#

# This patch modifies the MIT implementation of krb5_fcc_initialize() so

# it doesn't call unlink() on an existing ccache file.  This modification

# was done a long time ago in Solaris to workaround a race condition

# brought on by the interaction between Solaris pam_krb5 and MIT's

# implementation of krb5_fcc_initialize().  Given there are better ways of

# fixing the race condition we will not give this patch to MIT however a

# proper race condition fix would take prohibitively long to implement

# hence this patch.  When pam_krb5 is modified to better deal with the

# ccache file and RFE 22229031 regarding ktkt_warnd is implemented then

# this patch can be removed.

# Patch source: in-house

#

diff -Naru old/src/lib/krb5/ccache/cc_file.c new/src/lib/krb5/ccache/cc_file.c

--- old/src/lib/krb5/ccache/cc_file.c	2015-05-08 16:27:02.000000000 -0700

+++ new/src/lib/krb5/ccache/cc_file.c	2015-11-16 15:54:02.138183303 -0800

@@ -64,6 +64,10 @@

 #include "k5-int.h"

 #include "cc-int.h"

+/* Solaris Kerberos */

+#include <syslog.h>

+#include <ctype.h>

+

 #include <stdio.h>

 #include <errno.h>

@@ -71,6 +75,11 @@

 #include <unistd.h>

 #endif

+/* Solaris Kerberos */

+/* How long to block if flock fails with EAGAIN */

+#define    LOCK_RETRIES    100

+#define    WAIT_LENGTH    20    /* in milliseconds */

+

 extern const krb5_cc_ops krb5_cc_file_ops;

 krb5_error_code krb5_change_cache(void);

@@ -85,6 +94,7 @@

 #define FCC_OPEN_AND_ERASE      1

 #define FCC_OPEN_RDWR           2

 #define FCC_OPEN_RDONLY         3

+#define	FCC_OPEN_AND_ERASE_NOUNLINK	255    /* Solaris Kerberos */

 #define FCC_TAG_DELTATIME       1

@@ -524,6 +534,130 @@

     ((SIZE) < BUFSIZE ? (abort(),0) : setbuf(FILE, BUF))

 #endif

+/* Solaris Kerberos */

+static krb5_error_code

+krb5_fcc_open_nounlink(char *filename, int open_flag, int *ret_fd, int *new)

+{

+     struct stat lres;

+     struct stat fres;

+     int error;

+     uid_t uid, euid;

+     int fd;

+     int newfile = 0;

+

+     *ret_fd = -1;

+     /*

+      * Solaris Kerberos

+      * If we are opening in NOUNLINK mode, we have to check that the

+      * existing file, if any, is not a symlink. If it is, we try to

+      * delete and re-create it.

+      */

+     error = lstat(filename, &lres);

+     if (error == -1 && errno != ENOENT) {

+         syslog(LOG_ERR, "lstat failed for %s [%m]", filename);

+         return (-1);

+     }

+

+     if (error == 0 && !S_ISREG(lres.st_mode)) {

+         syslog(LOG_WARNING, "%s is not a plain file!", filename);

+         syslog(LOG_WARNING, "trying to unlink %s", filename);

+         if (unlink(filename) != 0) {

+              syslog(LOG_ERR, "could not unlink %s [%m]", filename);

+              return (-1);

+         }

+     }

+

+     fd = THREEPARAMOPEN(filename, open_flag | O_NONBLOCK | O_NOFOLLOW, 0600);

+     if (fd == -1) {

+         if (errno == ENOENT) {

+              fd = THREEPARAMOPEN(filename, open_flag | O_EXCL | O_CREAT,

+                  0600);

+              if (fd != -1) {

+                  newfile = 1;

+              } else {

+                  /* If the file got created after the open we must retry */

+                  if (errno == EEXIST)

+                      return (0);

+              }

+         } else if (errno == EACCES) {

+            /*

+             * We failed since the file existed with wrong permissions.

+             * Let's try to unlink it and if that succeeds retry.

+             */

+            syslog(LOG_WARNING, "Insufficient permissions on %s", filename);

+            syslog(LOG_WARNING, "trying to unlink %s", filename);

+            if (unlink(filename) != 0) {

+                syslog(LOG_ERR, "could not unlink %s [%m]", filename);

+                return (-1);

+            }

+            return (0);

+        }

+    }

+    /* If we still don't have a valid fd, we stop trying */

+    if (fd == -1)

+        return (-1);

+

+    /*

+     * Solaris Kerberos

+     * If the file was not created now with a O_CREAT | O_EXCL open,

+     * we have opened an existing file. We should check if the file

+     * owner is us, if not, unlink and retry. If unlink fails we log

+     * the error and return.

+     */

+    if (!newfile) {

+        if (fstat(fd, &fres) == -1) {

+            syslog(LOG_ERR, "lstat failed for %s [%m]", filename);

+            close(fd);

+            return (-1);

+        }

+        /* Check if this is the same file we lstat'd earlier */

+        if (lres.st_dev != fres.st_dev || lres.st_ino != fres.st_ino) {

+            syslog(LOG_ERR, "%s changed between stat and open!", filename);

+            close(fd);

+            return (-1);

+        }

+

+        /*

+         * Solaris Kerberos

+         * Check if the cc filename uid matches owner of file.

