diff options
| author | Karel Zak | 2011-11-18 12:26:19 +0100 |
|---|---|---|
| committer | Karel Zak | 2011-11-18 12:54:30 +0100 |
| commit | 34f7ea15c10fb72db73257c697156797832337c6 (patch) | |
| tree | 913d6bcd23024e1023b55c0b9c484fad1d1c44d9 /login-utils/login.c | |
| parent | column: avoid memory overrun and/or use of uninitialized buffer (diff) | |
| download | kernel-qcow2-util-linux-34f7ea15c10fb72db73257c697156797832337c6.tar.gz kernel-qcow2-util-linux-34f7ea15c10fb72db73257c697156797832337c6.tar.xz kernel-qcow2-util-linux-34f7ea15c10fb72db73257c697156797832337c6.zip | |
login: improve pam_setcred() usage
Reported-by: Thorsten Kukuk <kukuk@suse.de>
Signed-off-by: Karel Zak <kzak@redhat.com>
Diffstat (limited to 'login-utils/login.c')
| -rw-r--r-- | login-utils/login.c | 25 |
1 files changed, 23 insertions, 2 deletions
diff --git a/login-utils/login.c b/login-utils/login.c index 93ed2d62a..0d6c390de 100644 --- a/login-utils/login.c +++ b/login-utils/login.c @@ -863,16 +863,37 @@ static void loginpam_acct(struct login_context *cxt) } } +/* + * Note that position of the pam_setcred() call is discussable: + * + * - the PAM docs recommends pam_setcred() before pam_open_session() + * - but the original RFC http://www.opengroup.org/rfc/mirror-rfc/rfc86.0.txt + * uses pam_setcred() after pam_open_session() + * + * The old login versions (before year 2011) followed the RFC. This is probably + * not optimal, because there could be dependence between some session modules + * and user's credentials. + * + * The best is probably to follow openssh and call pam_setcred() before and + * after pam_open_session(). -- kzak@redhat.com (18-Nov-2011) + * + */ static void loginpam_session(struct login_context *cxt) { int rc; pam_handle_t *pamh = cxt->pamh; - rc = pam_open_session(pamh, 0); + rc = pam_setcred(pamh, PAM_ESTABLISH_CRED); if (is_pam_failure(rc)) loginpam_err(pamh, rc); - rc = pam_setcred(pamh, PAM_ESTABLISH_CRED); + rc = pam_open_session(pamh, 0); + if (is_pam_failure(rc)) { + pam_setcred(cxt->pamh, PAM_DELETE_CRED); + loginpam_err(pamh, rc); + } + + rc = pam_setcred(pamh, PAM_REINITIALIZE_CRED); if (is_pam_failure(rc)) { pam_close_session(pamh, 0); loginpam_err(pamh, rc); |