On Fedora, we need to default to using /run/user/%u for credential
caches for improved security and to simplify rpc.gssd locating the
cache for use with NFS.
This patch will not go upstream, but I wanted to submit it for review in
order to raise awareness about these changes for any other distributions
that might wish to make the same choices.
With recent Fedora distributions, we now have available
the /run/user/<username> directory. This is a tmpfs location that is
guaranteed (by filesystem permissions and SELinux rules) to be
accessible only by <username>. With this available, we can move the
default credential cache location here and guarantee two things:
1) The location is now well-known to be /run/user/<username>/krb5cc
2) An attacker (or laptop-thief) cannot boot to single-user mode and
gain access to valid credentials to impersonate the user.