openssh/openssh-7.5p1-gss-environment.patch

diff --git a/auth-krb5.c b/auth-krb5.c
index 09ed151..282fcca 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -182,7 +182,8 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
 		goto out;
 	}
 
-	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);
+	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx,
+	    &authctxt->krb5_fwd_ccache, &authctxt->krb5_set_env);
 	if (problem)
 		goto out;
 
@@ -192,7 +192,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
 
 
 #ifdef USE_PAM
-	if (options.use_pam)
+	if (options.use_pam && authctxt->krb5_set_env)
 		do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
 #endif
 
@@ -412,7 +413,7 @@ ssh_krb5_get_cctemplate(krb5_context ctx, char **ccname) {
 
 #ifndef HEIMDAL
 krb5_error_code
-ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache, int *need_environment) {
 	int tmpfd, ret, oerrno;
 	char *ccname;
 #ifdef USE_CCAPI
@@ -423,8 +424,10 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
 
 #endif
 
+	if (need_environment)
+		*need_environment = 0;
 	ret = ssh_krb5_get_cctemplate(ctx, &ccname);
-
+	/* fallback to the ccache in /tmp */
 	if (ret) {
 		ret = asprintf(&ccname, cctemplate, geteuid());
 		if (ret == -1)
@@ -444,6 +447,9 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
 			close(tmpfd);
 			return oerrno;
 		}
+		/* make sure the KRBCCNAME is set for non-standard location */
+		if (need_environment)
+			*need_environment = 1;
 		close(tmpfd);
 	}
 	debug("%s: Setting ccname to %s", __func__, ccname);
diff --git a/auth.h b/auth.h
index 954a0dd..0819483 100644
--- a/auth.h
+++ b/auth.h
@@ -78,6 +78,7 @@ struct Authctxt {
 	krb5_principal	 krb5_user;
 	char		*krb5_ticket_file;
 	char		*krb5_ccname;
+	int		 krb5_set_env;
 #endif
 	struct sshbuf	*loginmsg;
 
@@ -220,7 +221,7 @@ int	 sys_auth_passwd(Authctxt *, const char *);
 
 #if defined(KRB5) && !defined(HEIMDAL)
 #include <krb5.h>
-krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
+krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *, int *);
 krb5_error_code ssh_krb5_get_k5login_directory(krb5_context ctx,
 	char **k5login_directory);
 #endif
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 0fa3838..4127245 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -382,7 +382,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
 /* This writes out any forwarded credentials from the structure populated
  * during userauth. Called after we have setuid to the user */
 
-static void
+static int
 ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 {
 	krb5_ccache ccache;
@@ -391,14 +391,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 	OM_uint32 maj_status, min_status;
 	const char *new_ccname, *new_cctype;
 	const char *errmsg;
+	int set_env = 0;
 
 	if (client->creds == NULL) {
 		debug("No credentials stored");
-		return;
+		return 0;
 	}
 
 	if (ssh_gssapi_krb5_init() == 0)
-		return;
+		return 0;
 
 #ifdef HEIMDAL
 # ifdef HAVE_KRB5_CC_NEW_UNIQUE
@@ -412,14 +413,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 		krb5_get_err_text(krb_context, problem));
 # endif
 		krb5_free_error_message(krb_context, errmsg);
-		return;
+		return 0;
 	}
 #else
-	if ((problem = ssh_krb5_cc_gen(krb_context, &ccache))) {
+	if ((problem = ssh_krb5_cc_gen(krb_context, &ccache, &set_env))) {
 		errmsg = krb5_get_error_message(krb_context, problem);
 		logit("ssh_krb5_cc_gen(): %.100s", errmsg);
 		krb5_free_error_message(krb_context, errmsg);
-		return;
+		return 0;
 	}
 #endif	/* #ifdef HEIMDAL */
 
@@ -428,7 +429,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 		errmsg = krb5_get_error_message(krb_context, problem);
 		logit("krb5_parse_name(): %.100s", errmsg);
 		krb5_free_error_message(krb_context, errmsg);
-		return;
+		return 0;
 	}
 
 	if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
@@ -437,7 +438,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 		krb5_free_error_message(krb_context, errmsg);
 		krb5_free_principal(krb_context, princ);
 		krb5_cc_destroy(krb_context, ccache);
-		return;
+		return 0;
 	}
 
 	krb5_free_principal(krb_context, princ);
@@ -446,7 +447,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 	    client->creds, ccache))) {
 		logit("gss_krb5_copy_ccache() failed");
 		krb5_cc_destroy(krb_context, ccache);
-		return;
+		return 0;
 	}
 
 	new_cctype = krb5_cc_get_type(krb_context, ccache);
@@ -471,7 +478,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 #endif
 
