Nicolas Williams 58e07f8882 krb5: Fix(?) st_nlink check in fcache.c ...

We have a check for symlinks and hardlinks so that we refuse to open
ccaches through symlinks or which have hardlinks.  This check is too
strict, checking for `st_nlink != 1`, which runs into trouble when a
ccache is mounted as a file into a container, in which case `stat(2)`
reports it as having zero links.

The fix is to check for `st_nlink > 1`:

    -    if (sb2.st_nlink != 1) {
    +    if (sb2.st_nlink > 1) {
            krb5_set_error_message(context, EPERM, N_("Refuses to open hardlinks for caches FILE:%s", ""), filename);

Though I question the utility of the hardlink check.  MIT Kerberos
doesn't have it.

2022-12-29 22:27:42 -06:00

44 KiB

Raw Blame History

View Raw