KRB5_KDB_OPEN_RO
readonly = (mode & KRB5_KDB_OPEN_RO) || (mode & KRB5_KDB_SRV_TYPE_KDC);
readonly = !!(mode & KRB5_KDB_OPEN_RO);