From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Jacob Champion <pchampion@vmware.com>, pgsql-hackers@lists.postgresql.org
Subject: Re: Fixing cache pollution in the Kerberos test suite
In-reply-to: <20210125183645.GF27507@tamriel.snowman.net>
References: <1fcb175bafef6560f47a8c31229fa7c938486b8d.camel@vmware.com>
 <20210125183645.GF27507@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Mon, 25 Jan 2021 13:36:46 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1894697.1611600541.1@sss.pgh.pa.us>
Date: Mon, 25 Jan 2021 13:49:01 -0500
Message-ID: <1894698.1611600541@sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> * Jacob Champion (pchampion@vmware.com) wrote:
>> I was running tests with a GSS-enabled stack, and ran into some very
>> long psql timeouts after running the Kerberos test suite. It turns out
>> the suite pushes test credentials into the user's global cache, and
>> these no-longer-useful credentials persist after the suite has
>> finished. (You can see this in action by running the test/kerberos
>> suite and then running `klist`.) This leads to long hangs, I assume
>> while the GSS implementation tries to contact a KDC that no longer
>> exists.
>> Attached is a patch that initializes a local credentials cache inside
>> tmp_check/krb5cc, and tells psql to use it via the KRB5CCNAME envvar.
>> This prevents the global cache pollution. WDYT?

> Ah, yeah, that generally seems like a good idea.

Yeah, changing global state is just awful.  However, I don't
actually see any change here (RHEL8):

$ klist
klist: Credentials cache 'KCM:1001' not found
$ make check
...
Result: PASS
$ klist
klist: Credentials cache 'KCM:1001' not found

I suppose in an environment where someone was really using Kerberos,
the random kinit would be more of a problem.

Also, why are you only setting the ENV variable within narrow parts
of the test script?  I'd be inclined to enforce it throughout.

			regards, tom lane