Re: [PATCH] cifs.upcall: resolve scraped ccache name explicitly

[Paulo Alcantara <pc@manguebit.org>]

Paulo Alcantara <pc@manguebit.org> writes:

> get_existing_cc() selected the credentials cache scraped from the
> initiating process' environment by exporting it via setenv($KRB5CCNAME)
> and then calling krb5_cc_default().
>
> MIT krb5 reads $KRB5CCNAME through secure_getenv(), which returns NULL
> whenever the process runs with AT_SECURE set.  The request-key upcall
> that spawns cifs.upcall triggers an SELinux domain transition, so on
> systems with SELinux enforcing cifs.upcall runs with AT_SECURE=1.  The
> setenv() is therefore silently ignored and krb5 falls back to the
> profile default_ccache_name (KCM: on many distros).  As a result, a
> valid TGT living in a FILE credential cache is never found, and the
> mount fails with:
>
>   cifs.upcall: main: valid TGT is not present in credential cache
>   cifs.upcall: Unable to obtain service ticket
>
> while the same TGT in a KCM cache (selected via the profile default,
> not the environment) works fine.
>
> Resolve the scraped name directly with krb5_cc_resolve(), which takes
> the ccache name as an argument and does not consult secure_getenv(),
> so the FILE ccache is honored regardless of AT_SECURE.  Fall back to
> krb5_cc_default() only when nothing was scraped.
> ...

Applied.