From b67d0cec8adc2c43e274c60e8a838cf63f06d206 Mon Sep 17 00:00:00 2001 From: Sam Hartman Date: Sat, 21 Sep 1996 09:26:07 +0000 Subject: [PATCH] Preliminary fixed version of patch to deal with reading in credentials and writing them out later. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@9101 dc483132-0cff-0310-8789-dd5450dbe970 --- src/appl/bsd/ChangeLog | 12 ++++++++++++ src/appl/bsd/login.c | 43 +++++++++++++++++++++++++----------------- 2 files changed, 38 insertions(+), 17 deletions(-) diff --git a/src/appl/bsd/ChangeLog b/src/appl/bsd/ChangeLog index e6d6bd602..b41f87fa9 100644 --- a/src/appl/bsd/ChangeLog +++ b/src/appl/bsd/ChangeLog @@ -1,3 +1,15 @@ +Fri Sep 20 18:23:53 1996 Sam Hartman + + * login.c: Update so that we try to convert krb524 tickets after + we setuid(), and so that we don't hard fail if cache writeout + fail. + +Fri Sep 20 17:35:22 1996 Sam Hartman + + * login.c: Check to see if we got krb5 tickets at all times, + regardless of wether we are converting to krb4. This helps us + know when to kdestroy. + Wed Sep 11 17:27:02 1996 Barry Jaspan * login.c: fix a security-threating race condition: chown'ing the diff --git a/src/appl/bsd/login.c b/src/appl/bsd/login.c index 6cffb27aa..e398f1b62 100644 --- a/src/appl/bsd/login.c +++ b/src/appl/bsd/login.c @@ -1157,6 +1157,7 @@ int main(argc, argv) char *ttyname(), *stypeof(), *crypt(), *getpass(); time_t login_time; int retval; +int rewrite_ccache = 1; /*try to write out ccache*/ #ifdef KRB5_GET_TICKETS krb5_principal me; krb5_creds save_v5creds; @@ -1567,13 +1568,15 @@ int main(argc, argv) (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid); (void)chmod(ttyn, 0620); +#ifdef KRB5_GET_TICKETS + /* Maybe telnetd got tickets for us? */ + if (!got_v5_tickets && have_v5_tickets (&me)) + got_v5_tickets = 1; +#endif /*gET_KRB%_TICKETS/*/ #ifdef KRB4_GET_TICKETS - if (login_krb4_get_tickets && login_krb4_convert && !got_v4_tickets) { + if ( login_krb4_convert && !got_v4_tickets) { - /* Maybe telnetd got tickets for us? */ - if (!got_v5_tickets && have_v5_tickets (&me)) - got_v5_tickets = 1; if (got_v5_tickets) try_convert524 (kcontext, me); @@ -1677,17 +1680,18 @@ int main(argc, argv) syslog(LOG_ERR, "%s while creating V5 krbtgt principal", error_message(retval)); - sleepexit(1); + goto skip_ccache_rewrite; } - mcreds.ticket_flags = TKT_FLG_INITIAL; + + mcreds.ticket_flags =0; if (retval = krb5_cc_retrieve_cred(kcontext, ccache, - KRB5_TC_MATCH_FLAGS, + 0, &mcreds, &save_v5creds)) { syslog(LOG_ERR, "%s while retrieiving V5 initial ticket for copy", error_message(retval)); - sleepexit(1); + goto skip_ccache_rewrite; } krb5_free_principal(kcontext, mcreds.server); } @@ -1701,12 +1705,14 @@ int main(argc, argv) syslog(LOG_ERR, "%s while retrieving V4 initial ticket for copy", error_message(retval)); - sleepexit(1); + skip_ccache_rewrite: rewrite_ccache = 0; + } } #endif /* KRB4_GET_TICKETS */ #if defined(KRB5_GET_TICKETS) || defined(KRB4_GET_TICKETS) - destroy_tickets(); + if (got_v5_tickets || got_v4_tickets) + destroy_tickets(); #endif #ifdef OQUOTA @@ -1731,6 +1737,7 @@ int main(argc, argv) #ifdef _IBMR2 setuidx(ID_LOGIN, pwd->pw_uid); #endif + if(setuid((uid_t) pwd->pw_uid) < 0) { perror("setuid"); sleepexit(1); @@ -1741,31 +1748,31 @@ int main(argc, argv) * ticket file. */ #ifdef KRB5_GET_TICKETS - if (got_v5_tickets) { + if (got_v5_tickets && rewrite_ccache) { retval = krb5_cc_initialize (kcontext, ccache, me); if (retval) { syslog(LOG_ERR, "%s while re-initializing V5 ccache as user", error_message(retval)); - sleepexit(1); + goto skip_ccache_output; } if (retval = krb5_cc_store_cred(kcontext, ccache, &save_v5creds)) { syslog(LOG_ERR, "%s while re-storing V5 credentials as user", error_message(retval)); - sleepexit(1); + } - krb5_free_cred_contents(kcontext, &save_v5creds); + skip_ccache_output: krb5_free_cred_contents(kcontext, &save_v5creds); } #endif /* KRB5_GET_TICKETS */ #ifdef KRB4_GET_TICKETS - if (got_v4_tickets) { + if (got_v4_tickets&&rewrite_ccache) { retval = in_tkt(save_v4creds.pname, save_v4creds.pinst); if (retval != KSUCCESS) { syslog(LOG_ERR, "%s while re-initializing V4 ticket cache as user", error_message(retval)); - sleepexit(1); + goto skip_output_tkfile; } retval = krb_save_credentials(save_v4creds.service, save_v4creds.instance, @@ -1779,11 +1786,13 @@ int main(argc, argv) syslog(LOG_ERR, "%s while re-storing V4 tickets as user", error_message(retval)); - sleepexit(1); + } + skip_output_tkfile: /*null*/; } #endif /* KRB4_GET_TICKETS */ + if (*pwd->pw_shell == '\0') pwd->pw_shell = BSHELL; #if defined(NTTYDISC) && defined(TIOCSETD) -- 2.26.2