[2749] in Kerberos-V5-bugs
krb5-appl/438: login.c uses wrong criteria to set KRB_ENVIRON
daemon@ATHENA.MIT.EDU (Greg Hudson)
Sat Jun 14 15:54:18 1997
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, ghudson@MIT.EDU
Date: Sat, 14 Jun 1997 15:51:37 -0400
From: Greg Hudson <ghudson@MIT.EDU>
Reply-To: ghudson@MIT.EDU
To: krb5-bugs@MIT.EDU
>Number: 438
>Category: krb5-appl
>Synopsis: login.c uses wrong criteria to set KRB_ENVIRON
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Sat Jun 14 15:52:02 EDT 1997
>Last-Modified:
>Originator: Greg Hudson
>Organization:
MIT
>Release: 1.0
>Environment:
Solaris 2.5.1 (Athena 8.1), but not really system-dependent
>Description:
When deciding whether to set KRBTKFILE in the login environment,
src/appl/bsd/login.c checks for "login_krb4_get_tickets &&
tkfile[0]". This is wrong because (a) KRBTKFILE should be set
if login_krb4_convert is true, even if login_krb4_get_tickets is
false, and (b) tkfile[0] is pretty much always true; it's not a
good indicator of whether we got tickets above.
The simple fix is to test for tkfile[0]. However, another problem
remains. If login is called with the -p option (which is the
normal behavior), then KRBTKFILE will remain set from when it was
set in k_init(). To fix that, I think you need to remember the
old value of KRBTKFILE and reset it if tickets are not acquired
>How-To-Repeat:
rlogin to a krb5 host which has login_krb4_get_tickets set,
don't acquire v4 tickets, and notice that KRBTKFILE is set.
Modify krlogind to invoke login without the -p option. rlogin
to a krb5 host with the modified krlogind and which has
login_krb4_convert true but not login_krb4_get_tickets. Forward
your v5 tickets. Notice that KRBTKFILE is not set.
rlogin to a krb5 host with the unmodified krlogind and which has
login_krb4_convert true but not login_krb4_get_tickets. Don't
forward your v5 tickets. Notice that KRBTKFILE is still set
even though it wasn't set up in the login environment (because
login_krb4_get_tickets is not true)
>Fix:
Here is the fix for the simple problem. Please get back to me
when the more complicated problem is fixed, so that I can apply
exactly the same patch to the Athena krb5 sources as you guys
use.
Index: login.c
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/appl/bsd/login.c,v
retrieving revision 1.4
diff -c -r1.4 login.c
*** login.c 1997/04/01 00:26:05 1.4
--- login.c 1997/06/14 18:49:55
***************
*** 1852,1858 ****
(void)setenv("TERM", term, 0);
#ifdef KRB4_GET_TICKETS
/* tkfile[0] is only set if we got tickets above */
! if (login_krb4_get_tickets && tkfile[0])
(void) setenv(KRB_ENVIRON, tkfile, 1);
#endif /* KRB4_GET_TICKETS */
#ifdef KRB5_GET_TICKETS
--- 1852,1858 ----
(void)setenv("TERM", term, 0);
#ifdef KRB4_GET_TICKETS
/* tkfile[0] is only set if we got tickets above */
! if (got_v4_tickets)
(void) setenv(KRB_ENVIRON, tkfile, 1);
#endif /* KRB4_GET_TICKETS */
#ifdef KRB5_GET_TICKETS
>Audit-Trail:
>Unformatted:
