|
 |
8d58a8 |
From 6c240f1d7c3e348af0aa95d5dfba08e95601fcc8 Mon Sep 17 00:00:00 2001
|
|
|
8d58a8 |
From: Cathy Avery <cavery@redhat.com>
|
|
|
8d58a8 |
Date: Fri, 15 Nov 2019 14:49:07 +0100
|
|
|
8d58a8 |
Subject: [PATCH 2/3] End VGAuth impersonation in the
|
|
|
8d58a8 |
|
|
|
8d58a8 |
RH-Author: Cathy Avery <cavery@redhat.com>
|
|
|
8d58a8 |
Message-id: <20191115144908.7669-3-cavery@redhat.com>
|
|
|
8d58a8 |
Patchwork-id: 92390
|
|
|
8d58a8 |
O-Subject: [RHEL7.7.z open-vm-tools PATCH 2/3] End VGAuth impersonation in the case of error.
|
|
|
8d58a8 |
Bugzilla: 1772825
|
|
|
8d58a8 |
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
8d58a8 |
RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
|
|
|
8d58a8 |
|
|
|
8d58a8 |
commit 7b874f37f970aab2adddb063a8363594f47abf70
|
|
|
8d58a8 |
Author: Oliver Kurth <okurth@vmware.com>
|
|
|
8d58a8 |
Date: Tue Sep 4 15:40:58 2018 -0700
|
|
|
8d58a8 |
|
|
|
8d58a8 |
End VGAuth impersonation in the case of error.
|
|
|
8d58a8 |
|
|
|
8d58a8 |
* In GuestAuthPasswordAuthenticateImpersonate():
|
|
|
8d58a8 |
When VGAuth_UserHandleAccessToken fails, unimpersonation is not
|
|
|
8d58a8 |
being done. This can cause issues. Fixed it.
|
|
|
8d58a8 |
|
|
|
8d58a8 |
* In GuestAuthSAMLAuthenticateAndImpersonate(), fixed the following issues:
|
|
|
8d58a8 |
The 'newHandle' is not being freed which causes a memory leak.
|
|
|
8d58a8 |
When VGAuth_UserHandleAccessToken fails, unimpersonation is not
|
|
|
8d58a8 |
being done.
|
|
|
8d58a8 |
|
|
|
8d58a8 |
Signed-off-by: Cathy Avery <cavery@redhat.com>
|
|
|
8d58a8 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
8d58a8 |
---
|
|
|
8d58a8 |
services/plugins/vix/vixTools.c | 25 +++++++++++++++++++++++--
|
|
|
8d58a8 |
1 file changed, 23 insertions(+), 2 deletions(-)
|
|
|
8d58a8 |
|
|
|
8d58a8 |
diff --git a/services/plugins/vix/vixTools.c b/services/plugins/vix/vixTools.c
|
|
|
8d58a8 |
index 7ed9f43..3d327e4 100644
|
|
|
8d58a8 |
--- a/services/plugins/vix/vixTools.c
|
|
|
8d58a8 |
+++ b/services/plugins/vix/vixTools.c
|
|
|
8d58a8 |
@@ -11392,6 +11392,7 @@ GuestAuthPasswordAuthenticateImpersonate(
|
|
|
8d58a8 |
VGAuthError vgErr;
|
|
|
8d58a8 |
VGAuthUserHandle *newHandle = NULL;
|
|
|
8d58a8 |
VGAuthExtraParams extraParams[1];
|
|
|
8d58a8 |
+ Bool impersonated = FALSE;
|
|
|
8d58a8 |
|
|
|
8d58a8 |
extraParams[0].name = VGAUTH_PARAM_LOAD_USER_PROFILE;
|
|
|
8d58a8 |
extraParams[0].value = VGAUTH_PARAM_VALUE_TRUE;
