Add environment variable for GSS mech config

If the environment variable GSS_MECH_CONFIG is set (and the process is
not privileged), read it instead of /etc/gss/mech or files within
/etc/gss/mech.d.

Set GSS_MECH_CONFIG in test frameworks so that system configuration
does not interfere with tests.

Fix documentation to indicate that the default mech config file is in
sysconfdir, not necessarily /etc.

ticket: 8833 (new)

diff --git a/doc/admin/host_config.rst b/doc/admin/host_config.rst
index 6df250406dec6e5aab2dad73db7a56c1ea9c8827..e186dd4686d2d8a6e5ee061103c7f7419290878a 100644 (file)
--- a/doc/admin/host_config.rst
+++ b/doc/admin/host_config.rst
@@ -199,10 +199,9 @@ GSSAPI mechanism modules
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
 GSSAPI mechanism modules are registered using the file
-``/etc/gss/mech`` or configuration files in the ``/etc/gss/mech.d/``
-directory.  Only files with a ``.conf`` suffix will be read from the
-``/etc/gss/mech.d/`` directory.  Each line in these files has the
-form::
+|sysconfdir|\ ``/gss/mech`` or configuration files in the
+|sysconfdir|\ ``/gss/mech.d`` directory with a ``.conf``
+suffix.  Each line in these files has the form::
 
     oid  pathname  [options]  <type>
 
@@ -214,6 +213,9 @@ options provided to the plugin module, surrounded in square brackets.
 Currently the only special module type is "interposer", for a module
 designed to intercept calls to other mechanisms.
 
+If the environment variable **GSS_MECH_CONFIG** is set, its value is
+used as the sole mechanism configuration filename.
+
 
 .. _profile_plugin_config:
 

diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst
index 65d904ef6cff0a82e72d31fcad8378e195f74422..58f4f161229e938b31c1f3b0bef9d78721b45083 100644 (file)
--- a/doc/mitK5defaults.rst
+++ b/doc/mitK5defaults.rst
@@ -14,6 +14,7 @@ Client :ref:`keytab_definition` file        |ckeytab|                      **KRB
 Kerberos config file :ref:`krb5.conf(5)`    |krb5conf|\ ``:``\             **KRB5_CONFIG**
                                             |sysconfdir|\ ``/krb5.conf``
 KDC config file :ref:`kdc.conf(5)`          |kdcdir|\ ``/kdc.conf``        **KRB5_KDC_PROFILE**
+GSS mechanism config file                   |sysconfdir|\ ``/gss.mech``    **GSS_MECH_CONFIG**
 KDC database path (DB2)                     |kdcdir|\ ``/principal``
 Master key :ref:`stash_definition`          |kdcdir|\ ``/.k5.``\ *realm*
 Admin server ACL file :ref:`kadm5.acl(5)`   |kdcdir|\ ``/kadm5.acl``

diff --git a/doc/plugindev/gssapi.rst b/doc/plugindev/gssapi.rst
index 34fc9e48457082eb8f4ca51b9ea4caa1f52b1c9e..28e62ae8c976285689d998e1adf4bf8cb76cdf08 100644 (file)
--- a/doc/plugindev/gssapi.rst
+++ b/doc/plugindev/gssapi.rst
@@ -9,8 +9,7 @@ the set of built-in mechanisms.
 
 A mechanism module is a Unix shared object or Windows DLL, built
 separately from the krb5 tree.  Modules are loaded according to the
-``/etc/gss/mech`` or ``/etc/gss/mech.d/*.conf`` config files, as
-described in :ref:`gssapi_plugin_config`.
+GSS mechanism config files described in :ref:`gssapi_plugin_config`.
 
 For the most part, a GSSAPI mechanism module exports the same
 functions as would a GSSAPI implementation itself, with the same
@@ -45,10 +44,10 @@ with the following signature::
     gss_OID_set gss_mech_interposer(gss_OID mech_type);
 
 This function is invoked with the OID of the interposer mechanism as
-specified in ``/etc/gss/mech`` or in a ``/etc/gss/mech.d/*.conf``
-file, and returns a set of mechanism OIDs to be interposed.  The
-returned OID set must have been created using the mechglue's
-gss_create_empty_oid_set and gss_add_oid_set_member functions.
+specified in the mechanism config file, and returns a set of mechanism
+OIDs to be interposed.  The returned OID set must have been created
+using the mechglue's gss_create_empty_oid_set and
+gss_add_oid_set_member functions.
 
