diff options
| author | Andrew G. Morgan <morgan@kernel.org> | 2001-02-11 06:33:53 +0000 |
|---|---|---|
| committer | Andrew G. Morgan <morgan@kernel.org> | 2001-02-11 06:33:53 +0000 |
| commit | 4e4d6bb78e3bd6430838d854832c58f104d5f559 (patch) | |
| tree | 9f3223c9b38717da4db165ad13720367c76b6fbf /modules/pam_unix/pam_unix_passwd.c | |
| parent | 25188cef4bd88edeb68c1bd3c7b54c38e18ad151 (diff) | |
| download | pam-4e4d6bb78e3bd6430838d854832c58f104d5f559.tar.gz pam-4e4d6bb78e3bd6430838d854832c58f104d5f559.tar.bz2 pam-4e4d6bb78e3bd6430838d854832c58f104d5f559.zip | |
Relevant BUGIDs: 112540
Purpose of commit: minor security bugfix
Commit summary:
---------------
Fixes for the password helper binaries.
Before, there was no check that the password entered was actually that
of the intended user being authenticated. Instead, the password was
checked for the requesting user. While this disstinction sounds like a
security hole, its actually not been a problem in practice. The helper
binaries have only been used in the case that the application is not
setuid-0 and as such even if an improper authentication succeeded, the
application could not change its uid from that of the requesting user.
Diffstat (limited to 'modules/pam_unix/pam_unix_passwd.c')
| -rw-r--r-- | modules/pam_unix/pam_unix_passwd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/pam_unix/pam_unix_passwd.c b/modules/pam_unix/pam_unix_passwd.c index 5d8d2d7d..3fe8a27a 100644 --- a/modules/pam_unix/pam_unix_passwd.c +++ b/modules/pam_unix/pam_unix_passwd.c @@ -328,7 +328,7 @@ static int save_old_password(const char *forwho, const char *oldpass, int howman return retval; } -static int _update_passwd(const char *forwho, char *towhat) +static int _update_passwd(const char *forwho, const char *towhat) { struct passwd *tmpent = NULL; FILE *pwfile, *opwfile; @@ -588,7 +588,7 @@ static int _pam_unix_approve_pass(pam_handle_t * pamh ,const char *pass_new) { const char *user; - char *remark = NULL; + const char *remark = NULL; int retval = PAM_SUCCESS; D(("&new=%p, &old=%p", pass_old, pass_new)); |