[31649] in CVS-changelog-for-Kerberos-V5
krb5 commit: Move krb5.ini from ProgramData to Program Files
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:59:37 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165925.AB8E6105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:59:25 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/55302e26b4db994c6438cd2899562dd9b8ac195c
commit 55302e26b4db994c6438cd2899562dd9b8ac195c
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Sep 30 16:54:47 2026 -0400
Move krb5.ini from ProgramData to Program Files
On Windows, ProgramData (aka CSIDL_COMMON_APPDATA) by default has
permissions allowing any user to create files and directories, and
modify files and directories they have created, similar to /tmp on
UNIX-like systems. This permission model is not suited for krb5.ini,
because the installer cannot reasonably determine whether a
pre-existing krb5.ini (or its containing subdirectories) was placed
there by a previous installation or was pre-created with malicious
contents by an unprivileged user.
Change the default per-machine location for krb5.ini to
%ProgramFiles%\MIT\Kerberos5. This default applies if the filename
is not configured in the registry and no krb5.ini file exists under
%AppData% for the current user.
Discovered by Aisle Research.
ticket: 9245 (new)
tags: pullup
target_version: 1.22-next
src/lib/krb5/os/init_os_ctx.c | 8 +++++---
src/windows/README | 13 ++++++-------
src/windows/installer/wix/files.wxi | 13 +++----------
3 files changed, 14 insertions(+), 20 deletions(-)
diff --git a/src/lib/krb5/os/init_os_ctx.c b/src/lib/krb5/os/init_os_ctx.c
index 2d9951186..a59d3a1be 100644
--- a/src/lib/krb5/os/init_os_ctx.c
+++ b/src/lib/krb5/os/init_os_ctx.c
@@ -165,11 +165,11 @@ cleanup:
static krb5_error_code
get_from_known_folder(
int folderId,
+ const char* software_suffix,
char** pbuffer
)
{
char szPath[MAX_PATH];
- const char * software_suffix = "\\MIT\\Kerberos5";
krb5_error_code retval = 0;
size_t size;
struct _stat s;
@@ -260,12 +260,14 @@ os_get_default_config_files(profile_filespec_t **pfiles, krb5_boolean secure)
}
if (!name && !secure) {
- retval = get_from_known_folder(CSIDL_APPDATA, &name);
+ retval = get_from_known_folder(CSIDL_APPDATA, "\\MIT\\Kerberos5",
+ &name);
if (retval) return retval;
}
if (!name) {
- retval = get_from_known_folder(CSIDL_COMMON_APPDATA, &name);
+ retval = get_from_known_folder(CSIDL_PROGRAM_FILES, "\\MIT\\Kerberos",
+ &name);
if (retval) return retval;
}
diff --git a/src/windows/README b/src/windows/README
index d6766a4f9..48a092123 100644
--- a/src/windows/README
+++ b/src/windows/README
@@ -110,13 +110,12 @@ error), or if you are not building the graphical ticket manager.
Running Kerberos 5 Apps:
-----------------------
-Make sure you have a valid krb5.ini file.
-By default, an empty krb5.ini is installed in CSIDL_COMMON_APPDATA
-(that is, %SystemDrive%\ProgramData\MIT\Kerberos5\ on newer-than-XP).
-(ProgramData is a hidden folder.) You may need to customize it with
-settings for your site, but since DNS lookups are enabled for locating
-KDCs, many sites will not need further customization. The file format is
-identical to that of a Unix krb5.conf file.
+Make sure you have a valid krb5.ini file. By default, an empty
+krb5.ini is installed in %SystemDrive%\Program Files\MIT\Kerberos5\ .
+You may need to customize it with settings for your site, but since
+DNS lookups are enabled for locating KDCs, many sites will not need
+further customization. The file format is identical to that of a Unix
+krb5.conf file.
krb5.ini File:
diff --git a/src/windows/installer/wix/files.wxi b/src/windows/installer/wix/files.wxi
index 675eea803..7a9f5134c 100644
--- a/src/windows/installer/wix/files.wxi
+++ b/src/windows/installer/wix/files.wxi
@@ -64,6 +64,9 @@
<Directory Id="$(var.PIProgramFilesFolder)">
<Directory Id="dirMIT" Name="MIT" SourceName=".">
<Directory Id="KERBEROSDIR" Name="Kerberos">
+ <Component Id="cmf_krb5_ini" Guid="C1AF0670-BBF1-4AA6-B2A6-6C8B1584A1F4" NeverOverwrite="yes" Permanent="yes" DiskId="1">
+ <File Id="fil_krb5_ini" Name="krb5.ini" Source="$(var.ConfigDir)krb5.ini" KeyPath="yes" />
+ </Component>
<Directory Id="dirbin" Name="bin" FileSource="$(var.BinDir)">
<!-- Kerberos V options -->
@@ -379,16 +382,6 @@
</Directory> <!-- /Kerberos -->
</Directory> <!-- /MIT -->
</Directory> <!-- /Program Files -->
- <Directory Id="CommonAppDataFolder" Name="CommonAppDataFolder">
- <Directory Id="APPDATAMITDIR" Name="MIT">
- <Directory Id="APPDATAKERBEROS5DIR" Name="Kerberos5">
- <Component Id="cmf_krb5_ini" Guid="C1AF0670-BBF1-4AA6-B2A6-6C8B1584A1F4" NeverOverwrite="yes" Permanent="yes" DiskId="1">
- <File Id="fil_krb5_ini" Name="krb5.ini" Source="$(var.ConfigDir)krb5.ini" KeyPath="yes" />
- <CreateFolder/>
- </Component>
- </Directory>
- </Directory>
- </Directory>
<!-- Start Menu shortcut -->
<Directory Id="ProgramMenuFolder">
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
