diff options
| author | Jeff Layton <jlayton@samba.org> | 2017-02-23 18:28:24 -0500 |
|---|---|---|
| committer | Jeff Layton <jlayton@samba.org> | 2017-02-24 07:12:14 -0500 |
| commit | 2dcecd21262513a0866c321643fc33d3d0135915 (patch) | |
| tree | b192e7f4f419961f9cbff148bb46e2caa056c651 | |
| parent | 891d7806ac153e7d99b324ed9a33ff92699a92c6 (diff) | |
| download | cifs-utils-2dcecd21262513a0866c321643fc33d3d0135915.tar.gz cifs-utils-2dcecd21262513a0866c321643fc33d3d0135915.tar.bz2 cifs-utils-2dcecd21262513a0866c321643fc33d3d0135915.zip | |
cifs.upcall: unset $KRB5CCNAME when creating new credcache from keytab
We don't want to trust $KRB5CCNAME when creating or updating a new
credcache since we could be operating under the wrong credentials.
Always create new credcaches in the default location instead.
Reported-by: Chad William Seys <cwseys@physics.wisc.edu>
Signed-off-by: Jeff Layton <jlayton@samba.org>
| -rw-r--r-- | cifs.upcall.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/cifs.upcall.c b/cifs.upcall.c index 15e1e0f..0c89d7c 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -379,6 +379,12 @@ init_cc_from_keytab(const char *keytab_name, const char *user) memset((char *) &my_creds, 0, sizeof(my_creds)); + /* + * Unset the environment variable, if any. If we're creating our own + * credcache here, stick it in the default location. + */ + unsetenv(ENV_NAME); + if (keytab_name) ret = krb5_kt_resolve(context, keytab_name, &keytab); else |