[31643] in CVS-changelog-for-Kerberos-V5
krb5 commit: Check for cache copy error in kfwlogon
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:59:03 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165858.A114C105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:58:58 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/9c71a68596bc25b4b7373f475252a4baa17ed26c
commit 9c71a68596bc25b4b7373f475252a4baa17ed26c
Author: Greg Hudson <ghudson@mit.edu>
Date: Fri Sep 11 20:32:06 2026 -0400
Check for cache copy error in kfwlogon
Add a return status to KFW_copy_cache_to_system_file(). If it returns
an error to NPLogonNotify(), do not continue processing; otherwise
kfwlogon could potentially set ACL rights on a file it didn't create.
Discovered by Aisle Research.
ticket: 9236 (new)
tags: pullup
target_version: 1.22-next
src/windows/kfwlogon/kfwcommon.c | 12 +++++++++---
src/windows/kfwlogon/kfwlogon.c | 6 ++++--
src/windows/kfwlogon/kfwlogon.h | 2 +-
3 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/src/windows/kfwlogon/kfwcommon.c b/src/windows/kfwlogon/kfwcommon.c
index b7ffbbdde..6510e32ce 100644
--- a/src/windows/kfwlogon/kfwcommon.c
+++ b/src/windows/kfwlogon/kfwcommon.c
@@ -950,8 +950,9 @@ int KFW_obtain_user_temp_directory(HANDLE hUserToken, char *newfilename, int siz
return 0;
}
-void
-KFW_copy_cache_to_system_file(const char * user, const char * filename)
+int
+KFW_copy_cache_to_system_file(const char * user, const char * filename,
+ char **reason_out)
{
char cachename[MAX_PATH + 8] = "FILE:";
krb5_context ctx = 0;
@@ -962,7 +963,7 @@ KFW_copy_cache_to_system_file(const char * user, const char * filename)
PSECURITY_ATTRIBUTES pSA = NULL;
if (!pkrb5_init_context || !user || !filename)
- return;
+ return EINVAL;
strncat(cachename, filename, sizeof(cachename));
cachename[sizeof(cachename)-1] = '\0';
@@ -1007,6 +1008,11 @@ KFW_copy_cache_to_system_file(const char * user, const char * filename)
if (ctx)
pkrb5_free_context(ctx);
+
+ if (code && reason_out != NULL)
+ *reason_out = (char *)perror_message(code);
+
+ return code;
}
int
diff --git a/src/windows/kfwlogon/kfwlogon.c b/src/windows/kfwlogon/kfwlogon.c
index 55dd026d1..f9213109a 100644
--- a/src/windows/kfwlogon/kfwlogon.c
+++ b/src/windows/kfwlogon/kfwlogon.c
@@ -195,7 +195,7 @@ DWORD APIENTRY NPLogonNotify(
DWORD code = 0;
- char *reason;
+ char *reason = "(unknown reason)";
char *ctemp;
BOOLEAN interactive = TRUE;
@@ -307,7 +307,9 @@ DWORD APIENTRY NPLogonNotify(
goto cleanup;
}
- KFW_copy_cache_to_system_file(uname, filename);
+ code = KFW_copy_cache_to_system_file(uname, filename, &reason);
+ if (code)
+ goto cleanup;
/* Need to determine the SID */
diff --git a/src/windows/kfwlogon/kfwlogon.h b/src/windows/kfwlogon/kfwlogon.h
index 44749cdf7..cc7a42ffc 100644
--- a/src/windows/kfwlogon/kfwlogon.h
+++ b/src/windows/kfwlogon/kfwlogon.h
@@ -201,7 +201,7 @@ static BOOL WINAPI UnicodeStringToANSI(UNICODE_STRING uInputString, LPSTR lpszOu
int KFW_is_available(void);
int KFW_get_cred( char * username, char * password, int lifetime, char ** reasonP );
-void KFW_copy_cache_to_system_file(const char * user, const char * filename);
+int KFW_copy_cache_to_system_file(const char * user, const char * filename, char **reason_out);
int KFW_destroy_tickets_for_principal(char * user);
int KFW_set_ccache_dacl(char *filename, HANDLE hUserToken);
int KFW_set_ccache_dacl_with_user_sid(char *filename, PSID pUserSID);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