 #ifdef USE_PAM
-	if (options.use_pam)
+	if (options.use_pam && set_env)
 		do_pam_putenv(client->store.envvar, client->store.envval);
 #endif
 
@@ -479,7 +486,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 
 	client->store.data = krb_context;
 
-	return;
+	return set_env;
 }
 
 int
diff --git a/gss-serv.c b/gss-serv.c
index 681847a..2a02dae 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -404,7 +404,7 @@ ssh_gssapi_cleanup_creds(void)
 			debug("%s: krb5_cc_resolve(): %.100s", __func__,
 				krb5_get_err_text(gssapi_client.store.data, problem));
 		} else if ((problem = krb5_cc_destroy(gssapi_client.store.data, ccache))) {
-			debug("%s: krb5_cc_resolve(): %.100s", __func__,
+			debug("%s: krb5_cc_destroy(): %.100s", __func__,
 				krb5_get_err_text(gssapi_client.store.data, problem));
 		} else {
 			krb5_free_context(gssapi_client.store.data);
@@ -414,13 +414,15 @@ ssh_gssapi_cleanup_creds(void)
 }
 
 /* As user */
-void
+int
 ssh_gssapi_storecreds(void)
 {
 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
-		(*gssapi_client.mech->storecreds)(&gssapi_client);
+		return (*gssapi_client.mech->storecreds)(&gssapi_client);
 	} else
 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
+
+	return 0;
 }
 
 /* This allows GSSAPI methods to do things to the childs environment based
diff --git a/session.c b/session.c
index df4985a..b7a6a57 100644
--- a/session.c
+++ b/session.c
@@ -1084,7 +1084,8 @@ do_setup_env(Session *s, const char *shell)
 	/* Allow any GSSAPI methods that we've used to alter
 	 * the childs environment as they see fit
 	 */
-	ssh_gssapi_do_child(&env, &envsize);
+	if (s->authctxt->krb5_set_env)
+		ssh_gssapi_do_child(&env, &envsize);
 #endif
 
 	/* Set basic environment. */
@@ -1196,7 +1197,7 @@ do_setup_env(Session *s, const char *shell)
 	}
 #endif
 #ifdef KRB5
-	if (s->authctxt->krb5_ccname)
+	if (s->authctxt->krb5_ccname && s->authctxt->krb5_set_env)
 		child_set_env(&env, &envsize, "KRB5CCNAME",
 		    s->authctxt->krb5_ccname);
 #endif
diff --git a/ssh-gss.h b/ssh-gss.h
index 6f2b0ac..73ef2c2 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -106,7 +106,7 @@ typedef struct ssh_gssapi_mech_struct {
 	int (*dochild) (ssh_gssapi_client *);
 	int (*userok) (ssh_gssapi_client *, char *);
 	int (*localname) (ssh_gssapi_client *, char **);
-	void (*storecreds) (ssh_gssapi_client *);
+	int (*storecreds) (ssh_gssapi_client *);
 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
 } ssh_gssapi_mech;
 
@@ -163,7 +163,7 @@ char* ssh_gssapi_get_displayname(void);
 OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 void ssh_gssapi_do_child(char ***, u_int *);
 void ssh_gssapi_cleanup_creds(void);
-void ssh_gssapi_storecreds(void);
+int ssh_gssapi_storecreds(void);
 const char *ssh_gssapi_displayname(void);
 
 char *ssh_gssapi_server_mechanisms(void);
diff --git a/sshd.c b/sshd.c
index ce2e374..3c4e13e 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2221,7 +2221,7 @@ main(int ac, char **av)
 #ifdef GSSAPI
 	if (options.gss_authentication) {
 		temporarily_use_uid(authctxt->pw);
-		ssh_gssapi_storecreds();
+		authctxt->krb5_set_env = ssh_gssapi_storecreds();
 		restore_uid();
 	}
 #endif