This commit is contained in:
OBS User unknown
Git OBS Bridge
parent
d5bd631021
commit
0b7715d634
141
pam_krb5-2.2.11-1-refresh-drop-restore-priv.dif
Normal file
141
pam_krb5-2.2.11-1-refresh-drop-restore-priv.dif
Normal file
@ -0,0 +1,141 @@
|
||||
--- src/auth.c
|
||||
+++ src/auth.c 2007/03/15 10:55:36
|
||||
@@ -418,9 +418,13 @@
|
||||
return pam_sm_open_session(pamh, flags, argc, argv);
|
||||
}
|
||||
if (flags & (PAM_REINITIALIZE_CRED | PAM_REFRESH_CRED)) {
|
||||
- if (_pam_krb5_sly_looks_unsafe() == 0) {
|
||||
+ int unsave = _pam_krb5_sly_looks_unsafe();
|
||||
+
|
||||
+ /* unsave == 2 or 3 can be fixed inside of
|
||||
+ _pam_krb5_sly_maybe_refresh */
|
||||
+ if (unsave == 0 || unsave == 2 || unsave == 3) {
|
||||
return _pam_krb5_sly_maybe_refresh(pamh, flags,
|
||||
- argc, argv);
|
||||
+ argc, argv);
|
||||
} else {
|
||||
return PAM_IGNORE;
|
||||
}
|
||||
--- src/sly.c
|
||||
+++ src/sly.c 2007/03/15 10:46:36
|
||||
@@ -146,6 +146,21 @@
|
||||
return 0;
|
||||
}
|
||||
|
||||
+/* restore dropped privileges */
|
||||
+int
|
||||
+_restore_privs(uid_t save_euid, gid_t save_egid)
|
||||
+{
|
||||
+ int retuid = 0, retgid = 0;
|
||||
+
|
||||
+ retuid = setresuid(getuid(), save_euid, getuid());
|
||||
+ retgid = setresgid(getgid(), save_egid, getgid());
|
||||
+
|
||||
+ debug("restore privileges: UID = %u, EUID = %u\n", getuid(), geteuid());
|
||||
+ debug("restore privileges: GID = %u, EGID = %u\n", getgid(), getegid());
|
||||
+
|
||||
+ return (retuid == -1 || retgid == -1)?-1:0;
|
||||
+}
|
||||
+
|
||||
int
|
||||
_pam_krb5_sly_maybe_refresh(pam_handle_t *pamh, int flags,
|
||||
int argc, PAM_KRB5_MAYBE_CONST char **argv)
|
||||
@@ -159,6 +174,20 @@
|
||||
int i, retval, stored;
|
||||
char *v5ccname, *v4tktfile;
|
||||
|
||||
+ uid_t save_euid = geteuid();
|
||||
+ gid_t save_egid = getegid();
|
||||
+
|
||||
+
|
||||
+ if(_pam_krb5_sly_looks_unsafe() == 2 || _pam_krb5_sly_looks_unsafe() == 3)
|
||||
+ {
|
||||
+ /* drop privileges temporarily; restore them on every return from this function */
|
||||
+ setresuid(getuid(), getuid(), geteuid());
|
||||
+ setresgid(getgid(), getgid(), getegid());
|
||||
+
|
||||
+ debug("drop privileges temporarily: UID = %u, EUID = %u\n", getuid(), geteuid());
|
||||
+ debug("drop privileges temporarily: GID = %u, EGID = %u\n", getgid(), getegid());
|
||||
+ }
|
||||
+
|
||||
/* Inexpensive checks. */
|
||||
switch (_pam_krb5_sly_looks_unsafe()) {
|
||||
case 0:
|
||||
@@ -166,18 +195,22 @@
|
||||
break;
|
||||
case 1:
|
||||
warn("won't refresh credentials while running under sudo");
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
break;
|
||||
case 2:
|
||||
warn("won't refresh credentials while running setuid");
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
break;
|
||||
case 3:
|
||||
warn("won't refresh credentials while running setgid");
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
break;
|
||||
default:
|
||||
warn("not safe to refresh credentials");
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
break;
|
||||
}
|
||||
@@ -185,6 +218,7 @@
|
||||
/* Initialize Kerberos. */
|
||||
if (_pam_krb5_init_ctx(&ctx, argc, argv) != 0) {
|
||||
warn("error initializing Kerberos");
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
}
|
||||
|
||||
@@ -193,6 +227,7 @@
|
||||
if (i != PAM_SUCCESS) {
|
||||
warn("could not identify user name");
|
||||
krb5_free_context(ctx);
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return i;
|
||||
}
|
||||
|
||||
@@ -201,6 +236,7 @@
|
||||
if (options == NULL) {
|
||||
warn("error parsing options (shouldn't happen)");
|
||||
krb5_free_context(ctx);
