Function CheckReplayCacheDirPermissions

be/src/rpc/authentication.cc:1288–1308

Ensure that /var/tmp (the location of the Kerberos replay cache) has drwxrwxrwt permissions. If it doesn't, Kerberos will be unhappy in a way that's very difficult to debug. We do this using direct stat() calls because boost doesn't support the detail we need.

// to debug.  We do this using direct stat() calls because boost doesn't support the
// detail we need.
Status CheckReplayCacheDirPermissions() {
  DCHECK(IsKerberosEnabled());
  struct stat st;

  if (stat("/var/tmp", &st) < 0) {
    return Status(Substitute("Problem accessing /var/tmp: $0", GetStrErrMsg()));
  }

  if (!(st.st_mode & S_IFDIR)) {
    return Status("Error: /var/tmp is not a directory");
  }

  if ((st.st_mode & 01777) != 01777) {
    return Status(Substitute("Error: The permissions on /var/tmp must precisely match "
        "\"drwxrwxrwt\". This directory is used by the Kerberos replay cache. "
        "Current permissions: \"$0\". To rectify this issue, run "
        "\"chmod 01777 /var/tmp\" as root.", FormatPermissions(st.st_mode)));
  }

  return Status::OK();
}

Status SecureAuthProvider::InitKerberos(const string& principal) {
  principal_ = principal;