|
 |
0d441c |
From 37780b895199bab991edae6b1eeb91b7b3966bcf Mon Sep 17 00:00:00 2001
|
|
|
0d441c |
From: Sumit Bose <sbose@redhat.com>
|
|
|
0d441c |
Date: Thu, 6 Feb 2020 14:50:23 +0100
|
|
|
0d441c |
Subject: [PATCH 25/25] PAM client: only require UID 0 for private socket
|
|
|
0d441c |
MIME-Version: 1.0
|
|
|
0d441c |
Content-Type: text/plain; charset=UTF-8
|
|
|
0d441c |
Content-Transfer-Encoding: 8bit
|
|
|
0d441c |
|
|
|
0d441c |
Some privileged services like e.g. gdm might only call with UID 0 but
|
|
|
0d441c |
with a different GID. This patch removes the GID 0 requirement to access
|
|
|
0d441c |
to private PAM socket so that e.g. gdm can use the wait-for-card option.
|
|
|
0d441c |
|
|
|
0d441c |
Resolves: https://pagure.io/SSSD/sssd/issue/4159
|
|
|
0d441c |
|
|
|
0d441c |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
0d441c |
---
|
|
|
0d441c |
src/sss_client/common.c | 4 ++--
|
|
|
0d441c |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
0d441c |
|
|
|
0d441c |
diff --git a/src/sss_client/common.c b/src/sss_client/common.c
|
|
|
0d441c |
index 270ca8b54..902438c86 100644
|
|
|
0d441c |
--- a/src/sss_client/common.c
|
|
|
0d441c |
+++ b/src/sss_client/common.c
|
|
|
0d441c |
@@ -910,8 +910,8 @@ int sss_pam_make_request(enum sss_cli_command cmd,
|
|
|
0d441c |
goto out;
|
|
|
0d441c |
}
|
|
|
0d441c |
|
|
|
0d441c |
- /* only root shall use the privileged pipe */
|
|
|
0d441c |
- if (getuid() == 0 && getgid() == 0) {
|
|
|
0d441c |
+ /* only UID 0 shall use the privileged pipe */
|
|
|
0d441c |
+ if (getuid() == 0) {
|
|
|
0d441c |
socket_name = SSS_PAM_PRIV_SOCKET_NAME;
|
|
|
0d441c |
errno = 0;
|
|
|
0d441c |
statret = stat(socket_name, &stat_buf);
|
|
|
0d441c |
--
|
|
|
0d441c |
2.20.1
|
|
|
0d441c |
|