|
|
|
8d58a8 |
@@ -11427,6 +11428,8 @@ GuestAuthPasswordAuthenticateImpersonate(
|
|
|
8d58a8 |
goto done;
|
|
|
8d58a8 |
}
|
|
|
8d58a8 |
|
|
|
8d58a8 |
+ impersonated = TRUE;
|
|
|
8d58a8 |
+
|
|
|
8d58a8 |
#ifdef _WIN32
|
|
|
8d58a8 |
// this is making a copy of the token, be sure to close it
|
|
|
8d58a8 |
vgErr = VGAuth_UserHandleAccessToken(ctx, newHandle, userToken);
|
|
|
8d58a8 |
@@ -11446,6 +11449,10 @@ done:
|
|
|
8d58a8 |
Util_ZeroFreeString(password);
|
|
|
8d58a8 |
|
|
|
8d58a8 |
if (VIX_OK != err) {
|
|
|
8d58a8 |
+ if (impersonated) {
|
|
|
8d58a8 |
+ vgErr = VGAuth_EndImpersonation(ctx);
|
|
|
8d58a8 |
+ ASSERT(vgErr == VGAUTH_E_OK);
|
|
|
8d58a8 |
+ }
|
|
|
8d58a8 |
VGAuth_UserHandleFree(newHandle);
|
|
|
8d58a8 |
newHandle = NULL;
|
|
|
8d58a8 |
}
|
|
|
8d58a8 |
@@ -11480,12 +11487,13 @@ GuestAuthSAMLAuthenticateAndImpersonate(
|
|
|
8d58a8 |
{
|
|
|
8d58a8 |
#if SUPPORT_VGAUTH
|
|
|
8d58a8 |
VixError err;
|
|
|
8d58a8 |
- char *token;
|
|
|
8d58a8 |
- char *username;
|
|
|
8d58a8 |
+ char *token = NULL;
|
|
|
8d58a8 |
+ char *username = NULL;
|
|
|
8d58a8 |
VGAuthContext *ctx = NULL;
|
|
|
8d58a8 |
VGAuthError vgErr;
|
|
|
8d58a8 |
VGAuthUserHandle *newHandle = NULL;
|
|
|
8d58a8 |
VGAuthExtraParams extraParams[1];
|
|
|
8d58a8 |
+ Bool impersonated = FALSE;
|
|
|
8d58a8 |
|
|
|
8d58a8 |
extraParams[0].name = VGAUTH_PARAM_LOAD_USER_PROFILE;
|
|
|
8d58a8 |
extraParams[0].value = VGAUTH_PARAM_VALUE_TRUE;
|
|
|
8d58a8 |
@@ -11577,6 +11585,8 @@ impersonate:
|
|
|
8d58a8 |
goto done;
|
|
|
8d58a8 |
}
|
|
|
8d58a8 |
|
|
|
8d58a8 |
+ impersonated = TRUE;
|
|
|
8d58a8 |
+
|
|
|
8d58a8 |
#ifdef _WIN32
|
|
|
8d58a8 |
// this is making a copy of the token, be sure to close it
|
|
|
8d58a8 |
vgErr = VGAuth_UserHandleAccessToken(ctx, newHandle, userToken);
|
|
|
8d58a8 |
@@ -11592,6 +11602,17 @@ impersonate:
|
|
|
8d58a8 |
err = VIX_OK;
|
|
|
8d58a8 |
|
|
|
8d58a8 |
done:
|
|
|
8d58a8 |
+ Util_ZeroFreeString(token);
|
|
|
8d58a8 |
+ Util_ZeroFreeString(username);
|
|
|
8d58a8 |
+
|
|
|
8d58a8 |
+ if (VIX_OK != err) {
|
|
|
8d58a8 |
+ if (impersonated) {
|
|
|
8d58a8 |
+ vgErr = VGAuth_EndImpersonation(ctx);
|
|
|
8d58a8 |
+ ASSERT(vgErr == VGAUTH_E_OK);
|
|
|
8d58a8 |
+ }
|
|
|
8d58a8 |
+ VGAuth_UserHandleFree(newHandle);
|
|
|
8d58a8 |
+ newHandle = NULL;
|
|
|
8d58a8 |
+ }
|
|
|
8d58a8 |
|
|
|
8d58a8 |
return err;
|
|
|
8d58a8 |
#else
|
|
|
8d58a8 |
--
|
|
|
8d58a8 |
1.8.3.1
|
|
|
8d58a8 |
|