kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
Petr Šabata 81d24c
diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-seteuid openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
Petr Šabata 81d24c
--- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-seteuid	2017-02-07 15:41:53.172334151 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-02-07 15:41:53.174334149 +0100
Petr Šabata 81d24c
@@ -238,17 +238,26 @@ ssh_get_authentication_socket_for_uid(ui
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	errno = 0; 
Petr Šabata 81d24c
-	seteuid(uid); /* To ensure a race condition is not used to circumvent the stat
Petr Šabata 81d24c
-	             above, we will temporarily drop UID to the caller */
Petr Šabata 81d24c
-	if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
Petr Šabata 81d24c
+	/* To ensure a race condition is not used to circumvent the stat
Petr Šabata 81d24c
+	   above, we will temporarily drop UID to the caller */
Petr Šabata 81d24c
+	if (seteuid(uid) == -1) {
Petr Šabata 81d24c
 		close(sock);
Petr Šabata 81d24c
-        if(errno == EACCES)
Petr Šabata 81d24c
-		fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
Petr Šabata 81d24c
+		error("seteuid(%lu) failed with error: %s",
Petr Šabata 81d24c
+		    (unsigned long) uid, strerror(errno));
Petr Šabata 81d24c
 		return -1;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
+	if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
Petr Šabata 81d24c
+		close(sock);
Petr Šabata 81d24c
+		sock = -1;
Petr Šabata 81d24c
+		if(errno == EACCES)
Petr Šabata 81d24c
+			fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-	seteuid(0); /* we now continue the regularly scheduled programming */
Petr Šabata 81d24c
-
Petr Šabata 81d24c
+	/* we now continue the regularly scheduled programming */
Petr Šabata 81d24c
+	if (0 != seteuid(0)) {
Petr Šabata 81d24c
+		fatal("setuid(0) failed with error: %s", strerror(errno));
Petr Šabata 81d24c
+		return -1;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
 	return sock;
Petr Šabata 81d24c
 }
Petr Šabata 81d24c