[SSSD] [PATCH] KRB5: Recover gracefully if the ccache file could not be reused

Jakub Hrozek jhrozek at redhat.com
Sun Sep 23 21:12:30 UTC 2012


https://fedorahosted.org/sssd/ticket/1384

I tested by logging in from one terminal, then chowning the ccache to
root.root to make the existing ccache unusable by the krb5_child process
and attempting to log in from another terminal.

Without the patch, the second login would just fail. With the patch, the
second login would succeed so the user can su or sudo and fix the
permissions problem.
-------------- next part --------------
>From da9151e73d6389705463341728bc0fbef4982900 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 23 Sep 2012 23:00:45 +0200
Subject: [PATCH] KRB5: Recover gracefully if the ccache file could not be
 reused

https://fedorahosted.org/sssd/ticket/1384
---
 src/providers/krb5/krb5_utils.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/providers/krb5/krb5_utils.c b/src/providers/krb5/krb5_utils.c
index 8b15fc35dd172179713eac53fc2d4aa20f229d28..774f62dad092f54e979f887307b72f6ccdc4acbf 100644
--- a/src/providers/krb5/krb5_utils.c
+++ b/src/providers/krb5/krb5_utils.c
@@ -721,8 +721,9 @@ cc_file_check_existing(const char *location, uid_t uid,
 
     ret = cc_residual_is_used(uid, filename, SSS_KRB5_TYPE_FILE, &active);
     if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active\n"));
-        return ret;
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
+                                  "Will create a new one.\n"));
+        active = false;
     }
 
     kerr = krb5_init_context(&context);
@@ -890,8 +891,9 @@ cc_dir_check_existing(const char *location, uid_t uid,
     ret = cc_residual_is_used(uid, dir, SSS_KRB5_TYPE_DIR, &active);
     talloc_free(tmp);
     if (ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE, ("Could not check if ccache is active\n"));
-        return ret;
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
+                                  "Will create a new one.\n"));
+        active = false;
     }
 
     krberr = krb5_init_context(&context);
-- 
1.7.11.4



More information about the sssd-devel mailing list