Re: Patch for k5start cc ownership

Harry Coin <[email protected]> writes:

> There is a problem with the k5start Linux distributions use so that
> nslcd credentials cache is refreshed.

> Symptom:  k5start would create and refresh the specified credentials
> cache, then change the uid:gid as directed.  This is verified by an ls
> -l in the nslcd init script just after k5start is launched and before
> the nslcd daemon launches.  Linux would then proceed with its init
> script to launch nslcd-- which would fail, as the credentials cache was
> owned by root as if k5start did not change the uid:gid.  How does it
> happen the ownership of the credentials cache changed back to 0:0?

> Result:

> After every call to authenticate(), the credentials cache ownership is
> changed to root.

[...]

To close the loop on this older discussion, I've just now released kstart
4.0, which writes the ticket cache out to a separate file if -o, -g, or -m
are used, sets ownership and permission, and then does an atomic rename of
the new cache to replace the old cache.  This should close race conditions
where a process using the cache doesn't have access to it.

-- 
Russ Allbery ([email protected])             <http://www.eyrie.org/~eagle/>