diff options
| author | Steve Langasek <steve.langasek@canonical.com> | 2022-08-16 22:06:15 -0700 |
|---|---|---|
| committer | Steve Langasek <steve.langasek@canonical.com> | 2022-08-16 22:11:24 -0700 |
| commit | 7561896529a7af05201dc31e959a05897ef99e19 (patch) | |
| tree | 14514b088f45d4fecd3b7a6ede5e0a99f6c10f6a /libpam/pam_modutil_priv.c | |
| parent | d071f8c9829cbd60e2a98ab5e6b1ddfdffb9b549 (diff) | |
| parent | 99d0d1c5c4f07332daa86e73981267a761bc966e (diff) | |
| download | pam-7561896529a7af05201dc31e959a05897ef99e19.tar.gz pam-7561896529a7af05201dc31e959a05897ef99e19.tar.bz2 pam-7561896529a7af05201dc31e959a05897ef99e19.zip | |
Merge new upstream version 1.5.2.
Diffstat (limited to 'libpam/pam_modutil_priv.c')
| -rw-r--r-- | libpam/pam_modutil_priv.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/libpam/pam_modutil_priv.c b/libpam/pam_modutil_priv.c index e22fab1a..a463e06a 100644 --- a/libpam/pam_modutil_priv.c +++ b/libpam/pam_modutil_priv.c @@ -107,11 +107,20 @@ int pam_modutil_drop_priv(pam_handle_t *pamh, * We should care to leave process credentials in consistent state. * That is, e.g. if change_gid() succeeded but change_uid() failed, * we should try to restore old gid. + * + * We try to add the supplementary groups on a best-effort + * basis. If it fails, it's not fatal: we fall back to using an + * empty list. */ - if (setgroups(0, NULL)) { - pam_syslog(pamh, LOG_ERR, - "pam_modutil_drop_priv: setgroups failed: %m"); - return cleanup(p); + if (initgroups(pw->pw_name, pw->pw_gid)) { + pam_syslog(pamh, LOG_WARNING, + "pam_modutil_drop_priv: initgroups failed: %m"); + + if (setgroups(0, NULL)) { + pam_syslog(pamh, LOG_ERR, + "pam_modutil_drop_priv: setgroups failed: %m"); + return cleanup(p); + } } if (change_gid(pw->pw_gid, &p->old_gid)) { pam_syslog(pamh, LOG_ERR, |