- (djm) Reestablish PAM credentials (which can be supplemental group
memberships) after initgroups() blows them away. Report and suggested
fix from Nalin Dahyabhai <nalin@redhat.com>
diff --git a/ChangeLog b/ChangeLog
index a849757..f26478a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,3 @@
-20010328
- - OpenBSD CVS Sync
- - markus@cvs.openbsd.org 2001/03/26 08:07:09
- [authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
- sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
- simpler key load/save interface, see authfile.h
-
20010327
- Attempt sync with sshlogin.c w/ OpenBSD (mainly CVS ID)
- Fix pointer issues in waitpid() and wait() replaces. Patch by Lutz
@@ -17,6 +10,13 @@
[servconf.c servconf.h session.c sshd.8 sshd_config]
PrintLastLog option; from chip@valinux.com with some minor
changes by me. ok markus@
+ - markus@cvs.openbsd.org 2001/03/26 08:07:09
+ [authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
+ sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
+ simpler key load/save interface, see authfile.h
+ - (djm) Reestablish PAM credentials (which can be supplemental group
+ memberships) after initgroups() blows them away. Report and suggested
+ fix from Nalin Dahyabhai <nalin@redhat.com>
20010324
- Fixed permissions ssh-keyscan. Thanks to Christopher Linn <celinn@mtu.edu>.
@@ -4725,4 +4725,4 @@
- Wrote replacements for strlcpy and mkdtemp
- Released 1.0pre1
-$Id: ChangeLog,v 1.1020 2001/03/26 13:44:06 mouring Exp $
+$Id: ChangeLog,v 1.1021 2001/03/27 06:12:24 djm Exp $
diff --git a/auth-pam.c b/auth-pam.c
index 2ea2996..d8eefdf 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -33,7 +33,7 @@
#include "canohost.h"
#include "readpass.h"
-RCSID("$Id: auth-pam.c,v 1.33 2001/03/21 02:01:35 djm Exp $");
+RCSID("$Id: auth-pam.c,v 1.34 2001/03/27 06:12:24 djm Exp $");
#define NEW_AUTHTOK_MSG \
"Warning: Your password has expired, please change it now"
@@ -287,14 +287,15 @@
}
/* Set PAM credentials */
-void do_pam_setcred(void)
+void do_pam_setcred(int init)
{
int pam_retval;
do_pam_set_conv(&conv);
debug("PAM establishing creds");
- pam_retval = pam_setcred(__pamh, PAM_ESTABLISH_CRED);
+ pam_retval = pam_setcred(__pamh,
+ init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
if (pam_retval != PAM_SUCCESS) {
if (was_authenticated)
fatal("PAM setcred failed[%d]: %.200s",
diff --git a/auth-pam.h b/auth-pam.h
index 1cf85c0..c249b53 100644
--- a/auth-pam.h
+++ b/auth-pam.h
@@ -1,4 +1,4 @@
-/* $Id: auth-pam.h,v 1.10 2001/02/15 00:51:32 djm Exp $ */
+/* $Id: auth-pam.h,v 1.11 2001/03/27 06:12:24 djm Exp $ */
#include "includes.h"
#ifdef USE_PAM
@@ -12,7 +12,7 @@
int do_pam_authenticate(int flags);
int do_pam_account(char *username, char *remote_user);
void do_pam_session(char *username, const char *ttyname);
-void do_pam_setcred(void);
+void do_pam_setcred(int init);
void print_pam_messages(void);
int is_pam_password_change_required(void);
void do_pam_chauthtok(void);
diff --git a/session.c b/session.c
index dfe1498..ac026e4 100644
--- a/session.c
+++ b/session.c
@@ -488,7 +488,7 @@
session_proctitle(s);
#if defined(USE_PAM)
- do_pam_setcred();
+ do_pam_setcred(1);
#endif /* USE_PAM */
/* Fork the child. */
@@ -603,7 +603,7 @@
#if defined(USE_PAM)
do_pam_session(s->pw->pw_name, s->tty);
- do_pam_setcred();
+ do_pam_setcred(1);
#endif
/* Fork the child. */
@@ -1100,6 +1100,15 @@
exit(1);
}
endgrent();
+# ifdef USE_PAM
+ /*
+ * PAM credentials may take the form of
+ * supplementary groups. These will have been
+ * wiped by the above initgroups() call.
+ * Reestablish them here.
+ */
+ do_pam_setcred(0);
+# endif /* USE_PAM */
# ifdef WITH_IRIX_JOBS
jid = jlimit_startjob(pw->pw_name, pw->pw_uid, "interactive");
if (jid == -1) {