Ticket History #8566: krb5_init_context() should detect set-uid-ness

The krb5_init_secure_context() approach does not work for GSS
applications.

An application might use GSS unwittingly (via SASL, via LDAP, via
nss_ldap, via the name service switch).

It would be better to have krb5_init_context() automatically detect
set-uid context and function like krb5_init_secure_context() when in
set-uid context.

Heimdal has a portable set-uid detection facility that you could copy:

https://github.com/heimdal/heimdal/blob/master/lib/roken/issuid.c

It's not always possible to determine if the application is set-uid.

In some cases it's not.

Solaris/Illumos and OpenBSD have the only fail-safe method: the
issetugid(2) system call. FreeBSD and NetBSD have a system call with
the same name that unfortunately doesn't quite work correctly but which
will do. Recent Linux kernels supply ELF aux vector entries that
include the necessary information.

I am a bit concerned that using the broken issetugid() on FreeBSD (and
NetBSD, if it's also broken there) could break legitimate uses of
Kerberos environment variables with httpd. Of course we can address
that, at least partially, by limiting our use of issetugid() to
platforms where it is known not to be broken.