Date: Fri, 7 Feb 2003 07:04:45 -0800 (PST) From: Dag-Erling Smorgrav <des@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 24779 for review Message-ID: <200302071504.h17F4jsr019305@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=24779 Change 24779 by des@des.at.des.thinksec.com on 2003/02/07 07:04:39 If a set of saved credentials already exists when we are called, log a debugging message and fail. If the effective uid is non-zero but identical to the target uid, save the current credentials and return without doing anything else. Affected files ... .. //depot/projects/openpam/lib/openpam_borrow_cred.c#4 edit Differences ... ==== //depot/projects/openpam/lib/openpam_borrow_cred.c#4 (text+ko) ==== @@ -31,7 +31,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $P4: //depot/projects/openpam/lib/openpam_borrow_cred.c#3 $ + * $P4: //depot/projects/openpam/lib/openpam_borrow_cred.c#4 $ */ #include <sys/param.h> @@ -57,9 +57,18 @@ struct pam_saved_cred *scred; int r; - ENTER(); - if (geteuid() != 0) + ENTERI(pwd->pw_uid); + r = pam_get_data(pamh, PAM_SAVED_CRED, (const void **)&scred); + if (r == PAM_SUCCESS && scred != NULL) { + openpam_log(PAM_LOG_DEBUG, + "already operating under borrowed credentials"); + RETURNC(PAM_SYSTEM_ERR); + } + if (geteuid() != 0 && geteuid() != pwd->pw_uid) { + openpam_log(PAM_LOG_DEBUG, "called with non-zero euid: %d", + (int)geteuid()); RETURNC(PAM_PERM_DENIED); + } scred = calloc(1, sizeof *scred); if (scred == NULL) RETURNC(PAM_BUF_ERR); @@ -76,6 +85,8 @@ free(scred); RETURNC(r); } + if (geteuid() == pwd->pw_uid) + RETURNC(PAM_SUCCESS); if (initgroups(pwd->pw_name, pwd->pw_gid) == -1 || setegid(pwd->pw_gid) == -1 || seteuid(pwd->pw_uid) == -1) { openpam_restore_cred(pamh); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200302071504.h17F4jsr019305>