+         * Expects cc file to be in the form of /tmp/krb5cc_<uid>,

+         * else skip this check.

+         */

+        if (strncmp(filename, "/tmp/krb5cc_", strlen("/tmp/krb5cc_")) == 0) {

+            uid_t fname_uid;

+            char *uidstr = strchr(filename, '_');

+            char *s = NULL;

+

+            /* make sure we have some non-null char after '_' */

+            if (!*++uidstr)

+                goto out;

+

+            /* make sure the uid part is all digits */

+            for (s = uidstr; *s; s++)

+                if (!isdigit(*s))

+                    goto out;

+

+            fname_uid = (uid_t) atoi(uidstr);

+            if (fname_uid != fres.st_uid) {

+                close(fd);

+                syslog(LOG_WARNING, "%s owned by %d instead of %d",

+                    filename, fres.st_uid, fname_uid);

+                syslog(LOG_WARNING, "trying to unlink %s", filename);

+                if (unlink(filename) != 0) {

+                    syslog(LOG_ERR, "could not unlink %s [%m]", filename);

+                    return (-1);

+                }

+                return (0);

+            }

+        }

+    }

+

+out:

+    *new = newfile;

+    *ret_fd = fd;

+    return (0);

+}

+

 /* Open and lock the cache file.  If mode is FCC_OPEN_AND_ERASE, initialize it

  * with a header.  Call with the mutex locked. */

 static krb5_error_code

@@ -538,6 +672,10 @@

     int f, open_flag, lock_flag, cnt;

     char buf[1024];

+    /* Solaris Kerberos */

+    int retries = 0;

+    int newfile = 0;

+

     k5_cc_mutex_assert_locked(context, &data->lock);

     invalidate_cache(data);

@@ -549,6 +687,10 @@

     }

     switch (mode) {

+	/* Solaris Kerberos */

+    case FCC_OPEN_AND_ERASE_NOUNLINK:

+        open_flag = O_RDWR;

+        break;

     case FCC_OPEN_AND_ERASE:

         unlink(data->filename);

         open_flag = O_CREAT | O_EXCL | O_TRUNC | O_RDWR;

@@ -562,7 +704,21 @@

         break;

     }

+fcc_retry:

+    /*

+     * Solaris Kerberos

+     * If we are opening in NOUNLINK mode, check whether we are opening a

+     * symlink or a file owned by some other user and take preventive action.

+     */

+    newfile = 0;

+    if (mode == FCC_OPEN_AND_ERASE_NOUNLINK) {

+     ret = krb5_fcc_open_nounlink(data->filename, open_flag,

+                     &f, &newfile);

+     if (ret == 0 && f == -1)

+          goto fcc_retry;

+    } else {

     f = THREEPARAMOPEN(data->filename, open_flag | O_BINARY, 0600);

+    }

     if (f == NO_FILE) {

         if (errno == ENOENT) {

             ret = KRB5_FCC_NOFILE;

@@ -584,10 +740,26 @@

     ret = krb5_lock_file(context, f, lock_flag);

     if (ret) {

         (void)close(f);

+        if (ret == EAGAIN && retries++ < LOCK_RETRIES) {

+            /* Solaris Kerberos wait some time before retrying */

+            if (poll(NULL, 0, WAIT_LENGTH) == 0)

+                goto fcc_retry;

+        }

+        syslog(LOG_ERR, "Failed to lock %s [%m]", data->filename);

         return ret;

     }

-    if (mode == FCC_OPEN_AND_ERASE) {

+    if (mode == FCC_OPEN_AND_ERASE || mode == FCC_OPEN_AND_ERASE_NOUNLINK) {

+        /*

+         * Solaris Kerberos

+         * If this file was not created, we have to flush existing data.

+         * This will happen only if we are doing an ERASE_NOUNLINK open.

+         */

+        if (newfile == 0 && (ftruncate(f, 0) == -1)) {

+            syslog(LOG_ERR, "ftruncate failed for %s [%m]", data->filename);

+            close(f);

+            return (interpret_errno(context, errno));

+        }

         /* write the version number */

         store_16_be(context->fcc_default_format, fcc_fvno);

         data->version = context->fcc_default_format;

@@ -755,14 +927,16 @@

     k5_cc_mutex_lock(context, &data->lock);

-    MAYBE_OPEN(context, id, FCC_OPEN_AND_ERASE);

+    MAYBE_OPEN(context, id, FCC_OPEN_AND_ERASE_NOUNLINK);

+#if 0

 #if defined(HAVE_FCHMOD) || defined(HAVE_CHMOD)

 #ifdef HAVE_FCHMOD

     st = fchmod(data->fd, S_IRUSR | S_IWUSR);

 #else

     st = chmod(data->filename, S_IRUSR | S_IWUSR);

 #endif

+#endif

     if (st == -1) {

         ret = interpret_errno(context, errno);

         MAYBE_CLOSE(context, id, ret);