dcavalca / rpms / util-linux

Forked from rpms/util-linux 2 years ago
Clone

Blame 0005-Complete-Linux-PAM-compliance-for-forked-child-in-su.patch

Karel Zak 991206
From 88da20ee56491fc6c38c26810c95e199f51fb71d Mon Sep 17 00:00:00 2001
Karel Zak 891375
From: "Andrew G. Morgan" <morgan@kernel.org>
Karel Zak 891375
Date: Sat, 27 Nov 2021 21:00:22 -0800
Karel Zak 991206
Subject: Complete Linux-PAM compliance for forked child in su and login.
Karel Zak 891375
Karel Zak 891375
As documented here:
Karel Zak 891375
Karel Zak 891375
http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end
Karel Zak 891375
Karel Zak 891375
The child that is about to exec*() the user shell is supposed to pam_end()
Karel Zak 891375
with PAM_DATA_SILENT. This gives the modules a last chance to do a minor
Karel Zak 891375
cleanup of the module state before the user's shell is launched.
Karel Zak 891375
Karel Zak 891375
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2037212
Karel Zak 891375
Upstream: http://github.com/util-linux/util-linux/commit/4660286e9cdff6d95b49295674b96f83af10ea36
Karel Zak 891375
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Karel Zak 891375
---
Karel Zak 891375
 login-utils/login.c     | 3 +++
Karel Zak 891375
 login-utils/su-common.c | 3 +++
Karel Zak 891375
 2 files changed, 6 insertions(+)
Karel Zak 891375
Karel Zak 891375
diff --git a/login-utils/login.c b/login-utils/login.c
Karel Zak 891375
index 3657f04cd..c62e91e94 100644
Karel Zak 891375
--- a/login-utils/login.c
Karel Zak 891375
+++ b/login-utils/login.c
Karel Zak 891375
@@ -1521,6 +1521,9 @@ int main(int argc, char **argv)
Karel Zak 891375
 
Karel Zak 891375
 	child_argv[child_argc++] = NULL;
Karel Zak 891375
 
Karel Zak 891375
+	/* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */
Karel Zak 891375
+	(void) pam_end(cxt.pamh, PAM_SUCCESS|PAM_DATA_SILENT);
Karel Zak 891375
+
Karel Zak 891375
 	execvp(child_argv[0], child_argv + 1);
Karel Zak 891375
 
Karel Zak 891375
 	if (!strcmp(child_argv[0], "/bin/sh"))
Karel Zak 891375
diff --git a/login-utils/su-common.c b/login-utils/su-common.c
Karel Zak 891375
index afd0ea8ad..7d4826bbc 100644
Karel Zak 891375
--- a/login-utils/su-common.c
Karel Zak 891375
+++ b/login-utils/su-common.c
Karel Zak 891375
@@ -1231,6 +1231,9 @@ int su_main(int argc, char **argv, int mode)
Karel Zak 891375
 	if (su->simulate_login && chdir(su->pwd->pw_dir) != 0)
Karel Zak 891375
 		warn(_("warning: cannot change directory to %s"), su->pwd->pw_dir);
Karel Zak 891375
 
Karel Zak 891375
+	/* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */
Karel Zak 891375
+	(void) pam_end(su->pamh, PAM_SUCCESS|PAM_DATA_SILENT);
Karel Zak 891375
+
Karel Zak 891375
 	if (shell)
Karel Zak 891375
 		run_shell(su, shell, command, argv + optind, max(0, argc - optind));
Karel Zak 891375
 
Karel Zak 891375
-- 
Karel Zak 991206
2.34.1
Karel Zak 891375