From 8987efdd5c1587ee2e795bf9996e415002172d32 Mon Sep 17 00:00:00 2001
From: Ondrej Kos <okos@redhat.com>
Date: Tue, 2 Oct 2012 18:56:39 +0200
Subject: [PATCH] Log possibly non-randomizable ccache file template

fixes https://fedorahosted.org/sssd/ticket/1533

ccache file template is now checked for appended XXXXXX for use with
mkstemp. When those characters are not present, warning is written to log.
---
 src/providers/krb5/krb5_auth.c  |  3 +--
 src/providers/krb5/krb5_child.c |  2 +-
 src/providers/krb5/krb5_utils.c | 36 ++++++++++++++++++++++++++----------
 src/providers/krb5/krb5_utils.h |  5 +++--
 4 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a305bb69c24c022da1b33b2dd39baf16068b9406..73e651dff5f7eb322c59f89d93e58c183e32b1a4 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -100,8 +100,7 @@ check_old_ccache(const char *old_ccache, struct krb5child_req *kr,
         return EINVAL;
     }
 
-    ret = old_cc_ops->check_existing(old_ccache, kr->uid, realm,
-                                     kr->upn, active, valid);
+    ret = old_cc_ops->check_existing(kr, old_ccache, realm, active, valid);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
               ("Cannot check if saved ccache %s is active and valid\n",
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 6987d2b9ed0c4c794e165716ed64f61427e66e0c..b2d5bdaeb9d4b1ac8de12055a4d6bb5a7f48a7f1 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -337,7 +337,7 @@ static krb5_error_code create_ccache_file(krb5_context ctx,
 
 
     ccname_len = strlen(cc_file_name);
-    if (ccname_len >= 6 && strcmp(cc_file_name + (ccname_len-6), "XXXXXX")==0 ) {
+    if (ccname_len >= 6 && strcmp(cc_file_name + (ccname_len - 6), "XXXXXX") == 0) {
         fd = mkstemp(cc_file_name);
         if (fd == -1) {
             kerr = errno;
diff --git a/src/providers/krb5/krb5_utils.c b/src/providers/krb5/krb5_utils.c
index 774f62dad092f54e979f887307b72f6ccdc4acbf..f8d9719af614fc7a317fb76f09382ad2fff691bb 100644
--- a/src/providers/krb5/krb5_utils.c
+++ b/src/providers/krb5/krb5_utils.c
@@ -695,10 +695,25 @@ cc_residual_is_used(uid_t uid, const char *ccname,
     return EOK;
 }
 
+void
+cc_file_check_template(struct krb5child_req *kr)
+{
+    size_t ccname_len;
+    const char *ccname;
+
+    ccname = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
+
+    ccname_len = strlen(ccname);
+    if (ccname_len >= 6 && strcmp(ccname + (ccname_len - 6), "XXXXXX") == 0) {
+        DEBUG(SSSDBG_CONF_SETTINGS, ("ccache file name template [%s] doesn't "
+                   "contain randomizing characters (XXXXXX), file might not "
+                   "be rewritable\n", ccname));
+    }
+}
+
 errno_t
-cc_file_check_existing(const char *location, uid_t uid,
-                       const char *realm, const char *princ,
-                       bool *_active, bool *_valid)
+cc_file_check_existing(struct krb5child_req *kr, const char *location,
+                       const char *realm, bool *_active, bool *_valid)
 {
     errno_t ret;
     bool active;
@@ -719,10 +734,11 @@ cc_file_check_existing(const char *location, uid_t uid,
         return EINVAL;
     }
 
-    ret = cc_residual_is_used(uid, filename, SSS_KRB5_TYPE_FILE, &active);
+    ret = cc_residual_is_used(kr->uid, filename, SSS_KRB5_TYPE_FILE, &active);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
                                   "Will create a new one.\n"));
+        cc_file_check_template(kr);
         active = false;
     }
 
@@ -740,7 +756,7 @@ cc_file_check_existing(const char *location, uid_t uid,
         return EIO;
     }
 
-    kerr = check_for_valid_tgt(context, ccache, realm, princ, &valid);
+    kerr = check_for_valid_tgt(context, ccache, realm, kr->upn, &valid);
     krb5_free_context(context);
     krb5_cc_close(context, ccache);
     if (kerr != EOK) {
@@ -844,9 +860,8 @@ get_ccache_for_princ(krb5_context context, const char *location,
 }
 
 errno_t
-cc_dir_check_existing(const char *location, uid_t uid,
-                      const char *realm, const char *princ,
-                      bool *_active, bool *_valid)
+cc_dir_check_existing(struct krb5child_req *kr, const char *location,
+                      const char *realm, bool *_active, bool *_valid)
 {
     bool active = false;
     bool valid = false;
@@ -888,11 +903,12 @@ cc_dir_check_existing(const char *location, uid_t uid,
         return EINVAL;
     }
 
-    ret = cc_residual_is_used(uid, dir, SSS_KRB5_TYPE_DIR, &active);
+    ret = cc_residual_is_used(kr->uid, dir, SSS_KRB5_TYPE_DIR, &active);
     talloc_free(tmp);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
                                   "Will create a new one.\n"));
+        cc_file_check_template(kr);
         active = false;
     }
 
@@ -920,7 +936,7 @@ cc_dir_check_existing(const char *location, uid_t uid,
         goto done;
     }
 
-    krberr = check_for_valid_tgt(context, ccache, realm, princ, &valid);
+    krberr = check_for_valid_tgt(context, ccache, realm, kr->upn, &valid);
     if (krberr != EOK) {
         KRB5_DEBUG(SSSDBG_OP_FAILURE, context, krberr);
         DEBUG(SSSDBG_CRIT_FAILURE,
diff --git a/src/providers/krb5/krb5_utils.h b/src/providers/krb5/krb5_utils.h
index d8d96d25868b8896553455199043b3c23ff3686e..e8a83d0f5b4ec520407c299ecb65f5792bbbecc6 100644
--- a/src/providers/krb5/krb5_utils.h
+++ b/src/providers/krb5/krb5_utils.h
@@ -35,8 +35,9 @@
 /* Operations on a credential cache */
 typedef errno_t (*cc_be_create_fn)(const char *location, pcre *illegal_re,
                                    uid_t uid, gid_t gid, bool private_path);
-typedef errno_t (*cc_be_check_existing)(const char *location, uid_t uid,
-                                        const char *realm, const char *princ,
+typedef errno_t (*cc_be_check_existing)(struct krb5child_req *kr,
+                                        const char *location,
+                                        const char *realm,
                                         bool *active, bool *valid);
 typedef const char * (*cc_be_ccache_for_princ)(TALLOC_CTX *mem_ctx,
                                                const char *location,
-- 
1.7.11.4

