34eb9e
diff -up ./plugins/sudoers/auth/pam.c.krb5ccname ./plugins/sudoers/auth/pam.c
34eb9e
--- ./plugins/sudoers/auth/pam.c.krb5ccname	2019-10-28 13:27:38.000000000 +0100
34eb9e
+++ ./plugins/sudoers/auth/pam.c	2021-12-06 11:14:15.580226222 +0100
34eb9e
@@ -119,10 +119,10 @@ conv_filter_init(void)
34eb9e
 
34eb9e
 	/*
34eb9e
 	 * Messages from PAM account management when trusted mode is enabled:
34eb9e
-	 *  1 Last   successful login for %s: %s  
34eb9e
-	 *  2 Last   successful login for %s: %s on %s 
34eb9e
-	 *  3 Last unsuccessful login for %s: %s      
34eb9e
-	 *  4 Last unsuccessful login for %s: %s on %s 
34eb9e
+	 *  1 Last   successful login for %s: %s
34eb9e
+	 *  2 Last   successful login for %s: %s on %s
34eb9e
+	 *  3 Last unsuccessful login for %s: %s
34eb9e
+	 *  4 Last unsuccessful login for %s: %s on %s
34eb9e
 	 */
34eb9e
 	if ((catd = catopen("pam_comsec", NL_CAT_LOCALE)) != -1) {
34eb9e
 	    maxfilters += 4;
34eb9e
@@ -290,6 +290,7 @@ sudo_pam_init_quiet(struct passwd *pw, s
34eb9e
 int
34eb9e
 sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_conv_callback *callback)
34eb9e
 {
34eb9e
+    const char *envccname;
34eb9e
     const char *s;
34eb9e
     int *pam_status = (int *) auth->data;
34eb9e
     debug_decl(sudo_pam_verify, SUDOERS_DEBUG_AUTH)
34eb9e
@@ -298,8 +299,27 @@ sudo_pam_verify(struct passwd *pw, char
34eb9e
     getpass_error = false;	/* set by converse if user presses ^C */
34eb9e
     conv_callback = callback;	/* passed to conversation function */
34eb9e
 
34eb9e
+	/* Set KRB5CCNAME from the user environment if not set to propagate this
34eb9e
+	 * information to PAM modules that may use it to authentication. */
34eb9e
+	envccname = sudo_getenv("KRB5CCNAME");
34eb9e
+	if (envccname == NULL && user_ccname != NULL) {
34eb9e
+		if (sudo_setenv("KRB5CCNAME", user_ccname, true) != 0) {
34eb9e
+			sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
34eb9e
+			"unable to set KRB5CCNAME");
34eb9e
+			debug_return_int(AUTH_FAILURE);
34eb9e
+		}
34eb9e
+	}
34eb9e
+
34eb9e
     /* PAM_SILENT prevents the authentication service from generating output. */
34eb9e
     *pam_status = pam_authenticate(pamh, PAM_SILENT);
34eb9e
+
34eb9e
+	/* Restore KRB5CCNAME to its original value. */
34eb9e
+	if (envccname == NULL && sudo_unsetenv("KRB5CCNAME") != 0) {
34eb9e
+		sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
34eb9e
+		"unable to restore KRB5CCNAME");
34eb9e
+		debug_return_int(AUTH_FAILURE);
34eb9e
+	}
34eb9e
+
34eb9e
     if (getpass_error) {
34eb9e
 	/* error or ^C from tgetpass() */
34eb9e
 	debug_return_int(AUTH_INTR);