Default libkrb5 ccache location

[Simo Sorce]

On Tue, 2013-07-30 at 03:27 +0200, Lennart Poettering wrote:
> On Mon, 29.07.13 21:11, Simo Sorce (simo at redhat.com) wrote:
> 
> > On Tue, 2013-07-30 at 02:08 +0200, Lennart Poettering wrote:
> > > On Mon, 29.07.13 23:56, David Woodhouse (dwmw2 at infradead.org) wrote:
> > > 
> > > > On Tue, 2013-07-30 at 00:50 +0200, Lennart Poettering wrote:
> > > > > So, why don't you revert to using /tmp then?
> > > > 
> > > > The problem with /tmp is that if you want predictable filenames for the
> > > > storage, you open yourself to a denial-of-service attack where another
> > > > user can create a file with the same name.
> > > 
> > > Well, but that's not unsurmountable, just pick a randomly named
> > > directory in /tmp and make sure to have a symlink:
> > > 
> > >    ln -s /tmp/krb.XXXXXX "$HOME/.krb-`cat /etc/machine-id`"
> > 
> > What would create this directory ?
> 
> The same component that creates the temporary directory?
> 
> In pseudo code:
>    
>    char temp[] = "/tmp/krb.XXXXXX", link[PATH_MAX];
>    char *machine_id, *home;
> 
>    mkdtemp(temp);
>    machine_id = get_file_contents("/etc/machine_id");
>    *strchrnul(machined_id, '\n') = 0;
>    home = getenv("HOME);
>    snprintf(link, "%s/.krb-%s", home, machine_id);
>    symlink(temp, link);
> 
> Of course, you should skip this if the symlink already exists and points
> to a valid directory...

This doesn't make any sense whatsoever, if we are back to unpredictable
file names and trolling I may as well just use /tmp/krb5cc_XXXXXX only.

Ccaches do not belong in the home directory, period.

> > > to give it a stable, machine-local name.
> > 
> > in what case /tmp contains non-'machine-local' files ?
> 
> /tmp doesn't. But /home does. Hence you include the machine ID in the
> symlink name.
> 
> > Also I need one directory per-user and not per-machine.
> 
> Well, you want it per-user *and* per-machine.
> 
> > And how is this different than /run/kerberos in the end ?
> 
> That there's a sane cleanup scheme done via /tmp and not yet another
> place where we have unrestricted runtime objects of the user.

Except the stuff that cleans /tmp has no idea how to look *into* the
ccache to see if it is still valid or not, so it is a mechanism I do not
care for.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York