ---- a/doc/mitK5defaults.rst -+++ b/doc/mitK5defaults.rst -@@ -17,6 +17,7 @@ KDC config file :ref:`kdc.conf(5)` |kdcdir|\ ``/kdc.conf`` **KRB - KDC database path (DB2) |kdcdir|\ ``/principal`` - Master key :ref:`stash_definition` |kdcdir|\ ``/.k5.``\ *realm* - Admin server ACL file :ref:`kadm5.acl(5)` |kdcdir|\ ``/kadm5.acl`` -+OTP socket directory |kdcrundir| - Plugin base directory |libdir|\ ``/krb5/plugins`` - :ref:`rcache_definition` directory ``/var/tmp`` **KRB5RCACHEDIR** - Master key default enctype |defmkey| -@@ -64,6 +65,7 @@ Description Symbolic name Custom build path Typical - User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` - Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` - Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` -+Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` - Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` - Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` - Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` -diff --git a/src/Makefile.in b/src/Makefile.in -index a8bc990..1725093 100644 ---- a/src/Makefile.in -+++ b/src/Makefile.in -@@ -64,6 +64,7 @@ INSTALLMKDIRS = $(KRB5ROOT) $(KRB5MANROOT) $(KRB5OTHERMKDIRS) \ - $(KRB5_AD_MODULE_DIR) \ - $(KRB5_LIBKRB5_MODULE_DIR) \ - @localstatedir@ @localstatedir@/krb5kdc \ -+ @runstatedir@ @runstatedir@/krb5kdc \ - $(KRB5_INCSUBDIRS) $(datadir) $(EXAMPLEDIR) \ - $(PKGCONFIG_DIR) - -diff --git a/src/configure.in b/src/configure.in -index 2145d54..c2eaf78 100644 ---- a/src/configure.in -+++ b/src/configure.in -@@ -9,6 +9,12 @@ - fi - AC_SUBST(SYSCONFCONF) - -+# If $runstatedir isn't set by autoconf (<2.70), set it manually. -+if test x"$runstatedir" == x; then -+ runstatedir=$localstatedir/run -+fi -+AC_SUBST(runstatedir) -+ - CONFIG_RULES - KRB5_VERSION=K5_VERSION - AC_SUBST(KRB5_VERSION) -diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in -index a6bb7c5..b07e16a 100644 ---- a/src/doc/Makefile.in -+++ b/src/doc/Makefile.in -@@ -7,6 +7,7 @@ DOXYGEN=doxygen - - docsrc=$(top_srcdir)/../doc - localstatedir=@localstatedir@ -+runstatedir=@runstatedir@ - sysconfdir=@sysconfdir@ - DEFCCNAME=@DEFCCNAME@ - DEFKTNAME=@DEFKTNAME@ -@@ -113,6 +114,7 @@ paths.py: - echo 'sbindir = "``$(SERVER_BINDIR)``"' >> $@ - echo 'libdir = "``$(KRB5_LIBDIR)``"' >> $@ - echo 'localstatedir = "``$(localstatedir)``"' >> $@ -+ echo 'runstatedir = "``$(runstatedir)``"' >> $@ - echo 'sysconfdir = "``$(sysconfdir)``"' >> $@ - echo 'ccache = "``$(DEFCCNAME)``"' >> $@ - echo 'keytab = "``$(DEFKTNAME)``"' >> $@ -diff --git a/src/include/Makefile.in b/src/include/Makefile.in -index e13042a..f83ff4e 100644 ---- a/src/include/Makefile.in -+++ b/src/include/Makefile.in -@@ -53,6 +53,7 @@ autoconf.stamp: $(srcdir)/autoconf.h.in $(BUILDTOP)/config.status - - SYSCONFDIR = @sysconfdir@ - LOCALSTATEDIR = @localstatedir@ -+RUNSTATEDIR = @runstatedir@ - BINDIR = @bindir@ - SBINDIR = @sbindir@ - LIBDIR = @libdir@ -@@ -66,6 +67,7 @@ PROCESS_REPLACE = -e "s+@KRB5RCTMPDIR+$(KRB5RCTMPDIR)+" \ - -e "s+@MODULEDIR+$(MODULE_DIR)+" \ - -e "s+@GSSMODULEDIR+$(GSS_MODULE_DIR)+" \ - -e 's+@LOCALSTATEDIR+$(LOCALSTATEDIR)+' \ -+ -e 's+@RUNSTATEDIR+$(RUNSTATEDIR)+' \ - -e 's+@SYSCONFDIR+$(SYSCONFDIR)+' \ - -e 's+@DYNOBJEXT+$(DYNOBJEXT)+' \ - -e 's+@SYSCONFCONF+$(SYSCONFCONF)+' -diff --git a/src/include/osconf.hin b/src/include/osconf.hin -index 90ab86d..871503a 100644 ---- a/src/include/osconf.hin -+++ b/src/include/osconf.hin -@@ -59,6 +59,7 @@ - #define PLUGIN_EXT "@DYNOBJEXT" - - #define KDC_DIR "@LOCALSTATEDIR/krb5kdc" -+#define KDC_RUN_DIR "@RUNSTATEDIR/krb5kdc" - #define DEFAULT_KDB_FILE KDC_DIR "/principal" - #define DEFAULT_KEYFILE_STUB KDC_DIR "/.k5." - #define KRB5_DEFAULT_ADMIN_ACL KDC_DIR "/krb5_adm.acl" -diff --git a/src/man/Makefile.in b/src/man/Makefile.in -index 4dd2448..2b9c892 100644 ---- a/src/man/Makefile.in -+++ b/src/man/Makefile.in -@@ -5,6 +5,7 @@ SPHINX_BUILD=sphinx-build - GROFF=@GROFF@ - GROFF_MAN=$(GROFF) -mtty-char -Tascii -mandoc -c - localstatedir=@localstatedir@ -+runstatedir=@runstatedir@ - sysconfdir=@sysconfdir@ - DEFCCNAME=@DEFCCNAME@ - DEFKTNAME=@DEFKTNAME@ -@@ -44,6 +45,7 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h - -e 's|@SBINDIR@|$(SERVER_BINDIR)|g' \ - -e 's|@LIBDIR@|$(KRB5_LIBDIR)|g' \ - -e 's|@LOCALSTATEDIR@|$(localstatedir)|g' \ -+ -e 's|@RUNSTATEDIR@|$(runstatedir)|g' \ - -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \ - -e 's|@CCNAME@|$(DEFCCNAME)|g' \ - -e 's|@KTNAME@|$(DEFKTNAME)|g' \ -diff --git a/src/plugins/preauth/otp/otp_state.c b/src/plugins/preauth/otp/otp_state.c -index a4d7e3b..4643dff 100644 ---- a/src/plugins/preauth/otp/otp_state.c -+++ b/src/plugins/preauth/otp/otp_state.c -@@ -40,7 +40,7 @@ - #endif - - #define DEFAULT_TYPE_NAME "DEFAULT" --#define DEFAULT_SOCKET_FMT KDC_DIR "/%s.socket" -+#define DEFAULT_SOCKET_FMT KDC_RUN_DIR "/%s.socket" - #define DEFAULT_TIMEOUT 5 - #define DEFAULT_RETRIES 3 - #define MAX_SECRET_LEN 1024 diff --git a/krb5-master-rcache-acquirecred-cleanup.patch b/krb5-master-rcache-acquirecred-cleanup.patch deleted file mode 100644 index 72b97d3..0000000 --- a/krb5-master-rcache-acquirecred-cleanup.patch +++ /dev/null @@ -1,105 +0,0 @@ -commit ef8e19af863158e4c1abc15fc710aa8cfad38406 -Author: Greg Hudson <ghudson@mit.edu> -Date: Wed Jan 15 12:51:42 2014 -0500 - - Clean up GSS krb5 acquire_accept_cred - - Use a cleanup handler instead of releasing kt in multiple error - clauses. Wrap a long line and fix a comment with a missing word. - Rewrap the function arguments to use fewer lines. - -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index 9547207..37cc6b5 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -179,13 +179,13 @@ cleanup: - */ - - static OM_uint32 --acquire_accept_cred(krb5_context context, -- OM_uint32 *minor_status, -- krb5_keytab req_keytab, -- krb5_gss_cred_id_rec *cred) -+acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, -+ krb5_keytab req_keytab, krb5_gss_cred_id_rec *cred) - { -+ OM_uint32 major; - krb5_error_code code; -- krb5_keytab kt; -+ krb5_keytab kt = NULL; -+ krb5_rcache rc = NULL; - - assert(cred->keytab == NULL); - -@@ -202,46 +202,54 @@ acquire_accept_cred(krb5_context context, - } - } - if (code) { -- *minor_status = code; -- return GSS_S_CRED_UNAVAIL; -+ major = GSS_S_CRED_UNAVAIL; -+ goto cleanup; - } - - if (cred->name != NULL) { -- /* Make sure we keys matching the desired name in the keytab. */ -+ /* Make sure we have keys matching the desired