[15668] in Kerberos_V5_Development
issue with krb5_prompter_posix() design
daemon@ATHENA.MIT.EDU (Will Fiveash)
Thu Apr 15 16:22:42 2010
Date: Thu, 15 Apr 2010 15:23:14 -0500
From: Will Fiveash <will.fiveash@oracle.com>
To: MIT Kerberos Dev List <krbdev@mit.edu>
Message-ID: <20100415202314.GA22981@sun.com>
Mail-Followup-To: MIT Kerberos Dev List <krbdev@MIT.EDU>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
While debugging some memory leaks relating to my pam_krb5 pkinit work I
noticed a discrepancy between the libkrb krb5_prompter_posix() which
requires callers to allocate the reply data buffer and standard PAM
conversation functions which allocate the reply data buffer and expect
the consumer of the reply data to free() it. Here is a description from
the Solaris Security for Developers Guide on how to write a proper PAM
conversation function:
http://docs.sun.com/app/docs/doc/816-4863/emrbk?a=view
Seems to me the PAM approach is better since it's acquiring the reply.
Anyway this is adding complication to the prompter bridge function I
wrote in pam_krb5 to allow preauth plug-ins like pkinit to prompt via a
PAM conversation function.
--
Will Fiveash
Oracle
Note my new work e-mail address: will.fiveash@oracle.com
http://opensolaris.org/os/project/kerberos/
Sent using mutt, a sweet text based e-mail app: http://www.mutt.org/
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
