SSS_CLIENT: check if mem-cache fd was hijacked

Real life example would be:
https://github.com/TigerVNC/tigervnc/blob/effd854bfd19654fa67ff3d39514a91a246b8ae6/unix/xserver/hw/vnc/xvnc.c#L369
 - TigerVNC unconditionally overwrites fd=3

Resolves: SSSD#6986

src/sss_client/nss_mc.h

@@ -53,6 +53,8 @@ struct sss_cli_mc_ctx {
     pthread_mutex_t *mutex;
 #endif
     int fd;
+    ino_t fd_inode;
+    dev_t fd_device;
 
     uint32_t seed;          /* seed from the tables header */
 
@@ -69,9 +71,9 @@ struct sss_cli_mc_ctx {
 };
 
 #if HAVE_PTHREAD
-#define SSS_CLI_MC_CTX_INITIALIZER(mtx) {UNINITIALIZED, (mtx), -1, 0, NULL, 0, NULL, 0, NULL, 0, 0}
+#define SSS_CLI_MC_CTX_INITIALIZER(mtx) {UNINITIALIZED, (mtx), -1, 0, 0, 0, NULL, 0, NULL, 0, NULL, 0, 0}
 #else
-#define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, -1, 0, NULL, 0, NULL, 0, NULL, 0, 0}
+#define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, -1, 0, 0, 0, NULL, 0, NULL, 0, NULL, 0, 0}
 #endif
 
 errno_t sss_nss_mc_get_ctx(const char *name, struct sss_cli_mc_ctx *ctx);

src/sss_client/nss_mc_common.c

@@ -87,6 +87,12 @@ static errno_t sss_nss_mc_validate(struct sss_cli_mc_ctx *ctx)
         return EINVAL;
     }
 
+    /* FD was hijacked */
+    if ((fdstat.st_dev != ctx->fd_device) || (fdstat.st_ino != ctx->fd_inode)) {
+        ctx->fd = -1; /* don't ruin app even if it's misbehaving */
+        return EINVAL;
+    }
+
     /* Invalid size. */
     if (fdstat.st_size != ctx->mmap_size) {
         return EINVAL;
@@ -161,6 +167,8 @@ static void sss_nss_mc_destroy_ctx(struct sss_cli_mc_ctx *ctx)
         close(ctx->fd);
     }
     ctx->fd = -1;
+    ctx->fd_inode = 0;
+    ctx->fd_device = 0;
 
     ctx->seed = 0;
     ctx->data_table = NULL;
@@ -202,6 +210,8 @@ static errno_t sss_nss_mc_init_ctx(const char *name,
         ret = EIO;
         goto done;
     }
+    ctx->fd_inode = fdstat.st_ino;
+    ctx->fd_device = fdstat.st_dev;
 
     if (fdstat.st_size < MC_HEADER_SIZE) {
         ret = ENOMEM;