I should note that for some reason, on Fedora 19, this AVC denial does not prevent the file from being created and so things work as normal.

I have a patch submitted to MIT to allow specifying something like:
cred_store = rcache:none:none
or
cred_store = rcache:dfl:XYZName
on a per-service basis that will address this ticket.

It requires no new interface, only configuration changes, but will be supported only in MIT 1.13 (and perhaps backported to 1.12 in RHEL/Fedora).

It's unclear how we can test for this, perhaps we should just close the ticket and document in the man page how to set the cred_store's rcache parameter and then warn that this works only on very recent krb versions ? (It will simply be ignored in older versions)

If the location is not going to change on existing Fedoras, shouldn't we work with the SELinux team to allow that file to be created without AVC denial?

Replying to [comment:5 adelton]:

If the location is not going to change on existing Fedoras, shouldn't we work with the SELinux team to allow that file to be created without AVC denial?

Yes we need a bugzilla for fedoa abaout that regardless of the additional work I am doing to avoid related issues.

Comment https://bugzilla.redhat.com/show_bug.cgi?id=1008777#c3 suggests fix went to some selinux-policy. However, before we go back to the SELinux issue, we'd need GSS-Proxy to start working again like it did for versions < 0.3.0. I've filed https://bugzilla.redhat.com/show_bug.cgi?id=1047776 for that.

It may make sense to always set a private rcache for GSS-Proxy by default.
GSS-Proxy will probably run as a different user than other userspace applications and generally takes over control of a keytab anyway so not reason to share the default path.

I think we should create a new option name private_rcache that defaults to yes
When that option is yes then we set the KRB5RCACHEDIR environment variable to /var/lib/gssproxy/rcache or similar (rpms will need to create the dir).

Replying to [comment:14 simo]:

I think we should create a new option name private_rcache that defaults to yes
When that option is yes then we set the KRB5RCACHEDIR environment variable to /var/lib/gssproxy/rcache or similar (rpms will need to create the dir).

Actually, creating /etc/systemd/system/gssproxy.service with

.include /usr/lib/systemd/system/gssproxy.service
[Service]
Environment=KRB5RCACHEDIR=/var/lib/gssproxy/rcache

will achieve just that, won't it? At least on RHEL 7.1 with gssproxy-0.3.0-10.el7.x86_64, that causes /var/tmp/HTTP_0 to be no longer created and /var/lib/gssproxy/rcache/HTTP_0 appears instead.

Duplicate of https://fedorahosted.org/gss-proxy/ticket/145 and https://fedorahosted.org/gss-proxy/ticket/130 ; additionally, fedora 19 is EOL.