 An interposer module must use the prefix ``gssi_`` for the GSSAPI
 functions it exports, instead of the prefix ``gss_``.

diff --git a/doc/user/user_config/kerberos.rst b/doc/user/user_config/kerberos.rst
index bcb79d9aad996170e629ccdf993d66b799d56e12..1830447a2abda9777d5185ee616eac7fc420ebe3 100644 (file)
--- a/doc/user/user_config/kerberos.rst
+++ b/doc/user/user_config/kerberos.rst
@@ -142,6 +142,12 @@ programs.  These include:
 **KPROP_PORT**
     :ref:`kprop(8)` port to use.  Defaults to 754.
 
+**GSS_MECH_CONFIG**
+    Specifies a filename containing GSSAPI mechanism module
+    configuration.  The default is to read |sysconfdir|\ ``/gss/mech``
+    and files with a ``.conf`` suffix within the directory
+    |sysconfdir|\ ``/gss/mech.d``.
+
 Most environment variables are disabled for certain programs, such as
 login system programs and setuid programs, which are designed to be
 secure when run within an untrusted process environment.

diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin
index 8c29bb996e6d3e147872466a6680adbe3d55dc08..084dadccc312d611780a216df0382c2fb22ccd0a 100755 (executable)
--- a/src/kadmin/testing/scripts/env-setup.shin
+++ b/src/kadmin/testing/scripts/env-setup.shin
@@ -82,6 +82,7 @@ KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE
 KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME
 KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME
 KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME
+GSS_MECH_CONFIG=$K5ROOT/mech.conf; export GSS_MECH_CONFIG
 
 # Make sure we don't get confused by translated messages
 # or localized times.

diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db
index 2496be2aba1cd902fddfdd74134884bb259c0c85..c3a14994a5eeea01fe56e2e9b16f4bd5edeff720 100755 (executable)
--- a/src/kadmin/testing/scripts/init_db
+++ b/src/kadmin/testing/scripts/init_db
@@ -225,6 +225,7 @@ setenv KRB5_CONFIG $KRB5_CONFIG
 setenv KRB5_KDC_PROFILE $KRB5_KDC_PROFILE
 setenv KRB5_KTNAME $KRB5_KTNAME
 setenv KRB5_CLIENT_KTNAME $KRB5_CLIENT_KTNAME
+setenv GSS_MECH_CONFIG $GSS_MECH_CONFIG
 $KRB5_RUN_ENV_CSH
 EOF
 

diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
index 0ad11c0b029bca5be2919e1d4f1e5512dc061344..394869e27a0ffe225cb434fae67faa05de2db27f 100644 (file)
--- a/src/lib/gssapi/mechglue/g_initialize.c
+++ b/src/lib/gssapi/mechglue/g_initialize.c
@@ -473,12 +473,19 @@ loadConfigFiles()
        glob_t globbuf;
        time_t highest = 0, now;
        char **path;
+       const char *val;
 
        /* Don't glob and stat more than once per second. */
        if (time(&now) == (time_t)-1 || now == g_confLastCall)
                return;
        g_confLastCall = now;
 
+       val = secure_getenv("GSS_MECH_CONFIG");
+       if (val != NULL) {
+               load_if_changed(val, g_confFileModTime, &g_confFileModTime);
+               return;
+       }
+
        load_if_changed(MECH_CONF, g_confFileModTime, &highest);
 
        memset(&globbuf, 0, sizeof(globbuf));

diff --git a/src/man/kerberos.man b/src/man/kerberos.man
index a109538fade4963a60eaa7c2e99f9bb2c0fcef0f..effdd8e7562884394e74a0ebe1e58f57669b0acc 100644 (file)
--- a/src/man/kerberos.man
+++ b/src/man/kerberos.man
@@ -174,6 +174,12 @@ used).
 .TP
 \fBKPROP_PORT\fP
 kprop(8) port to use.  Defaults to 754.
+.TP
+\fBGSS_MECH_CONFIG\fP
+Specifies a filename containing GSSAPI mechanism module
+configuration.  The default is to read \fB@SYSCONFDIR@\fP\fB/gss/mech\fP
+and files with a \fB\&.conf\fP suffix within the directory
+\fB@SYSCONFDIR@\fP\fB/gss/mech.d\fP\&.
 .UNINDENT
 .sp
 Most environment variables are disabled for certain programs, such as

diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
index 88545e3205b5bd37f0e5b955b61ca6edb9124445..81ca4cbb5c563fe9507cd17c09058e4d5a6e9044 100644 (file)
--- a/src/tests/Makefile.in
+++ b/src/tests/Makefile.in
@@ -4,7 +4,7 @@ SUBDIRS = resolve asn.1 create hammer verify gssapi dejagnu shlib \
        gss-threads misc threads softpkcs11
 
 RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \
-       LC_ALL=C $(VALGRIND)
+       GSS_MECH_CONFIG=mech.conf LC_ALL=C $(VALGRIND)
 