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
}
|
||||
if (options->debug) {
|
||||
@@ -222,6 +258,7 @@
|
||||
}
|
||||
_pam_krb5_options_free(pamh, ctx, options);
|
||||
krb5_free_context(ctx);
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return retval;
|
||||
}
|
||||
|
||||
@@ -233,6 +270,7 @@
|
||||
_pam_krb5_user_info_free(ctx, userinfo);
|
||||
_pam_krb5_options_free(pamh, ctx, options);
|
||||
krb5_free_context(ctx);
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_IGNORE;
|
||||
}
|
||||
|
||||
@@ -244,6 +282,7 @@
|
||||
_pam_krb5_user_info_free(ctx, userinfo);
|
||||
_pam_krb5_options_free(pamh, ctx, options);
|
||||
krb5_free_context(ctx);
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return PAM_SERVICE_ERR;
|
||||
}
|
||||
|
||||
@@ -331,5 +370,6 @@
|
||||
pam_strerror(pamh, retval));
|
||||
}
|
||||
|
||||
+ _restore_privs(save_euid, save_egid);
|
||||
return retval;
|
||||
}
|
||||
@ -1,3 +1,12 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Mar 15 12:34:55 CET 2007 - mc@suse.de
|
||||
|
||||
- drop privileges in _pam_krb5_sly_maybe_refresh when
|
||||
running in set uid and restore them on exit of this
|
||||
function. This enables us to refresh the ticket
|
||||
after screen un-lock.
|
||||
[#124611]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 25 10:45:53 CEST 2006 - mc@suse.de
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package pam_krb5 (Version 2.2.11)
|
||||
#
|
||||
# Copyright (c) 2006 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||
# Copyright (c) 2007 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||
# This file and all modifications and additions to the pristine
|
||||
# package are under the same license as the package itself.
|
||||
#
|
||||
@ -13,17 +13,18 @@
|
||||
Name: pam_krb5
|
||||
BuildRequires: krb5-client krb5-devel krb5-server openssl-devel pam-devel
|
||||
%define PAM_RELEASE 1
|
||||
License: GPL
|
||||
License: GNU General Public License (GPL)
|
||||
Group: Productivity/Networking/Security
|
||||
Provides: pam_krb
|
||||
Autoreqprov: on
|
||||
Version: 2.2.11
|
||||
Release: 1
|
||||
Release: 27
|
||||
Summary: PAM Module for Kerberos Authentication
|
||||
URL: http://sourceforge.net/projects/pam-krb5/
|
||||
Source: pam_krb5-%{version}-%{PAM_RELEASE}.tar.bz2
|
||||
Patch1: pam_krb5-2.2.0-0.5-configure_ac.dif
|
||||
Patch2: pam_krb5-2.2.0-2-noafsonarm.patch
|
||||
Patch3: pam_krb5-2.2.11-1-refresh-drop-restore-priv.dif
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
|
||||
%description
|
||||
@ -41,6 +42,7 @@ Authors:
|
||||
%setup -q -n pam_krb5-%{version}-%{PAM_RELEASE}
|
||||
%patch1
|
||||
%patch2
|
||||
%patch3
|
||||
|
||||
%build
|
||||
%{suse_update_config -f}
|
||||
@ -72,12 +74,18 @@ rm -rf $RPM_BUILD_ROOT
|
||||
%attr(444,root,root) %_mandir/man*/*.*
|
||||
%attr(755,root,root) /usr/bin/afs5log
|
||||
|
||||
%changelog -n pam_krb5
|
||||
%changelog
|
||||
* Thu Mar 15 2007 - mc@suse.de
|
||||
- drop privileges in _pam_krb5_sly_maybe_refresh when
|
||||
running in set uid and restore them on exit of this
|
||||
function. This enables us to refresh the ticket
|
||||
after screen un-lock.
|
||||
[#124611]
|
||||
* Mon Sep 25 2006 - mc@suse.de
|
||||
- version 2.2.11
|
||||
- remove two patches with are upstream now
|
||||
- pam_krb5-2.2.10-0-oldauthtok.dif
|
||||
- pam_krb5-2.2.10-0-testfix.dif
|
||||
- pam_krb5-2.2.10-0-oldauthtok.dif
|
||||
- pam_krb5-2.2.10-0-testfix.dif
|
||||
- make use of --with-os-distribution
|
||||
* Thu Sep 14 2006 - mc@suse.de
|
||||
- fix pam_set_item call for AUTHTOK and OLDAUTHTOK
|
||||
|
||||
Loading…
Reference in New Issue
Block a user