Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1l47f2-00019P-SP
	for pgsql-hackers@arkaria.postgresql.org; Mon, 25 Jan 2021 19:36:28 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1l47f1-0006Wi-4W
	for pgsql-hackers@arkaria.postgresql.org; Mon, 25 Jan 2021 19:36:27 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1l47f0-0006Wb-Ty
	for pgsql-hackers@lists.postgresql.org; Mon, 25 Jan 2021 19:36:26 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1l47ew-0005v8-EU
	for pgsql-hackers@lists.postgresql.org; Mon, 25 Jan 2021 19:36:25 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 10PJaL6D1897403;
	Mon, 25 Jan 2021 14:36:21 -0500
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <pchampion@vmware.com>
cc: "sfrost@snowman.net" <sfrost@snowman.net>,
        "pgsql-hackers@lists.postgresql.org"
 <pgsql-hackers@lists.postgresql.org>
Subject: Re: Fixing cache pollution in the Kerberos test suite
In-reply-to: <1895343.1611601474@sss.pgh.pa.us>
References: <1fcb175bafef6560f47a8c31229fa7c938486b8d.camel@vmware.com>
 <20210125183645.GF27507@tamriel.snowman.net>
 <1894698.1611600541@sss.pgh.pa.us>
 <0c0cbc9b9a7a1bcd6e78e5eddf706ddeba0293da.camel@vmware.com>
 <1895343.1611601474@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Mon, 25 Jan 2021 14:04:34 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1897401.1611603381.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 25 Jan 2021 14:36:21 -0500
Message-ID: <1897402.1611603381@sss.pgh.pa.us>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Precedence: bulk

I wrote:
> Jacob Champion <pchampion@vmware.com> writes:
>> Interesting. I'm running Ubuntu 20.04:

> Hmm.  I'll poke harder.

Ah ... on both RHEL8 and Fedora 33, I find this:

--- snip ---
$ cat /etc/krb5.conf.d/kcm_default_ccache
# This file should normally be installed by your distribution into a
# directory that is included from the Kerberos configuration file (/etc/kr=
b5.conf)
# On Fedora/RHEL/CentOS, this is /etc/krb5.conf.d/
#
# To enable the KCM credential cache enable the KCM socket and the service=
:
#   systemctl enable sssd-secrets.socket sssd-kcm.socket
#   systemctl start sssd-kcm.socket
#
# To disable the KCM credential cache, comment out the following lines.

[libdefaults]
    default_ccache_name =3D KCM:
--- snip ---

Even more interesting, that service seems to be enabled by default
(I'm pretty darn sure I didn't ask for it...)

However, this doesn't seem to explain why the test script isn't
causing a global state change.  Whether the state is held in a
file or the sssd daemon shouldn't matter, it seems like.

Also, it looks like the test causes /tmp/krb5cc_<uid> to get
created or updated despite this setting.  If I force klist
to look at that:

$ KRB5CCNAME=3D/tmp/krb5cc_1001 klist
Ticket cache: FILE:/tmp/krb5cc_1001
Default principal: test1@EXAMPLE.COM

Valid starting     Expires            Service principal
01/25/21 14:31:57  01/26/21 14:31:57  krbtgt/EXAMPLE.COM@EXAMPLE.COM
01/25/21 14:31:57  01/26/21 14:31:57  postgres/auth-test-localhost.postgre=
sql.example.com@
        Ticket server: postgres/auth-test-localhost.postgresql.example.com=
@EXAMPLE.COM

where the time corresponds to my having just run the test again.

So I'm still mightily confused, but it is clear that the test's
kinit is touching a file it shouldn't.

			regards, tom lane