name in the keytab. */ - code = check_keytab(context, kt, cred->name); - if (code) { -- krb5_kt_close(context, kt); - if (code == KRB5_KT_NOTFOUND) { - char *errstr = (char *)krb5_get_error_message(context, code); -- krb5_set_error_message(context, KG_KEYTAB_NOMATCH, "%s", errstr); -+ krb5_set_error_message(context, KG_KEYTAB_NOMATCH, "%s", -+ errstr); - krb5_free_error_message(context, errstr); -- *minor_status = KG_KEYTAB_NOMATCH; -- } else -- *minor_status = code; -- return GSS_S_CRED_UNAVAIL; -+ code = KG_KEYTAB_NOMATCH; -+ } -+ major = GSS_S_CRED_UNAVAIL; -+ goto cleanup; - } - - /* Open the replay cache for this principal. */ - code = krb5_get_server_rcache(context, &cred->name->princ->data[0], -- &cred->rcache); -+ &rc); - if (code) { -- krb5_kt_close(context, kt); -- *minor_status = code; -- return GSS_S_FAILURE; -+ major = GSS_S_FAILURE; -+ goto cleanup; - } - } else { - /* Make sure we have a keytab with keys in it. */ - code = krb5_kt_have_content(context, kt); - if (code) { -- krb5_kt_close(context, kt); -- *minor_status = code; -- return GSS_S_CRED_UNAVAIL; -+ major = GSS_S_CRED_UNAVAIL; -+ goto cleanup; - } - } - - cred->keytab = kt; -+ kt = NULL; -+ cred->rcache = rc; -+ rc = NULL; -+ major = GSS_S_COMPLETE; - -- return GSS_S_COMPLETE; -+cleanup: -+ if (kt != NULL) -+ krb5_kt_close(context, kt); -+ if (rc != NULL) -+ krb5_rc_close(context, rc); -+ *minor_status = code; -+ return major; - } - #endif /* LEAN_CLIENT */ - diff --git a/krb5-master-rcache-acquirecred-source.patch b/krb5-master-rcache-acquirecred-source.patch deleted file mode 100644 index 71c3876..0000000 --- a/krb5-master-rcache-acquirecred-source.patch +++ /dev/null @@ -1,136 +0,0 @@ -commit 7dad0bee30fbbde8cfc0eacd2d1487c198a004a1 -Author: Simo Sorce <simo@redhat.com> -Date: Thu Dec 26 19:05:34 2013 -0500 - - Add rcache feature to gss_acquire_cred_from - - The "rcache" cred store entry can specify a replay cache type and name - to be used with the credentials being acquired. - - [ghudson@mit.edu: split up, simplified, and altered to fit preparatory - commits] - - ticket: 7819 (new) - -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index f625c0c..5d680f9 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -180,7 +180,8 @@ cleanup: - - static OM_uint32 - acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, -- krb5_keytab req_keytab, krb5_gss_cred_id_rec *cred) -+ krb5_keytab req_keytab, const char *rcname, -+ krb5_gss_cred_id_rec *cred) - { - OM_uint32 major; - krb5_error_code code; -@@ -189,6 +190,20 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, - - assert(cred->keytab == NULL); - -+ /* If we have an explicit rcache name, open it. */ -+ if (rcname != NULL) { -+ code = krb5_rc_resolve_full(context, &rc, rcname); -+ if (code) { -+ major = GSS_S_FAILURE; -+ goto cleanup; -+ } -+ code = krb5_rc_recover_or_initialize(context, rc, context->clockskew); -+ if (code) { -+ major = GSS_S_FAILURE; -+ goto cleanup; -+ } -+ } -+ - if (req_keytab != NULL) { - code = krb5_kt_dup(context, req_keytab, &kt); - } else { -@@ -221,12 +236,14 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, - goto cleanup; - } - -- /* Open the replay cache for this principal. */ -- code = krb5_get_server_rcache(context, &cred->name->princ->data[0], -- &rc); -- if (code) { -- major = GSS_S_FAILURE; -- goto cleanup; -+ if (rc == NULL) { -+ /* Open the replay cache for this principal. */ -+ code = krb5_get_server_rcache(context, &cred->name->princ->data[0], -+ &rc); -+ if (code) { -+ major = GSS_S_FAILURE; -+ goto cleanup; -+ } - } - } else { - /* Make sure we have a keytab with keys in it. */ -@@ -718,8 +735,8 @@ acquire_cred_context(krb5_context context, OM_uint32 *minor_status, - gss_name_t desired_name, gss_buffer_t password, - OM_uint32 time_req, gss_cred_usage_t cred_usage, - krb5_ccache ccache, krb5_keytab client_keytab, -- krb5_keytab keytab, krb5_boolean iakerb, -- gss_cred_id_t *output_cred_handle, -+ krb5_keytab keytab, const char *rcname, -+ krb5_boolean iakerb, gss_cred_id_t *output_cred_handle, - OM_uint32 *time_rec) - { - krb5_gss_cred_id_t cred = NULL; -@@ -775,7 +792,7 @@ acquire_cred_context(krb5_context context, OM_uint32 *minor_status, - * in cred->name if desired_princ is specified. - */ - if (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH) { -- ret = acquire_accept_cred(context, minor_status, keytab, cred); -+ ret = acquire_accept_cred(context, minor_status, keytab, rcname, cred); - if (ret != GSS_S_COMPLETE) - goto error_out; - } -@@ -867,7 +884,7 @@ acquire_cred(OM_uint32 *minor_status, gss_name_t desired_name, - - ret = acquire_cred_context(context, minor_status, desired_name, password, - time_req, cred_usage, ccache, NULL, keytab, -- iakerb, output_cred_handle, time_rec); -+ NULL, iakerb, output_cred_handle, time_rec); - - out: - krb5_free_context(context); -@@ -1135,7 +1152,7 @@ krb5_gss_acquire_cred_from(OM_uint32 *minor_status, - krb5_keytab client_keytab = NULL; - krb5_keytab keytab = NULL; - krb5_ccache ccache = NULL; -- const char *value; -+ const char *rcname, *value; - OM_uint32 ret; - - code = gss_krb5int_initialize_library(); -@@ -1191,9 +1208,14 @@ krb5_gss_acquire_cred_from(OM_uint32 *minor_status, - } - } - -+ ret = kg_value_from_cred_store(cred_store, KRB5_CS_RCACHE_URN, &rcname); -+ if (GSS_ERROR(ret)) -+ goto out; -+ - ret = acquire_cred_context(context, minor_status, desired_name, NULL, - time_req, cred_usage, ccache, client_keytab, -- keytab, 0, output_cred_handle, time_rec); -+ keytab, rcname, 0, output_cred_handle, -+ time_rec); - - out: - if (ccache != NULL) -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index 0167816..8e4f6d9 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -1260,6 +1260,7 @@ data_to_gss(krb5_data *input_k5data, gss_buffer_t output_buffer) - #define KRB5_CS_CLI_KEYTAB_URN "client_keytab" - #define KRB5_CS_KEYTAB_URN "keytab" - #define KRB5_CS_CCACHE_URN "ccache" -+#define KRB5_CS_RCACHE_URN "rcache" - - OM_uint32 - kg_value_from_cred_store(gss_const_key_value_set_t cred_store, diff --git a/krb5-master-rcache-acquirecred-test.patch b/krb5-master-rcache-acquirecred-test.patch deleted file mode 100644 index e8eef5e..0000000 --- a/krb5-master-rcache-acquirecred-test.patch +++ /dev/null @@ -1,82 +0,0 @@ -commit 6f8d5135334c9ddb674f9824e750872b3b0642ea -Author: Greg Hudson <ghudson@mit.edu> -Date: Thu Jan 16 11:49:55 2014 -0500 - - Add test for gss_acquire_cred_from rcache feature - -diff --git