[nfs-utils/f17] gssd: Look for user creds in user defined directory (bz 786993)

[Steve Dickson]

commit 4028445e576ec9c94b73e09e29ebdc76a5cf1af2
Author: Steve Dickson <steved at redhat.com>
Date:   Thu Mar 22 14:55:49 2012 -0400

    gssd: Look for user creds in user defined directory (bz 786993)
    
    Signed-off-by: Steve Dickson <steved at redhat.com>

 nfs-utils-1.2.5-gssd-usercreds.patch |   96 ++++++++++++++++++++++++++++++++++
 nfs-utils.spec                       |    7 ++-
 2 files changed, 102 insertions(+), 1 deletions(-)
---
diff --git a/nfs-utils-1.2.5-gssd-usercreds.patch b/nfs-utils-1.2.5-gssd-usercreds.patch
new file mode 100644
index 0000000..d9578fc
--- /dev/null
+++ b/nfs-utils-1.2.5-gssd-usercreds.patch
@@ -0,0 +1,96 @@
+commit 245fad6be5a32866b2cefad55b3e2d50f6b197af
+Author: Steve Dickson <steved at redhat.com>
+Date:   Thu Mar 22 11:02:46 2012 -0400
+
+    gssd: Look for user creds in user defined directory
+    
+    The user credential cache currently is kept in /tmp.
+    In upcoming Kerberos release that will be moved to
+    /run/user/<username>/. This patch enables gssd to
+    look in both the old and new caches
+    
+    Signed-off-by: Steve Dickson <steved at redhat.com>
+
+diff -up nfs-utils-1.2.5/utils/gssd/gssd.c.orig nfs-utils-1.2.5/utils/gssd/gssd.c
+--- nfs-utils-1.2.5/utils/gssd/gssd.c.orig	2011-09-24 07:55:15.000000000 -0400
++++ nfs-utils-1.2.5/utils/gssd/gssd.c	2012-03-22 11:12:47.441219000 -0400
+@@ -57,7 +57,7 @@
+ 
+ char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
+ char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
+-char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR;
++char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR ":" GSSD_USER_CRED_DIR;
+ char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
+ int  use_memcache = 0;
+ int  root_uses_machine_creds = 1;
+diff -up nfs-utils-1.2.5/utils/gssd/gssd.h.orig nfs-utils-1.2.5/utils/gssd/gssd.h
+--- nfs-utils-1.2.5/utils/gssd/gssd.h.orig	2011-09-24 07:55:15.000000000 -0400
++++ nfs-utils-1.2.5/utils/gssd/gssd.h	2012-03-22 11:12:47.447222000 -0400
+@@ -45,6 +45,7 @@
+ #define DNOTIFY_SIGNAL		(SIGRTMIN + 3)
+ 
+ #define GSSD_DEFAULT_CRED_DIR			"/tmp"
++#define GSSD_USER_CRED_DIR			"/run/user"
+ #define GSSD_DEFAULT_CRED_PREFIX		"krb5cc_"
+ #define GSSD_DEFAULT_MACHINE_CRED_SUFFIX	"machine"
+ #define GSSD_DEFAULT_KEYTAB_FILE		"/etc/krb5.keytab"
+diff -up nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig nfs-utils-1.2.5/utils/gssd/gssd_proc.c
+--- nfs-utils-1.2.5/utils/gssd/gssd_proc.c.orig	2011-09-24 07:55:15.000000000 -0400
++++ nfs-utils-1.2.5/utils/gssd/gssd_proc.c	2012-03-22 11:12:47.455220000 -0400
+@@ -949,6 +949,23 @@ int create_auth_rpc_client(struct clnt_i
+ 	goto out;
+ }
+ 
++static char *
++user_cachedir(char *dirname, uid_t uid)
++{
++	struct passwd *pw;
++	char *ptr;
++
++	if ((pw = getpwuid(uid)) == NULL) {
++		printerr(0, "user_cachedir: Failed to find '%d' uid"
++			    " for cache directory\n");
++		return NULL;
++	}
++	ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2);
++	if (ptr)
++		sprintf(ptr, "%s/%s", dirname, pw->pw_name);
++
++	return ptr;
++}
+ /*
+  * this code uses the userland rpcsec gss library to create a krb5
+  * context on behalf of the kernel
+@@ -963,7 +980,7 @@ process_krb5_upcall(struct clnt_info *cl
+ 	gss_buffer_desc		token;
+ 	char			**credlist = NULL;
+ 	char			**ccname;
+-	char			**dirname;
++	char			**dirname, *dir, *userdir;
+ 	int			create_resp = -1;
+ 	int			err, downcall_err = -EACCES;
+ 
+@@ -1006,7 +1023,22 @@ process_krb5_upcall(struct clnt_info *cl
+ 				service == NULL)) {
+ 		/* Tell krb5 gss which credentials cache to use */
+ 		for (dirname = ccachesearch; *dirname != NULL; dirname++) {
+-			err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
++			/* See if the user name is needed */
++			if (strncmp(*dirname, GSSD_USER_CRED_DIR, 
++					strlen(GSSD_USER_CRED_DIR)) == 0) {
++				userdir = user_cachedir(*dirname, uid);
++				if (userdir == NULL) 
++					continue;
++				dir = userdir;
++			} else
++				dir = *dirname;
++
++			err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir);
++
++			if (userdir) {
++				free(userdir);
++				userdir = NULL;
++			}
+ 			if (err == -EKEYEXPIRED)
+ 				downcall_err = -EKEYEXPIRED;
+ 			else if (!err)
diff --git a/nfs-utils.spec b/nfs-utils.spec
index bca7cba..b72e671 100644
--- a/nfs-utils.spec
+++ b/nfs-utils.spec
@@ -2,7 +2,7 @@ Summary: NFS utilities and supporting clients and daemons for the kernel NFS ser
 Name: nfs-utils
 URL: http://sourceforge.net/projects/nfs
 Version: 1.2.5
-Release: 13%{?dist}
+Release: 14%{?dist}
 Epoch: 1
 
 # group all 32bit related archs
@@ -32,6 +32,7 @@ Patch001: nfs-utils-1.2.6-rc6.patch
 Patch002: nfs-utils-1.2.4-mountshortcut.patch
 Patch003: nfs-utils-1.2.5-libidmap-hide-syms.patch
 Patch004: nfs-utils-1.2.5-nfsd-new-default.patch
+Patch005: nfs-utils-1.2.5-gssd-usercreds.patch
 
 Patch100: nfs-utils-1.2.1-statdpath-man.patch
 Patch101: nfs-utils-1.2.1-exp-subtree-warn-off.patch
@@ -92,6 +93,7 @@ This package also contains the mount.nfs and umount.nfs program.
 %patch002 -p1
 %patch003 -p1
 %patch004 -p1
+%patch005 -p1
 
 %patch100 -p1
 %patch101 -p1
@@ -281,6 +283,9 @@ fi
 %attr(4755,root,root)   /sbin/umount.nfs4
 
 %changelog
+* Thu Mar 22 2012 Steve Dickson <steved at redhat.com> 1.2.5-14
+- gssd: Look for user creds in user defined directory (bz 786993)
+
 * Fri Mar 16 2012 Steve Dickson <steved at redhat.com> 1.2.5-13
 - Make sure statd is start before NFS mounts (bz 786050)
 - rpc.idmap: Hide global symbols from libidmap plugins (bz 797332)