Use zapfree in krb5_decrypt_tkt_part

ticket: 7982 (new)
target_version: 1.12.2
tags: pullup
In ksu, merge krb5_ccache_copy() and _restricted()

Other than whether or not they limit the creds it stores to the new
ccache based on the principal name of the client for whom the creds were
issued, there's no meaningful difference between what these two
functions do.  Merge them.
In ksu, don't stat() not-on-disk ccache residuals

Don't assume that ccache residual names are filenames which we can
stat() usefully.  Instead, use helper functions to call the library
routines to try to read the default principal name from caches, and
use whether or not that succeeds as an indication of whether or not
there's a ccache in a given location.
Use an intermediate memory cache in ksu

Instead of copying source or obtained creds into the target cache and
changing ownership if everything succeeds, copy them into a MEMORY:
cache and then, if everything succeeds, create the target cache as the
target user.  We no longer need to clean up the temporary ccache when
exiting.
Use a fake temporary cache client principal in ksu

Add a paramter to krb5_ccache_copy() which will provide the principal
name for which the target ccache should be created.  Using a fake value
("_ksu/_ksu@_ksu") when we copy the source user's creds to a MEMORY
cache should prevent us from accidentally selecting it when we make a
subsequent call to krb5_cc_cache_match() (to be added in a later patch)
to find a location where the creds should be stored for use while
running as the target user.
Make ksu respect the default_ccache_name setting

Move logic for resolving and initializing a cache that we're copying
creds into out of krb5_ccache_copy(), and let the caller deal with it.
Add helper functions to pull the default location from the configuration
and resolve any substitutions in it, and to select/resolve an output
ccache using that location after we've switched to the target user's
privileges.  If the destination is a collection, take care not to change
which subsidiary is its primary, and reuse a subsidiary cache if we can.
If the destination is not a collection, continue to use a per-run cache.

We move the declarations for k5_expand_path_tokens() and
k5_expand_path_tokens_extra() from os-proto.h to k5-int.h so that
they're declared for us to use.
Copy config entries to the ksu target ccache

When we try to screen out expired creds while reading them from one
ccache to eventually store in another, also keep configuration entries.
Use more randomness for ksu secondary cache names

When generating a suffix to append to a ccache name that will hold the
credentials for a ksu-invoked process, instead of using integers
counting up from 1, use the result of base64-encoding six randomly-
generated octets.  Tweak the output alphabet just a bit to avoid using
'+' or '/' in the generated names, the latter of which could really
confuse things.