From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
Cc: sfrost@snowman.net <sfrost@snowman.net>
Cc: pgsql-hackers@lists.postgresql.org <pgsql-hackers@lists.postgresql.org>
Subject: Re: Fixing cache pollution in the Kerberos test suite
Date: Mon, 25 Jan 2021 14:36:21 -0500
Message-ID: <1897402.1611603381@sss.pgh.pa.us> (raw)
In-Reply-To: <1895343.1611601474@sss.pgh.pa.us>
References: <1fcb175bafef6560f47a8c31229fa7c938486b8d.camel@vmware.com>
<20210125183645.GF27507@tamriel.snowman.net>
<1894698.1611600541@sss.pgh.pa.us>
<0c0cbc9b9a7a1bcd6e78e5eddf706ddeba0293da.camel@vmware.com>
<1895343.1611601474@sss.pgh.pa.us>
I wrote:
> Jacob Champion <pchampion@vmware.com> writes:
>> Interesting. I'm running Ubuntu 20.04:
> Hmm. I'll poke harder.
Ah ... on both RHEL8 and Fedora 33, I find this:
--- snip ---
$ cat /etc/krb5.conf.d/kcm_default_ccache
# This file should normally be installed by your distribution into a
# directory that is included from the Kerberos configuration file (/etc/krb5.conf)
# On Fedora/RHEL/CentOS, this is /etc/krb5.conf.d/
#
# To enable the KCM credential cache enable the KCM socket and the service:
# systemctl enable sssd-secrets.socket sssd-kcm.socket
# systemctl start sssd-kcm.socket
#
# To disable the KCM credential cache, comment out the following lines.
[libdefaults]
default_ccache_name = KCM:
--- snip ---
Even more interesting, that service seems to be enabled by default
(I'm pretty darn sure I didn't ask for it...)
However, this doesn't seem to explain why the test script isn't
causing a global state change. Whether the state is held in a
file or the sssd daemon shouldn't matter, it seems like.
Also, it looks like the test causes /tmp/krb5cc_<uid> to get
created or updated despite this setting. If I force klist
to look at that:
$ KRB5CCNAME=/tmp/krb5cc_1001 klist
Ticket cache: FILE:/tmp/krb5cc_1001
Default principal: test1@EXAMPLE.COM
Valid starting Expires Service principal
01/25/21 14:31:57 01/26/21 14:31:57 krbtgt/EXAMPLE.COM@EXAMPLE.COM
01/25/21 14:31:57 01/26/21 14:31:57 postgres/auth-test-localhost.postgresql.example.com@
Ticket server: postgres/auth-test-localhost.postgresql.example.com@EXAMPLE.COM
where the time corresponds to my having just run the test again.
So I'm still mightily confused, but it is clear that the test's
kinit is touching a file it shouldn't.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pchampion@vmware.com, sfrost@snowman.net, pgsql-hackers@lists.postgresql.org
Subject: Re: Fixing cache pollution in the Kerberos test suite
In-Reply-To: <1897402.1611603381@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox