From bb1793f369fc486362d3d540eaa19799164d717f Mon Sep 17 00:00:00 2001

From: Nalin Dahyabhai <nalin@redhat.com>

Date: Thu, 31 Oct 2013 15:43:49 -0400

Subject: [PATCH 3/6] Learn to destroy the ccache we're copying from

Add a flag to krb5_ccache_copy() which will instruct it to destroy a

source ccache after reading its contents.  Using this when we copy the

creds from a MEMORY cache to somewhere else is necessary to avoid having

a subsequent call to krb5_cc_cache_match() select the MEMORY cache when

we're trying to have it search a different location by default.

---

 src/clients/ksu/ccache.c | 10 +++++++++-

 src/clients/ksu/ksu.h    |  2 +-

 src/clients/ksu/main.c   |  5 +++--

 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c

index 7917af2..90ba2f2 100644

--- a/src/clients/ksu/ccache.c

+++ b/src/clients/ksu/ccache.c

@@ -47,12 +47,14 @@ void show_credential();

 */

 krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag,

-                                  primary_principal, cc_out, stored, target_uid)

+                                  primary_principal, destroy_def,

+                                  cc_out, stored, target_uid)

 /* IN */

     krb5_context context;

     krb5_ccache cc_def;

     char *cc_other_tag;

     krb5_principal primary_principal;

+    krb5_boolean destroy_def;

     uid_t target_uid;

     /* OUT */

     krb5_ccache *cc_out;

@@ -80,6 +82,12 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag,

         }

     }

+    if (destroy_def) {

+        retval = krb5_cc_destroy(context, cc_def);

+        if (retval)

+            return retval;

+    }

+

     *stored = krb5_find_princ_in_cred_list(context, cc_def_creds_arr,

                                            primary_principal);

diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h

index 1d102a1..a889fb9 100644

--- a/src/clients/ksu/ksu.h

+++ b/src/clients/ksu/ksu.h

@@ -108,7 +108,7 @@ extern krb5_error_code get_best_principal

 /* ccache.c */

 extern krb5_error_code krb5_ccache_copy

 (krb5_context, krb5_ccache, char *, krb5_principal,

- krb5_ccache *, krb5_boolean *, uid_t);

+ krb5_boolean, krb5_ccache *, krb5_boolean *, uid_t);

 extern krb5_error_code krb5_store_all_creds

 (krb5_context, krb5_ccache, krb5_creds **, krb5_creds **);

diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c

index fa86c78..7497a2b 100644

--- a/src/clients/ksu/main.c

+++ b/src/clients/ksu/main.c

@@ -28,6 +28,7 @@

 #include "ksu.h"

 #include "adm_proto.h"

+#include "../../lib/krb5/os/os-proto.h"

 #include <sys/types.h>

 #include <sys/wait.h>

 #include <signal.h>

@@ -481,7 +482,7 @@ main (argc, argv)

     } else {

         retval = krb5_ccache_copy(ksu_context, cc_source, KRB5_TEMPORARY_CACHE,

-                                  client, &cc_tmp, &stored, 0);

+                                  client, FALSE, &cc_tmp, &stored, 0);

         if (retval) {

             com_err(prog_name, retval, _("while copying cache %s to %s"),

                     krb5_cc_get_name(ksu_context, cc_source),

@@ -758,7 +759,7 @@ main (argc, argv)

     }

     retval = krb5_ccache_copy(ksu_context, cc_tmp, cc_target_tag,

-                              client, &cc_target, &stored,

+                              client, TRUE, &cc_target, &stored,

                               target_pwd->pw_uid);

     if (retval) {

         com_err(prog_name, retval, _("while copying cache %s to %s"),

-- 

1.8.4.2