ehlo,
In krb5-libs 1.11, function krb5_cc_resolve verify if credential cache dir
exists. If it doesn't exist, than it will be created. We
have to ensure, that it will be created with right uid, gid and permissions.
There is check in krb_auth_send, whether cached user data in ldb contains
SYSDB_CCACHE_FILE attribute. If it is available, then old ccache is checked in
function check_old_ccache. Gdm clean user directory (in /run/user/)
after logout. This is the reason why SYSDB_CCACHE_FILE attribute was found
in ldb cache and directory did not exist and then in function krb5_cc_resolve
was created with wrong permissions.
Patch attached.
LS
Show replies by date