 OBJS= adata.o etinfo.o forward.o gcred.o hist.o hooks.o hrealm.o \
        icinterleave.o icred.o kdbtest.o localauth.o plugorder.o rdreq.o \

diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
index 93e2fb0f508b7c228331909c476e11926f7cdf22..4cd7775c096b9bfdb4e05c5be9760e5a340447d6 100644 (file)
--- a/src/tests/dejagnu/config/default.exp
+++ b/src/tests/dejagnu/config/default.exp
@@ -470,6 +470,7 @@ proc envstack_pop { } {
 #
 set envvars_tosave {
     KRB5_CONFIG KRB5CCNAME KRB5_CLIENT_KTNAME KRB5RCACHEDIR KRB5_KDC_PROFILE
+    GSS_MECH_CONFIG
 }
 set krb5_init_vars [list ]
 # XXX -- fix me later!
@@ -853,6 +854,12 @@ if [ info exists env(KRB5RCACHEDIR)] {
     catch "unset orig_krb5rcachedir"
 }
 
+if [ info exists env(GSS_MECH_CONFIG)] {
+    set orig_gss_mech_config $env(GSS_MECH_CONFIG)
+} else {
+    catch "unset orig_gss_mech_config"
+}
+
 # setup_kerberos_env
 # Set the environment variables needed to run Kerberos programs.
 
@@ -883,6 +890,11 @@ proc setup_kerberos_env { {type client} } {
     set env(KRB5RCACHEDIR) $tmppwd
     verbose "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"
 
+    # Direct the GSS library at a nonexistent file in the temporary
+    # directory, to avoid interference from system configuration.
+    set env(GSS_MECH_CONFIG) $tmppwd/mech.conf
+    verbose "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"
+
     # Get the run time environment variables... (including LD_LIBRARY_PATH)
     setup_runtime_env
 
@@ -905,6 +917,7 @@ proc setup_kerberos_env { {type client} } {
        puts $envfile "KRB5CCNAME=$env(KRB5CCNAME)"
        puts $envfile "KRB5_CLIENT_KTNAME=$env(KRB5_CLIENT_KTNAME)"
        puts $envfile "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"
+       puts $envfile "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"
        if [info exists env(KRB5_KDC_PROFILE)] {
            puts $envfile "KRB5_KDC_PROFILE=$env(KRB5_KDC_PROFILE)"
        } else {
@@ -912,6 +925,7 @@ proc setup_kerberos_env { {type client} } {
        }
        puts $envfile "export KRB5_CONFIG KRB5CCNAME KRB5RCACHEDIR"
        puts $envfile "export KRB5_KDC_PROFILE KRB5_CLIENT_KTNAME"
+       puts $envfile "export GSS_MECH_CONFIG"
        foreach i $krb5_init_vars {
                regexp "^(\[^=\]*)=(.*)" $i foo evar evalue
                puts $envfile "$evar=$env($evar)"
@@ -925,6 +939,7 @@ proc setup_kerberos_env { {type client} } {
        puts $envfile "setenv KRB5CCNAME $env(KRB5CCNAME)"
        puts $envfile "setenv KRB5_CLIENT_KTNAME $env(KRB5_CLIENT_KTNAME)"
        puts $envfile "setenv KRB5RCACHEDIR $env(KRB5RCACHEDIR)"
+       puts $envfile "setenv GSS_MECH_CONFIG $env(GSS_MECH_CONFIG)"
        if [info exists env(KRB5_KDC_PROFILE)] {
            puts $envfile "setenv KRB5_KDC_PROFILE $env(KRB5_KDC_PROFILE)"
        } else {

diff --git a/src/util/k5test.py b/src/util/k5test.py
index 2a042ff8cfb5e8b365a94e141bfa23b428910e96..89ebacd349b99fc18fd89f58ea6426624ed9b074 100644 (file)
--- a/src/util/k5test.py
+++ b/src/util/k5test.py
@@ -884,6 +884,7 @@ class K5Realm(object):
         self.keytab = os.path.join(self.testdir, 'keytab')
         self.client_keytab = os.path.join(self.testdir, 'client_keytab')
         self.ccache = os.path.join(self.testdir, 'ccache')
+        self.gss_mech_config = os.path.join(self.testdir, 'mech.conf')
         self.kadmin_ccache = os.path.join(self.testdir, 'kadmin_ccache')
         self._krb5_conf = _cfg_merge(_default_krb5_conf, krb5_conf)
         base_kdc_conf = _default_kdc_conf
@@ -1002,6 +1003,7 @@ class K5Realm(object):
         env['KRB5RCACHEDIR'] = self.testdir
         env['KPROPD_PORT'] = str(self.kprop_port())
         env['KPROP_PORT'] = str(self.kprop_port())
+        env['GSS_MECH_CONFIG'] = self.gss_mech_config
         return env
 
     def run(self, args, env=None, **keywords):