Add environment variable for GSS mech config

If the environment variable GSS_MECH_CONFIG is set (and the process is
not privileged), read it instead of /etc/gss/mech or files within
/etc/gss/mech.d.

Set GSS_MECH_CONFIG in test frameworks so that system configuration
does not interfere with tests.

Fix documentation to indicate that the default mech config file is in
sysconfdir, not necessarily /etc.

ticket: 8833 (new)

4 files changed, 18 insertions, 10 deletions

diff --git a/doc/admin/host_config.rst b/doc/admin/host_config.rst
index 6df2504..e186dd4 100644
--- a/doc/admin/host_config.rst
+++ b/doc/admin/host_config.rst
@@ -199,10 +199,9 @@ GSSAPI mechanism modules
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
 GSSAPI mechanism modules are registered using the file
-``/etc/gss/mech`` or configuration files in the ``/etc/gss/mech.d/``
-directory.  Only files with a ``.conf`` suffix will be read from the
-``/etc/gss/mech.d/`` directory.  Each line in these files has the
-form::
+|sysconfdir|\ ``/gss/mech`` or configuration files in the
+|sysconfdir|\ ``/gss/mech.d`` directory with a ``.conf``
+suffix.  Each line in these files has the form::
 
     oid  pathname  [options]  <type>
 
@@ -214,6 +213,9 @@ options provided to the plugin module, surrounded in square brackets.
 Currently the only special module type is "interposer", for a module
 designed to intercept calls to other mechanisms.
 
+If the environment variable **GSS_MECH_CONFIG** is set, its value is
+used as the sole mechanism configuration filename.
+
 
 .. _profile_plugin_config:
 
diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst
index 65d904e..58f4f16 100644
--- a/doc/mitK5defaults.rst
+++ b/doc/mitK5defaults.rst
@@ -14,6 +14,7 @@ Client :ref:`keytab_definition` file        |ckeytab|                      **KRB
 Kerberos config file :ref:`krb5.conf(5)`    |krb5conf|\ ``:``\             **KRB5_CONFIG**
                                             |sysconfdir|\ ``/krb5.conf``
 KDC config file :ref:`kdc.conf(5)`          |kdcdir|\ ``/kdc.conf``        **KRB5_KDC_PROFILE**
+GSS mechanism config file                   |sysconfdir|\ ``/gss.mech``    **GSS_MECH_CONFIG**
 KDC database path (DB2)                     |kdcdir|\ ``/principal``
 Master key :ref:`stash_definition`          |kdcdir|\ ``/.k5.``\ *realm*
 Admin server ACL file :ref:`kadm5.acl(5)`   |kdcdir|\ ``/kadm5.acl``
diff --git a/doc/plugindev/gssapi.rst b/doc/plugindev/gssapi.rst
index 34fc9e4..28e62ae 100644
--- a/doc/plugindev/gssapi.rst
+++ b/doc/plugindev/gssapi.rst
@@ -9,8 +9,7 @@ the set of built-in mechanisms.
 
 A mechanism module is a Unix shared object or Windows DLL, built
 separately from the krb5 tree.  Modules are loaded according to the
-``/etc/gss/mech`` or ``/etc/gss/mech.d/*.conf`` config files, as
-described in :ref:`gssapi_plugin_config`.
+GSS mechanism config files described in :ref:`gssapi_plugin_config`.
 
 For the most part, a GSSAPI mechanism module exports the same
 functions as would a GSSAPI implementation itself, with the same
@@ -45,10 +44,10 @@ with the following signature::
     gss_OID_set gss_mech_interposer(gss_OID mech_type);
 
 This function is invoked with the OID of the interposer mechanism as
-specified in ``/etc/gss/mech`` or in a ``/etc/gss/mech.d/*.conf``
-file, and returns a set of mechanism OIDs to be interposed.  The
-returned OID set must have been created using the mechglue's
-gss_create_empty_oid_set and gss_add_oid_set_member functions.
+specified in the mechanism config file, and returns a set of mechanism
+OIDs to be interposed.  The returned OID set must have been created
+using the mechglue's gss_create_empty_oid_set and
+gss_add_oid_set_member functions.
 
 An interposer module must use the prefix ``gssi_`` for the GSSAPI
 functions it exports, instead of the prefix ``gss_``.
diff --git a/doc/user/user_config/kerberos.rst b/doc/user/user_config/kerberos.rst
index bcb79d9..1830447 100644
--- a/doc/user/user_config/kerberos.rst
+++ b/doc/user/user_config/kerberos.rst
@@ -142,6 +142,12 @@ programs.  These include:
 **KPROP_PORT**
     :ref:`kprop(8)` port to use.  Defaults to 754.
 
+**GSS_MECH_CONFIG**
+    Specifies a filename containing GSSAPI mechanism module
+    configuration.  The default is to read |sysconfdir|\ ``/gss/mech``
+    and files with a ``.conf`` suffix within the directory
+    |sysconfdir|\ ``/gss/mech.d``.
+
 Most environment variables are disabled for certain programs, such as
 login system programs and setuid programs, which are designed to be
 secure when run within an untrusted process environment.