diff options
Diffstat (limited to 'modules/pam_unix/pam_unix_acct.c')
| -rw-r--r-- | modules/pam_unix/pam_unix_acct.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/modules/pam_unix/pam_unix_acct.c b/modules/pam_unix/pam_unix_acct.c index 8f5ed3e0..befd3c99 100644 --- a/modules/pam_unix/pam_unix_acct.c +++ b/modules/pam_unix/pam_unix_acct.c @@ -57,6 +57,7 @@ #include <security/pam_ext.h> #include <security/pam_modutil.h> +#include "pam_i18n.h" #include "pam_cc_compat.h" #include "support.h" #include "passverify.h" @@ -110,14 +111,15 @@ int _unix_run_verify_binary(pam_handle_t *pamh, unsigned long long ctrl, _exit(PAM_AUTHINFO_UNAVAIL); } - if (geteuid() == 0) { - /* must set the real uid to 0 so the helper will not error - out if pam is called from setuid binary (su, sudo...) */ - if (setuid(0) == -1) { - pam_syslog(pamh, LOG_ERR, "setuid failed: %m"); - printf("-1\n"); - fflush(stdout); - _exit(PAM_AUTHINFO_UNAVAIL); + /* must set the real uid to 0 so the helper will not error + out if pam is called from setuid binary (su, sudo...) */ + if (setuid(0) == -1) { + uid_t euid = geteuid(); + pam_syslog(pamh, euid == 0 ? LOG_ERR : LOG_DEBUG, "setuid failed: %m"); + if (euid == 0) { + printf("-1\n"); + fflush(stdout); + _exit(PAM_AUTHINFO_UNAVAIL); } } |