Fix deleted node handling in libprofile

In profile_find_node, skip deleted nodes when finding the second
match.  Otherwise, profile_clear_nodes could return an error if a node
has some values to clear but the last one is deleted.

In profile_node_iterator, skip deleted nodes when looking up the
section names.  Otherwise we could iterate over a deleted section
and/or ignore its replacement.

ticket: 7971 (new)
target_version: 1.12.2
tags: pullup
Fix creation/rename of top-level profile sections

profile_rename_section should demand only one name.

profile_add_relation should demand only one name if it is creating a
new section.  It aso needs to reset state before calling
profile_find_node for the section, in case it didn't look up any
parent sections previously.

ticket: 7972 (new)
target_version: 1.12.2
tags: pullup
Add profile tests for deletion bugs

Add three new libprofile tests to prof_test1, two to test for the bugs
in #7971 and one to test a bug which would have been introduced by a
candidate fix.
Modify k5buf interfaces for easier use

Make struct k5buf less opaque and get rid of k5buf-int.h.  Make it
easy to initialize a k5buf in an error state so that it can be freed
in a cleanup handler.  Add a function k5_buf_status which returns 0 or
ENOMEM.  Remove k5_buf_data and k5_buf_len.  Rename k5_free_buf to
k5_buf_free.  Adjust all callers to match.
Adjust marshalling interfaces for KCM

Make k5_marshal_cred and k5_marshal_princ write to an existing struct
k5buf instead of allocating a new one, so that they can be marshalled
before or after other data.
Add KCM credential cache type (client only)

Add a new credential cache type "KCM" which performs cache operations
by speaking to a Heimdal or OS X KCM daemon, via either Unix domain
sockets or (on OS X only) Mach RPC.  Add "kcm_socket" and
"kcm_mach_service" profile variables to control the socket path and
bootstrap service name respectively.  In ccmarshal.c, add
k5_marshal_mcred to marshal matching credentials in the KCM protocol
representation.

This cache type is not currently supported on Windows, as Windows does
not support Unix domain sockets.

As with the keyring cache type, the lastchange method of this cache
type is mostly useless, reporting only the time of the last change
made through that cache handle.  The KCM protocol currently has no
support for obtaining the last change time of the cache itself.

ticket: 7964 (new)
Make KCM the default ccache on OS X

If we do not find a default ccache value from krb5-config and we
detect that the host platform is OS X 10.7 or higher, use KCM: as the
default ccache name instead of FILE:/tmp/krb5cc_%{uid}.

ticket: 7964
Document KCM ccache type

Document the new KCM ccache type in ccache_def.rst.  Document the
kcm_socket and kcm_mach_service variables in krb5_conf.rst.

ticket: 7964
In ksu, merge krb5_ccache_copy() and _restricted()

Other than whether or not they limit the creds it stores to the new
ccache based on the principal name of the client for whom the creds were
issued, there's no meaningful difference between what these two
functions do.  Merge them.
Fix type of GID variable in ksu

We stored the invoking user's primary GID in a uid_t variable.  Use the
right type instead.
In ksu, don't stat() not-on-disk ccache residuals

Don't assume that ccache residual names are filenames which we can
stat() usefully.  Instead, use helper functions to call the library
routines to try to read the default principal name from caches, and
use whether or not that succeeds as an indication of whether or not
there's a ccache in a given location.
Use an intermediate memory cache in ksu

Instead of copying source or obtained creds into the target cache and
changing ownership if everything succeeds, copy them into a MEMORY:
cache and then, if everything succeeds, create the target cache as the
target user.  We no longer need to clean up the temporary ccache when
exiting.
Use a fake temporary cache client principal in ksu

Add a paramter to krb5_ccache_copy() which will provide the principal
name for which the target ccache should be created.  Using a fake value
("_ksu/_ksu@_ksu") when we copy the source user's creds to a MEMORY
cache should prevent us from accidentally selecting it when we make a
subsequent call to krb5_cc_cache_match() to find a location where the
creds should be stored for use while running as the target user.
Make ksu respect the default_ccache_name setting

Try to use the location named by the default_ccache_name setting as the
name of the cache that we'll provide.  If the that cache isn't of a
collection type, check if there's already a cache by that name, and if
there is, mangle the name a bit to try to derive the name of a cache
that doesn't exist yet.

We move the declarations for k5_expand_path_tokens() and
k5_expand_path_tokens_extra() from os-proto.h to k5-int.h so that
they're declared for us to use.
In ksu, handle target ccache collections better

When copying credentials to a cache collection, take care to avoid
generating multiple caches for a single client principal, and don't
change the primary out from anyone who might already be using the
target collection.
Copy config entries to the ksu target ccache

When we try to screen out expired creds while reading them from one
ccache to eventually store in another, also keep configuration entries.
Use more randomness for ksu secondary cache names

When generating a suffix to append to a ccache name that will hold the
credentials for a ksu-invoked process, instead of using integers
counting up from 1, use the result of base64-encoding six randomly-
generated octets.  Tweak the output alphabet just a bit to avoid using
'+' or '/' in the generated names, the latter of which could really
confuse things.