diff options
| author | Tomas Mraz <tm@t8m.info> | 2005-10-26 19:05:32 +0000 |
|---|---|---|
| committer | Tomas Mraz <tm@t8m.info> | 2005-10-26 19:05:32 +0000 |
| commit | dba185605b1f9ce2d8d7e90b956abe9fa0487f24 (patch) | |
| tree | f77ad7cda420c90dab1f795b4f459e2fd6c699e4 /modules/pam_unix/pam_unix_acct.c | |
| parent | d9b712775c5f1962d3490b43465537c3e28a8c49 (diff) | |
| download | pam-dba185605b1f9ce2d8d7e90b956abe9fa0487f24.tar.gz pam-dba185605b1f9ce2d8d7e90b956abe9fa0487f24.tar.bz2 pam-dba185605b1f9ce2d8d7e90b956abe9fa0487f24.zip | |
Relevant BUGIDs: Red Hat bz 168180
Purpose of commit: bugfix
Commit summary:
---------------
2005-10-26 Tomas Mraz <t8m@centrum.cz>
* modules/pam_unix/pam_unix_acct.c (_unix_run_verify_binary),
modules/pam_unix/pam_unix_passwd.c (_unix_run_shadow_binary),
modules/pam_unix/support.c (_unix_run_shadow_binary_): Set real
uid to 0 before executing the helper if SELinux is enabled.
* modules/pam_unix/unix_chkpwd.c (main): Disable user check only
if real uid is 0 (CVE-2005-2977). Log failed password check attempt.
Diffstat (limited to 'modules/pam_unix/pam_unix_acct.c')
| -rw-r--r-- | modules/pam_unix/pam_unix_acct.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/modules/pam_unix/pam_unix_acct.c b/modules/pam_unix/pam_unix_acct.c index 324ab5ed..ec47d4b6 100644 --- a/modules/pam_unix/pam_unix_acct.c +++ b/modules/pam_unix/pam_unix_acct.c @@ -116,6 +116,13 @@ struct spwd *_unix_run_verify_binary(pam_handle_t *pamh, unsigned int ctrl, cons } } } + + if (SELINUX_ENABLED && geteuid() == 0) { + /* must set the real uid to 0 so the helper will not error + out if pam is called from setuid binary (su, sudo...) */ + setuid(0); + } + /* exec binary helper */ args[0] = x_strdup(CHKPWD_HELPER); args[1] = x_strdup(user); |