|
 |
e1791d |
diff -up ./plugins/sudoers/auth/pam.c.krb5ccname ./plugins/sudoers/auth/pam.c
|
|
|
e1791d |
--- ./plugins/sudoers/auth/pam.c.krb5ccname 2019-10-28 13:27:38.000000000 +0100
|
|
|
e1791d |
+++ ./plugins/sudoers/auth/pam.c 2021-12-06 11:14:15.580226222 +0100
|
|
|
e1791d |
@@ -119,10 +119,10 @@ conv_filter_init(void)
|
|
|
e1791d |
|
|
|
e1791d |
/*
|
|
|
e1791d |
* Messages from PAM account management when trusted mode is enabled:
|
|
|
e1791d |
- * 1 Last successful login for %s: %s
|
|
|
e1791d |
- * 2 Last successful login for %s: %s on %s
|
|
|
e1791d |
- * 3 Last unsuccessful login for %s: %s
|
|
|
e1791d |
- * 4 Last unsuccessful login for %s: %s on %s
|
|
|
e1791d |
+ * 1 Last successful login for %s: %s
|
|
|
e1791d |
+ * 2 Last successful login for %s: %s on %s
|
|
|
e1791d |
+ * 3 Last unsuccessful login for %s: %s
|
|
|
e1791d |
+ * 4 Last unsuccessful login for %s: %s on %s
|
|
|
e1791d |
*/
|
|
|
e1791d |
if ((catd = catopen("pam_comsec", NL_CAT_LOCALE)) != -1) {
|
|
|
e1791d |
maxfilters += 4;
|
|
|
e1791d |
@@ -290,6 +290,7 @@ sudo_pam_init_quiet(struct passwd *pw, s
|
|
|
e1791d |
int
|
|
|
e1791d |
sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_conv_callback *callback)
|
|
|
e1791d |
{
|
|
|
e1791d |
+ const char *envccname;
|
|
|
e1791d |
const char *s;
|
|
|
e1791d |
int *pam_status = (int *) auth->data;
|
|
|
e1791d |
debug_decl(sudo_pam_verify, SUDOERS_DEBUG_AUTH)
|
|
|
e1791d |
@@ -298,8 +299,27 @@ sudo_pam_verify(struct passwd *pw, char
|
|
|
e1791d |
getpass_error = false; /* set by converse if user presses ^C */
|
|
|
e1791d |
conv_callback = callback; /* passed to conversation function */
|
|
|
e1791d |
|
|
|
e1791d |
+ /* Set KRB5CCNAME from the user environment if not set to propagate this
|
|
|
e1791d |
+ * information to PAM modules that may use it to authentication. */
|
|
|
e1791d |
+ envccname = sudo_getenv("KRB5CCNAME");
|
|
|
e1791d |
+ if (envccname == NULL && user_ccname != NULL) {
|
|
|
e1791d |
+ if (sudo_setenv("KRB5CCNAME", user_ccname, true) != 0) {
|
|
|
e1791d |
+ sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
|
|
|
e1791d |
+ "unable to set KRB5CCNAME");
|
|
|
e1791d |
+ debug_return_int(AUTH_FAILURE);
|
|
|
e1791d |
+ }
|
|
|
e1791d |
+ }
|
|
|
e1791d |
+
|
|
|
e1791d |
/* PAM_SILENT prevents the authentication service from generating output. */
|
|
|
e1791d |
*pam_status = pam_authenticate(pamh, PAM_SILENT);
|
|
|
e1791d |
+
|
|
|
e1791d |
+ /* Restore KRB5CCNAME to its original value. */
|
|
|
e1791d |
+ if (envccname == NULL && sudo_unsetenv("KRB5CCNAME") != 0) {
|
|
|
e1791d |
+ sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
|
|
|
e1791d |
+ "unable to restore KRB5CCNAME");
|
|
|
e1791d |
+ debug_return_int(AUTH_FAILURE);
|
|
|
e1791d |
+ }
|
|
|
e1791d |
+
|
|
|
e1791d |
if (getpass_error) {
|
|
|
e1791d |
/* error or ^C from tgetpass() */
|
|
|
e1791d |
debug_return_int(AUTH_INTR);
|