|
 |
4be148 |
From 3a32e1e6e644c6092f48cf6b6f2d0b8635b3dd52 Mon Sep 17 00:00:00 2001
|
|
|
4be148 |
From: Nalin Dahyabhai <nalin@redhat.com>
|
|
|
4be148 |
Date: Wed, 30 Jul 2014 17:12:31 -0400
|
|
|
4be148 |
Subject: [PATCH] In ksu, without the -e flag, also check .k5users
|
|
|
4be148 |
|
|
|
4be148 |
When ksu was explicitly told to spawn a shell, a line in .k5users which
|
|
|
4be148 |
listed "*" as the allowed command would cause the principal named on the
|
|
|
4be148 |
line to be considered as a candidate for authentication.
|
|
|
4be148 |
|
|
|
4be148 |
When ksu was not passed a command to run, which implicitly meant that
|
|
|
4be148 |
the invoking user wanted to run the target user's login shell, knowledge
|
|
|
4be148 |
that the principal was a valid candidate was ignored, which could cause
|
|
|
4be148 |
a less optimal choice of the default target principal.
|
|
|
4be148 |
|
|
|
4be148 |
This doesn't impact the authorization checks which we perform later.
|
|
|
4be148 |
|
|
|
4be148 |
ticket: 7983 (new)
|
|
|
4be148 |
---
|
|
|
4be148 |
src/clients/ksu/heuristic.c | 19 ++++++-------------
|
|
|
4be148 |
1 file changed, 6 insertions(+), 13 deletions(-)
|
|
|
4be148 |
|
|
|
4be148 |
diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c
|
|
|
4be148 |
index c7e691c..99b54e5 100644
|
|
|
4be148 |
--- a/src/clients/ksu/heuristic.c
|
|
|
4be148 |
+++ b/src/clients/ksu/heuristic.c
|
|
|
4be148 |
@@ -264,20 +264,13 @@ get_authorized_princ_names(luser, cmd, princ_list)
|
|
|
4be148 |
|
|
|
4be148 |
close_time(k5users_flag,users_fp, k5login_flag, login_fp);
|
|
|
4be148 |
|
|
|
4be148 |
- if (cmd) {
|
|
|
4be148 |
- retval = list_union(k5login_list, k5users_filt_list, &combined_list);
|
|
|
4be148 |
- if (retval){
|
|
|
4be148 |
- close_time(k5users_flag,users_fp, k5login_flag,login_fp);
|
|
|
4be148 |
- return retval;
|
|
|
4be148 |
- }
|
|
|
4be148 |
- *princ_list = combined_list;
|
|
|
4be148 |
- return 0;
|
|
|
4be148 |
- } else {
|
|
|
4be148 |
- if (k5users_filt_list != NULL)
|
|
|
4be148 |
- free(k5users_filt_list);
|
|
|
4be148 |
- *princ_list = k5login_list;
|
|
|
4be148 |
- return 0;
|
|
|
4be148 |
+ retval = list_union(k5login_list, k5users_filt_list, &combined_list);
|
|
|
4be148 |
+ if (retval){
|
|
|
4be148 |
+ close_time(k5users_flag,users_fp, k5login_flag,login_fp);
|
|
|
4be148 |
+ return retval;
|
|
|
4be148 |
}
|
|
|
4be148 |
+ *princ_list = combined_list;
|
|
|
4be148 |
+ return 0;
|
|
|
4be148 |
}
|
|
|
4be148 |
|
|
|
4be148 |
static void close_time(k5users_flag, users_fp, k5login_flag, login_fp)
|