Re: Wishlist: credential file update/access collision avoidance?

30 sep 2011 kl. 21:45 skrev Russ Allbery:

> Harry Coin <[email protected]> writes:
> 
>> Doesn't the library just error/fail report to the daemon/service that
>> the credentials cache is missing/invalid/unreadable during the time
>> k5start is writing the refreshed credentials?  Am I wrong to worry that
>> these false/avoidable error messages will occur in a fashion hard to
>> reproduce reliably?
> 
> Well, ideally the Kerberos library uses file locking when updating a
> Kerberos ticket cache, so another process will just block on the lock for
> a short period of time.  I don't know if this actually happens.

Heimdal uses whole file locking when adding/deleting entries, and uses rename-over (where it works) to make atomic updates of the file caches.

Do you have any instances where this doesn't work, would appreciate reproduce test cases.

Love