openssh/openssh-4.5p1-pwname-home.diff

63 lines
1.7 KiB
Diff

--- openssh-4.5p1/misc.c
+++ openssh-4.5p1/misc.c
@@ -186,6 +186,29 @@
return (old);
}
+struct passwd *getpwuid_wh(uid_t uid) {
+ /* Return the password structure by lookup of the username in $ENV{USER},
+ but only when the UID matches a lookup-by-uid so as to not allow using
+ another users' .ssh files in case this function be used in superuser
+ context. */
+
+ const char *user = getenv("USER");
+ struct passwd *pe_nam, *pe_uid;
+
+ if(user == NULL || (pe_nam = getpwnam(user)) == NULL) {
+ return getpwuid(uid);
+ }
+
+ pe_nam = pwcopy(pe_nam);
+ if((pe_uid = getpwuid(uid)) == NULL || pe_nam->pw_uid != pe_uid->pw_uid) {
+ free(pe_nam);
+ return pe_uid;
+ }
+
+ free(pe_nam); // - need to return a non-pwcopy struct
+ return getpwnam(user);
+}
+
struct passwd *
pwcopy(struct passwd *pw)
{
@@ -524,7 +547,7 @@
user[slash] = '\0';
if ((pw = getpwnam(user)) == NULL)
fatal("tilde_expand_filename: No such user %s", user);
- } else if ((pw = getpwuid(uid)) == NULL) /* ~/path */
+ } else if ((pw = getpwuid_wh(uid)) == NULL) /* ~/path */
fatal("tilde_expand_filename: No such uid %d", uid);
if (strlcpy(ret, pw->pw_dir, sizeof(ret)) >= sizeof(ret))
--- openssh-4.5p1/misc.h
+++ openssh-4.5p1/misc.h
@@ -34,6 +34,7 @@
char *tohex(const void *, size_t);
void sanitise_stdfd(void);
+struct passwd *getpwuid_wh(uid_t);
struct passwd *pwcopy(struct passwd *);
typedef struct arglist arglist;
--- openssh-4.5p1/ssh.c
+++ openssh-4.5p1/ssh.c
@@ -249,7 +249,7 @@
}
#endif
/* Get user data. */
- pw = getpwuid(original_real_uid);
+ pw = getpwuid_wh(original_real_uid);
if (!pw) {
logit("You don't exist, go away!");
exit(255);