diff options
Diffstat (limited to 'modules/pam_unix')
| -rw-r--r-- | modules/pam_unix/pam_unix_acct.c | 17 | ||||
| -rw-r--r-- | modules/pam_unix/support.c | 14 |
2 files changed, 16 insertions, 15 deletions
diff --git a/modules/pam_unix/pam_unix_acct.c b/modules/pam_unix/pam_unix_acct.c index 8f5ed3e0..7ffcb9e3 100644 --- a/modules/pam_unix/pam_unix_acct.c +++ b/modules/pam_unix/pam_unix_acct.c @@ -110,14 +110,15 @@ int _unix_run_verify_binary(pam_handle_t *pamh, unsigned long long ctrl, _exit(PAM_AUTHINFO_UNAVAIL); } - if (geteuid() == 0) { - /* must set the real uid to 0 so the helper will not error - out if pam is called from setuid binary (su, sudo...) */ - if (setuid(0) == -1) { - pam_syslog(pamh, LOG_ERR, "setuid failed: %m"); - printf("-1\n"); - fflush(stdout); - _exit(PAM_AUTHINFO_UNAVAIL); + /* must set the real uid to 0 so the helper will not error + out if pam is called from setuid binary (su, sudo...) */ + if (setuid(0) == -1) { + uid_t euid = geteuid(); + pam_syslog(pamh, euid == 0 ? LOG_ERR : LOG_DEBUG, "setuid failed: %m"); + if (euid == 0) { + printf("-1\n"); + fflush(stdout); + _exit(PAM_AUTHINFO_UNAVAIL); } } diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c index d391973f..69811048 100644 --- a/modules/pam_unix/support.c +++ b/modules/pam_unix/support.c @@ -562,13 +562,13 @@ static int _unix_run_helper_binary(pam_handle_t *pamh, const char *passwd, _exit(PAM_AUTHINFO_UNAVAIL); } - if (geteuid() == 0) { - /* must set the real uid to 0 so the helper will not error - out if pam is called from setuid binary (su, sudo...) */ - if (setuid(0) == -1) { - D(("setuid failed")); - _exit(PAM_AUTHINFO_UNAVAIL); - } + /* must set the real uid to 0 so the helper will not error + out if pam is called from setuid binary (su, sudo...) */ + if (setuid(0) == -1) { + D(("setuid failed")); + if (geteuid() == 0) { + _exit(PAM_AUTHINFO_UNAVAIL); + } } /* exec binary helper */ |