|
 |
592caf |
From fcd9a141d08d521c01dc1a1c06a8d43a2337a392 Mon Sep 17 00:00:00 2001
|
|
|
592caf |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
592caf |
Date: Mon, 4 Feb 2019 10:23:43 +0100
|
|
|
592caf |
Subject: [PATCH] pam-systemd: use secure_getenv() rather than getenv()
|
|
|
592caf |
|
|
|
592caf |
And explain why in a comment.
|
|
|
592caf |
|
|
|
592caf |
(cherry picked from commit 83d4ab55336ff8a0643c6aa627b31e351a24040a)
|
|
|
592caf |
|
|
|
592caf |
CVE-2019-3842
|
|
|
592caf |
|
|
|
592caf |
Resolves: #1687514
|
|
|
592caf |
---
|
|
|
592caf |
src/login/pam_systemd.c | 55 ++++++++++++++++++++++++-----------------
|
|
|
592caf |
1 file changed, 32 insertions(+), 23 deletions(-)
|
|
|
592caf |
|
|
|
592caf |
diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
|
|
|
592caf |
index 1fbf6ba585..78ddb7d398 100644
|
|
|
592caf |
--- a/src/login/pam_systemd.c
|
|
|
592caf |
+++ b/src/login/pam_systemd.c
|
|
|
592caf |
@@ -274,6 +274,33 @@ static int append_session_cg_weight(pam_handle_t *handle, sd_bus_message *m, con
|
|
|
592caf |
return 0;
|
|
|
592caf |
}
|
|
|
592caf |
|
|
|
592caf |
+static const char* getenv_harder(pam_handle_t *handle, const char *key, const char *fallback) {
|
|
|
592caf |
+ const char *v;
|
|
|
592caf |
+
|
|
|
592caf |
+ assert(handle);
|
|
|
592caf |
+ assert(key);
|
|
|
592caf |
+
|
|
|
592caf |
+ /* Looks for an environment variable, preferrably in the environment block associated with the
|
|
|
592caf |
+ * specified PAM handle, falling back to the process' block instead. Why check both? Because we want
|
|
|
592caf |
+ * to permit configuration of session properties from unit files that invoke PAM services, so that
|
|
|
592caf |
+ * PAM services don't have to be reworked to set systemd-specific properties, but these properties
|
|
|
592caf |
+ * can still be set from the unit file Environment= block. */
|
|
|
592caf |
+
|
|
|
592caf |
+ v = pam_getenv(handle, key);
|
|
|
592caf |
+ if (!isempty(v))
|
|
|
592caf |
+ return v;
|
|
|
592caf |
+
|
|
|
592caf |
+ /* We use secure_getenv() here, since we might get loaded into su/sudo, which are SUID. Ideally
|
|
|
592caf |
+ * they'd clean up the environment before invoking foreign code (such as PAM modules), but alas they
|
|
|
592caf |
+ * currently don't (to be precise, they clean up the environment they pass to their children, but
|
|
|
592caf |
+ * not their own environ[]). */
|
|
|
592caf |
+ v = secure_getenv(key);
|
|
|
592caf |
+ if (!isempty(v))
|
|
|
592caf |
+ return v;
|
|
|
592caf |
+
|
|
|
592caf |
+ return fallback;
|
|
|
592caf |
+}
|
|
|
592caf |
+
|
|
|
592caf |
_public_ PAM_EXTERN int pam_sm_open_session(
|
|
|
592caf |
pam_handle_t *handle,
|
|
|
592caf |
int flags,
|
|
|
592caf |
@@ -352,29 +379,11 @@ _public_ PAM_EXTERN int pam_sm_open_session(
|
|
|
592caf |
pam_get_item(handle, PAM_RUSER, (const void**) &remote_user);
|
|
|
592caf |
pam_get_item(handle, PAM_RHOST, (const void**) &remote_host);
|
|
|
592caf |
|
|
|
592caf |
- seat = pam_getenv(handle, "XDG_SEAT");
|
|
|
592caf |
- if (isempty(seat))
|
|
|
592caf |
- seat = getenv("XDG_SEAT");
|
|
|
592caf |
-
|
|
|
592caf |
- cvtnr = pam_getenv(handle, "XDG_VTNR");
|
|
|
592caf |
- if (isempty(cvtnr))
|
|
|
592caf |
- cvtnr = getenv("XDG_VTNR");
|
|
|
592caf |
-
|
|
|
592caf |
- type = pam_getenv(handle, "XDG_SESSION_TYPE");
|
|
|
592caf |
- if (isempty(type))
|
|
|
592caf |
- type = getenv("XDG_SESSION_TYPE");
|
|
|
592caf |
- if (isempty(type))
|
|
|
592caf |
- type = type_pam;
|
|
|
592caf |
-
|
|
|
592caf |
- class = pam_getenv(handle, "XDG_SESSION_CLASS");
|
|
|
592caf |
- if (isempty(class))
|
|
|
592caf |
- class = getenv("XDG_SESSION_CLASS");
|
|
|
592caf |
- if (isempty(class))
|
|
|
592caf |
- class = class_pam;
|
|
|
592caf |
-
|
|
|
592caf |
- desktop = pam_getenv(handle, "XDG_SESSION_DESKTOP");
|
|
|
592caf |
- if (isempty(desktop))
|
|
|
592caf |
- desktop = getenv("XDG_SESSION_DESKTOP");
|
|
|
592caf |
+ seat = getenv_harder(handle, "XDG_SEAT", NULL);
|
|
|
592caf |
+ cvtnr = getenv_harder(handle, "XDG_VTNR", NULL);
|
|
|
592caf |
+ type = getenv_harder(handle, "XDG_SESSION_TYPE", type_pam);
|
|
|
592caf |
+ class = getenv_harder(handle, "XDG_SESSION_CLASS", class_pam);
|
|
|
592caf |
+ desktop = getenv_harder(handle, "XDG_SESSION_DESKTOP", NULL);
|
|
|
592caf |
|
|
|
592caf |
tty = strempty(tty);
|
|
|
592caf |
|