Date: Mon, 6 Aug 2001 18:34:11 +0000 (GMT) From: "Eugene L. Vorokov" <vel@bugz.infotecs.ru> To: freebsd-hackers@freebsd.org Subject: pam_wheel Message-ID: <200108061834.f76IYBO64264@bugz.infotecs.ru>
next in thread | raw e-mail | index | archive | help
Hello,
pam_wheel authentication module seems to be broken in -current. Look at
this (from src/lib/libpam/modules/pam_wheel):
PAM_EXTERN int
pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv)
{
struct options options;
struct passwd *pwd;
struct group *grp;
int retval;
const char *user;
char *use_group;
pam_std_option(&options, other_options, argc, argv);
PAM_LOG("Options processed");
if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL))
pwd = getpwnam(getlogin());
else {
retval = pam_get_user(pamh, &user, NULL);
if (retval != PAM_SUCCESS)
PAM_RETURN(retval);
pwd = getpwnam(user);
}
PAM_LOG("Got user: %s", user);
/* Ignore if already uid 0 */
if (pwd->pw_uid)
PAM_RETURN(PAM_IGNORE);
PAM_LOG("Not superuser");
This piece obviously has at least two errors. First, if PAM_OPT_AUTH_AS_SELF
is true, then value of user is undefined. It should probably log
pwd->pw_name instead. Second, check for root must of course be reversed
and become if (!pwd->pw_uid).
The way it works now, it always returns PAM_IGNORE for all non-root users,
which causes in allowing "su" for anyone who knows root password.
Or am I missing something again ? 8=)
Regards,
Eugene
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108061834.f76IYBO64264>