Clean up after failure with k5start -o, -g, or -m

Clean up the temporary ticket cache on k5start failure if -o, -g, or
-m were given.  Based on a patch by Rasmus Borup Hansen.

diff --git a/NEWS b/NEWS
index 911d2bf160da7bb8fd9c6a8f166b2224383bb2fd..aea3b6f9dab7a8e2bf5ea332db7dc7f99cf82148 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ kstart 4.2 (unreleased)
     with the shorter wake-up interval of one minute just as if a
     subsequent renewal failed.  Patch from Rasmus Borup Hansen.
 
+    Clean up the temporary ticket cache on k5start failure if -o, -g, or
+    -m were given.  Based on a patch by Rasmus Borup Hansen.
+
 kstart 4.1 (2012-01-07)
 
     Fix a regression introduced in kstart 4.0 that caused k5start -H and

diff --git a/k5start.c b/k5start.c
index 8169dc972b3b393ee6b90103d06fbbf97765c484..2caa61bd35667d65f6167a1e4ef03afb34d8fff3 100644 (file)
--- a/k5start.c
+++ b/k5start.c
@@ -213,7 +213,7 @@ authenticate(krb5_context ctx, struct config *config,
         if (code != 0) {
             warn_krb5(ctx, code, "error resolving keytab %s",
                       private->keytab);
-            return code;
+            goto done;
         }
         code = krb5_get_init_creds_keytab(ctx, &creds, config->client,
                                           keytab, 0, private->service,
@@ -234,7 +234,8 @@ authenticate(krb5_context ctx, struct config *config,
             *p = '\0';
         else {
             warn("password too long");
-            return KRB5_LIBOS_CANTREADPWD;
+            code = KRB5_LIBOS_CANTREADPWD;
+            goto done;
         }
         code = krb5_get_init_creds_password(ctx, &creds, config->client,
                                             buffer, NULL, NULL, 0,
@@ -274,11 +275,17 @@ authenticate(krb5_context ctx, struct config *config,
         code = set_permissions(cache, private);
         if (code != 0)
             goto done;
-        if (rename(cache, config->cache) < 0)
+        if (rename(cache, config->cache) < 0) {
             code = errno;
+            goto done;
+        }
     }
 
 done:
+    /* If we failed and were generating a separate cache, unlink it. */
+    if (private->set_perms)
+        unlink(cache);
+
     /* Make sure that we don't free princ; we use it later. */
     if (creds.client == config->client)
         creds.client = NULL;