rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Make ksu honor KRB5CCNAME again

Browse Source
This commit is contained in:
Robbie Harwood 2020-04-07 15:51:54 -04:00
parent 9f3201c4bc
commit 66ec722479
2 changed files with 84 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
Make-ksu-honor-KRB5CCNAME-again.patch Normal file
View File

@ -0,0 +1,79 @@
From 59f2a9dd6a83a3721cdffe852343d96ffaa5c18a Mon Sep 17 00:00:00 2001
From: Greg Hudson <ghudson@mit.edu>
Date: Mon, 6 Apr 2020 20:45:10 -0400
Subject: [PATCH] Make ksu honor KRB5CCNAME again
Commit d439e370b70f7af4ed2da9c692a3be7dcf7b4ac6 (ticket 8800) caused
ksu to ignore KRB5CCNAME from the environment. ksu uses euid
switching to access the source cache, and should honor KRB5CCNAME to
find the ccache to potentially authorize the su operation.
Add a helper function init_ksu_context() to create the ksu context,
with explicit code to honor KRB5CCNAME using
krb5_cc_set_default_name().
ticket: 8895
tags: pullup
target_version: 1.18-next
(cherry picked from commit f040a3ac73947312e1b08c76f75f3389ffb4ba75)
---
src/clients/ksu/main.c | 31 ++++++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
index 21a4d02bb..508242e0e 100644
--- a/src/clients/ksu/main.c
+++ b/src/clients/ksu/main.c
@@ -54,6 +54,7 @@ int force_fork = 0;
static int set_env_var (char *, char *);
static void sweep_up (krb5_context, krb5_ccache);
static char * ontty (void);
+static krb5_error_code init_ksu_context(krb5_context *);
static krb5_error_code set_ccname_env(krb5_context, krb5_ccache);
static void print_status( const char *fmt, ...)
#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7)
@@ -135,7 +136,7 @@ main (argc, argv)
unsetenv ("KRB5_CONFIG");
- retval = krb5_init_secure_context(&ksu_context);
+ retval = init_ksu_context(&ksu_context);
if (retval) {
com_err(argv[0], retval, _("while initializing krb5"));
exit(1);
@@ -878,6 +879,34 @@ main (argc, argv)
}
}
+static krb5_error_code
+init_ksu_context(krb5_context *context_out)
+{
+ krb5_error_code retval;
+ const char *env_ccname;
+ krb5_context context;
+
+ *context_out = NULL;
+
+ retval = krb5_init_secure_context(&context);
+ if (retval)
+ return retval;
+
+ /* We want to obey KRB5CCNAME in this context even though this is a setuid
+ * program. (It will only be used when operating as the real uid.) */
+ env_ccname = getenv(KRB5_ENV_CCNAME);
+ if (env_ccname != NULL) {
+ retval = krb5_cc_set_default_name(context, env_ccname);
+ if (retval) {
+ krb5_free_context(context);
+ return retval;
+ }
+ }
+
+ *context_out = context;
+ return 0;
+}
+
/* Set KRB5CCNAME in the environment to point to ccache. Print an error
* message on failure. */
static krb5_error_code

6
krb5.spec
View File

@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.18
# for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
Release: 11%{?dist}
Release: 12%{?dist}
# rharwood has trust path to signing key and verifies on check-in
Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz
@ -59,6 +59,7 @@ Patch13: Add-finalization-safety-check-to-com_err.patch
Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch
Patch15: Correctly-import-service-GSS-host-based-name.patch
Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch
Patch17: Make-ksu-honor-KRB5CCNAME-again.patch
License: MIT
URL: https://web.mit.edu/kerberos/www/
@ -636,6 +637,9 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
* Tue Apr 07 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-12
- Make ksu honor KRB5CCNAME again
* Thu Apr 02 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-11
- Do expiration warnings for all init_creds APIs