a/src/tests/gssapi/t_credstore.c b/src/tests/gssapi/t_credstore.c -index 575f96d..e28f5d0 100644 ---- a/src/tests/gssapi/t_credstore.c -+++ b/src/tests/gssapi/t_credstore.c -@@ -46,7 +46,9 @@ main(int argc, char *argv[]) - gss_cred_usage_t cred_usage = GSS_C_BOTH; - gss_OID_set mechs = GSS_C_NO_OID_SET; - gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; -- krb5_boolean store_creds = FALSE; -+ gss_ctx_id_t ictx = GSS_C_NO_CONTEXT, actx = GSS_C_NO_CONTEXT; -+ gss_buffer_desc itok, atok; -+ krb5_boolean store_creds = FALSE, replay = FALSE; - char opt; - - /* Parse options. */ -@@ -54,6 +56,8 @@ main(int argc, char *argv[]) - opt = (*argv)[1]; - if (opt == 's') - store_creds = TRUE; -+ else if (opt == 'r') -+ replay = TRUE; - else if (opt == 'a') - cred_usage = GSS_C_ACCEPT; - else if (opt == 'b') -@@ -101,6 +105,31 @@ main(int argc, char *argv[]) - &store, &cred, NULL, NULL); - check_gsserr("gss_acquire_cred_from", major, minor); - -+ if (replay) { -+ /* Induce a replay using cred as the acceptor cred, to test the replay -+ * cache indicated by the store. */ -+ major = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL, &ictx, name, -+ &mech_krb5, 0, GSS_C_INDEFINITE, -+ GSS_C_NO_CHANNEL_BINDINGS, -+ GSS_C_NO_BUFFER, NULL, &itok, NULL, NULL); -+ check_gsserr("gss_init_sec_context", major, minor); -+ (void)gss_delete_sec_context(&minor, &ictx, NULL); -+ -+ major = gss_accept_sec_context(&minor, &actx, cred, &itok, -+ GSS_C_NO_CHANNEL_BINDINGS, NULL, NULL, -+ &atok, NULL, NULL, NULL); -+ check_gsserr("gss_accept_sec_context(1)", major, minor); -+ (void)gss_release_buffer(&minor, &atok); -+ (void)gss_delete_sec_context(&minor, &actx, NULL); -+ -+ major = gss_accept_sec_context(&minor, &actx, cred, &itok, -+ GSS_C_NO_CHANNEL_BINDINGS, NULL, NULL, -+ &atok, NULL, NULL, NULL); -+ check_gsserr("gss_accept_sec_context(2)", major, minor); -+ (void)gss_release_buffer(&minor, &atok); -+ (void)gss_delete_sec_context(&minor, &actx, NULL); -+ } -+ - gss_release_name(&minor, &name); - gss_release_cred(&minor, &cred); - free(store.elements); -diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py -index 74139e4..106910d 100755 ---- a/src/tests/gssapi/t_gssapi.py -+++ b/src/tests/gssapi/t_gssapi.py -@@ -91,6 +91,15 @@ realm.kinit(service_cs, None, ['-k', '-t', servicekeytab]) - realm.run(['./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache, - 'keytab', servicekeytab]) - -+# Test rcache feature of cred stores. t_credstore -r should produce a -+# replay error normally, but not with rcache set to "none:". -+output = realm.run(['./t_credstore', '-r', '-a', 'p:' + realm.host_princ], -+ expected_code=1) -+if 'gss_accept_sec_context(2): Request is a replay' not in output: -+ fail('Expected replay error not seen in t_credstore output') -+realm.run(['./t_credstore', '-r', '-a', 'p:' + realm.host_princ, -+ 'rcache', 'none:']) -+ - # Verify that we can't acquire acceptor creds without a keytab. - os.remove(realm.keytab) - output = realm.run(['./t_accname', 'p:abc'], expected_code=1) diff --git a/krb5-master-rcache-internal-const.patch b/krb5-master-rcache-internal-const.patch deleted file mode 100644 index 5cb1108..0000000 --- a/krb5-master-rcache-internal-const.patch +++ /dev/null @@ -1,46 +0,0 @@ -commit 74ff6c4accb68bd1d6c652c55e66519720db9fc4 -Author: Greg Hudson <ghudson@mit.edu> -Date: Wed Jan 15 12:31:41 2014 -0500 - - Make rcache resolve functions take const char * - -diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index bbc7fab..b4757a9 100644 ---- a/src/include/k5-int.h -+++ b/src/include/k5-int.h -@@ -1887,8 +1887,10 @@ krb5_error_code KRB5_CALLCONV - krb5int_cc_user_set_default_name(krb5_context context, const char *name); - - krb5_error_code krb5_rc_default(krb5_context, krb5_rcache *); --krb5_error_code krb5_rc_resolve_type(krb5_context, krb5_rcache *,char *); --krb5_error_code krb5_rc_resolve_full(krb5_context, krb5_rcache *,char *); -+krb5_error_code krb5_rc_resolve_type(krb5_context, krb5_rcache *, -+ const char *); -+krb5_error_code krb5_rc_resolve_full(krb5_context, krb5_rcache *, -+ const char *); - char *krb5_rc_get_type(krb5_context, krb5_rcache); - char *krb5_rc_default_type(krb5_context); - char *krb5_rc_default_name(krb5_context); -diff --git a/src/lib/krb5/rcache/rc_base.c b/src/lib/krb5/rcache/rc_base.c -index 2fc96c5..373ac30 100644 ---- a/src/lib/krb5/rcache/rc_base.c -+++ b/src/lib/krb5/rcache/rc_base.c -@@ -65,7 +65,8 @@ krb5_rc_register_type(krb5_context context, const krb5_rc_ops *ops) - } - - krb5_error_code --krb5_rc_resolve_type(krb5_context context, krb5_rcache *idptr, char *type) -+krb5_rc_resolve_type(krb5_context context, krb5_rcache *idptr, -+ const char *type) - { - struct krb5_rc_typelist *t; - krb5_error_code err; -@@ -146,7 +147,7 @@ krb5_rc_default(krb5_context context, krb5_rcache *idptr) - - krb5_error_code - krb5_rc_resolve_full(krb5_context context, krb5_rcache *idptr, -- char *string_name) -+ const char *string_name) - { - char *type; - char *residual; diff --git a/krb5-master-strdupcheck.patch b/krb5-master-strdupcheck.patch deleted file mode 100644 index 4c9d0c1..0000000 --- a/krb5-master-strdupcheck.patch +++ /dev/null @@ -1,23 +0,0 @@ -commit b6810da129512b6d0200580d78d22d38cc214e21 -Author: Lukas Slebodnik <lslebodn@redhat.com> -Date: Sat Jun 21 17:09:31 2014 +0200 - - Fix error check in krb5_ldap_parse_principal_name - - Test the correct variable for NULL to detect a strdup failure. - - [ghudson@mit.edu: clarified commit message] - -diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c -index 21695a9..44bf339 100644 ---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c -+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c -@@ -412,7 +412,7 @@ krb5_ldap_parse_principal_name(char *i_princ_name, char **o_princ_name) - at_rlm_name = strrchr(i_princ_name, '@'); - if (!at_rlm_name) { - *o_princ_name = strdup(i_princ_name); -- if (!o_princ_name) -+ if (!*o_princ_name) - return ENOMEM; - } else { - k5_buf_init_dynamic(&buf); @@ -37,19 +37,20 @@ %global configure_default_ccache_name 1 %global configured_default_ccache_name KEYRING:persistent:%%{uid} %endif +%global prerelease -alpha1 Summary: The Kerberos network authentication system Name: krb5 -Version: 1.12.2 -Release: 3%{?dist} +Version: 1.13 +Release: 0%{?dist}.alpha1.1 # Maybe we should explode from the now-available-to-everybody tarball instead? -# http://web.mit.edu/kerberos/dist/krb5/1.12/krb5-1.12.2-signed.tar -Source0: krb5-%{version}.tar.gz -Source1: krb5-%{version}.tar.gz.asc +# http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13-alpha1-signed.tar +Source0: krb5-%{version}%{prerelease}.tar.gz +Source1: krb5-%{version}%{prerelease}.tar.gz.asc # Use a dummy krb5-%{version}-pdf.tar.xz the first time through, then # tar cvJf $RPM_SOURCE_DIR/krb5-%%{version}-pdf.tar.xz build-pdf/*.pdf # after the build phase finishes. -Source3: krb5-%{version}-pdf.tar.xz +Source3: krb5-%{version}%{prerelease}-pdf.tar.xz Source2: kprop.service Source4: kadmin.service Source5: krb5kdc.service @@ -76,36 +77,18 @@ Source100: nss_wrapper-0.0-20140204195100.git3d58327.tar.xz Source101: noport.c Source102: socket_wrapper-0.0-20140204194748.gitf3b2ece.tar.xz -Patch1: krb5-1.12-pwdch-fast.patch Patch6: krb5-1.12-ksu-path.patch Patch12: krb5-1.12-ktany.patch Patch16: krb5-1.12-buildconf.patch Patch23: krb5-1.3.1-dns.patch -Patch29: krb5-1.10-kprop-mktemp.patch -Patch30: krb5-1.3.4-send-pr-tempfile.patch Patch39: krb5-1.12-api.patch -Patch59: krb5-1.10-kpasswd_tcp.patch Patch60: krb5-1.12.1-pam.patch -Patch63: krb5-1.12-selinux-label.patch -Patch71: krb5-1.11-dirsrv-accountlock.patch +Patch63: krb5-1.13-selinux-label.patch +Patch71: krb5-1.13-dirsrv-accountlock.patch Patch86: krb5-1.9-debuginfo.patch Patch105: krb5-kvno-230379.patch Patch129: krb5-1.11-run_user_0.patch Patch134: krb5-1.11-kpasswdtest.patch -Patch136: krb5-master-rcache-internal-const.patch -Patch137: krb5-master-rcache-acquirecred-cleanup.patch -Patch139: krb5-master-rcache-acquirecred-source.patch -Patch141: krb5-master-rcache-acquirecred-test.patch -Patch142: krb5-master-move-otp-sockets.patch -Patch145: krb5-master-mechd.patch -Patch146: krb5-master-strdupcheck.patch -Patch201: 0001-In-ksu-merge-krb5_ccache_copy-and-_restricted.patch -Patch202: 0002-In-ksu-don-t-stat-not-on-disk-ccache-residuals.patch -Patch203: 0003-Use-an-intermediate-memory-cache-in-ksu.patch -Patch204: 0004-Make-ksu-respect-the-default_ccache_name-setting.patch -Patch205: 0005-Copy-config-entries-to-the-ksu-target-ccache.patch -Patch206: 0006-Use-more-randomness-for-ksu-secondary-cache-names.patch -Patch207: 0007-Make-krb5_cc_new_unique-create-DIR-directories.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -238,8 +221,6 @@ Requires: chkconfig # we drop files in its directory, but we don't want to own that directory Requires: logrotate Requires(preun): initscripts -# mktemp is used by krb5-send-pr -Requires: coreutils # we specify /usr/share/dict/words as the default dict_file in kdc.conf Requires: /usr/share/dict/words %if %{WITH_SYSVERTO} @@ -272,8 +253,6 @@ realm, you need to install this package. Summary: Kerberos 5 programs for use on workstations Group: System Environment/Base Requires: %{name}-libs%{?_isa} = %{version}-%{release} -# mktemp is used by krb5-send-pr -Requires: coreutils %description workstation Kerberos is a network authentication system. The krb5-workstation @@ -305,19 +284,9 @@ to obtain initial credentials from a KDC using a private key and a certificate. %prep -%setup -q -a 3 -a 100 -a 102 +%setup -q -n %{name}-%{version}%{prerelease} -a 3 -a 100 -a 102 ln -s NOTICE LICENSE -%patch201 -p1 -b .In-ksu-merge-krb5_ccache_copy-and-_restricted -%patch202 -p1 -b .In-ksu-don-t-stat-not-on-disk-ccache-residuals -%patch203 -p1 -b .Use-an-intermediate-memory-cache-in-ksu -%patch204 -p1 -b .Make-ksu-respect-the-default_ccache_name-setting -%patch205 -p1 -b .Copy-config-entries-to-the-ksu-target-ccache -%patch206 -p1 -b .Use-more-randomness-for-ksu-secondary-cache-names -%patch207 -p1 -b .Make-krb5_cc_new_unique-create-DIR-directories - -%patch1 -p1 -b .pwdch-fast - %patch60 -p1 -b .pam %patch63 -p1 -b .selinux-label @@ -326,10 +295,7 @@ ln -s NOTICE LICENSE %patch12 -p1 -b .ktany %patch16 -p1 -b .buildconf %{?_rawbuild} %patch23 -p1 -b .dns %{?_rawbuild} -%patch29 -p1 -b .kprop-mktemp -%patch30 -p1 -b .send-pr-tempfile %patch39 -p1 -b .api -%patch59 -p1 -b .kpasswd_tcp %patch71 -p1 -b .dirsrv-accountlock %{?_rawbuild} %patch86 -p0 -b .debuginfo %patch105 -p1 -b .kvno @@ -340,14 +306,6 @@ ln -s NOTICE LICENSE %patch134 -p1 -b .kpasswdtest -%patch136 -p1 -b .rcache-internal-const -%patch137 -p1 -b .rcache-acquirecred-cleanup -%patch139 -p1 -b .rcache-acquirecred-source -%patch141 -p1 -b .rcache-acquirecred-test -%patch142 -p1 -b .move-otp-sockets -%patch145 -p1 -b .master-mechd -%patch146 -p1 -b .master-strdupcheck - # Take the execute bit off of documentation. chmod -x doc/krb5-protocol/*.txt doc/ccapi/*.html @@ -378,9 +336,7 @@ mkdir -p socket_wrapper/build cfg="src/kadmin/testing/proto/kdc.conf.proto \ src/kadmin/testing/proto/krb5.conf.proto \ src/lib/kadm5/unit-test/api.current/init-v2.exp \ - src/util/k5test.py \ - src/tests/mk_migr/ldap_backend/input_conf/*.conf \ - src/tests/mk_migr/db2_backend/input_conf/*.conf" + src/util/k5test.py" LONG_BIT=`getconf LONG_BIT` PORT=`expr 61000 + $LONG_BIT - 48` sed -i -e s,61000,`expr "$PORT" + 0`,g $cfg @@ -656,6 +612,10 @@ for section in 1 5 8 ; do $RPM_BUILD_ROOT/%{_mandir}/man${section}/ done +# This script just tells you to send bug reports to krb5-bugs@mit.edu, but +# since we don't have a man page for it, just drop it. +rm $RPM_BUILD_ROOT/%{_sbindir}/krb5-send-pr + %find_lang %{gettext_domain} %clean @@ -831,12 +791,6 @@ exit 0 %{_mandir}/man1/ksu.1* %config(noreplace) /etc/pam.d/ksu -# Problem-reporting tool. -%{_sbindir}/krb5-send-pr -%dir %{_datadir}/gnats -%{_datadir}/gnats/mit -%{_mandir}/man1/krb5-send-pr.1* - %files server %defattr(-,root,root,-) %docdir %{_mandir} @@ -871,13 +825,6 @@ exit 0 %dir %{_libdir}/krb5/plugins/authdata %{_libdir}/krb5/plugins/preauth/otp.so - -# Problem-reporting tool. -%{_sbindir}/krb5-send-pr -%dir %{_datadir}/gnats -%{_datadir}/gnats/mit -%{_mandir}/man1/krb5-send-pr.1* - # KDC binaries and configuration. %{_mandir}/man5/kadm5.acl.5* %{_mandir}/man5/kdc.conf.5* @@ -961,6 +908,7 @@ exit 0 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/* %{_libdir}/krb5/plugins/kdb/db2.so +%{_libdir}/krb5/plugins/tls/k5tls.so %dir %{_var}/kerberos %dir %{_var}/kerberos/krb5 %dir %{_var}/kerberos/krb5/user @@ -1023,6 +971,10 @@ exit 0 %{_sbindir}/uuserver %changelog +* Fri Aug 22 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-4 +- update to 1.13 alpha1 + - drop upstreamed and backported patches + * Wed Aug 20 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-3 - pull in upstream fix for an incorrect check on the value returned by a strdup() call (#1132062) |