The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb

commit 84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb
Author: Lutz Justen <ljusten@chromium.org>
Date: Tue Jan 03 17:55:48 2017

authpolicy: Prevent that untrusted code serializes state

Currently, the authpolicy-exec user owns the machine keytab file in
/var/lib/authpolicyd, so that an exploit could modify it and serialize
state. This CL writes the keytab to a temp directory, moves it over to
/var/lib/authpolicyd and takes ownership with some user id trickery,
all inside the authpolicyd process. This limits the attack surface since
untrusted code can only write to it during domain join.

BUG= chromium:678001 
TEST=Compiles, tested with custom test code.

Change-Id: I2ac44703ebc7cbdc7902faaaf74e302f6d21c616
Reviewed-on: https://chromium-review.googlesource.com/424398
Commit-Ready: Lutz Justen <ljusten@chromium.org>
Tested-by: Lutz Justen <ljusten@chromium.org>
Reviewed-by: Roman Sorokin <rsorokin@chromium.org>

[modify] https://crrev.com/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb/authpolicy/process_executor.cc
[modify] https://crrev.com/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb/authpolicy/process_executor.h
[modify] https://crrev.com/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb/authpolicy/constants.h
[modify] https://crrev.com/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb/authpolicy/samba_interface.cc
[modify] https://crrev.com/84e3b5a11cbb63c1feaab3a6563c9e74b3e3e8bb/authpolicy/etc/init/authpolicyd.conf

bulk Verify of Chromad V1 bugs