forked from pool/shadow
51 lines
1.4 KiB
Diff
51 lines
1.4 KiB
Diff
|
Date: Thu Apr 6 16:04:17 CEST 2017
|
||
|
|
Bug: bnc#1031643
|
||
|
|
Upstream: https://github.com/shadow-maint/shadow/pull/74
|
||
|
|
|
||
|
|
dynamically added users via pam_group are not listed in groups
|
||
|
|
databases but are still valid.
|
||
|
|
|
||
|
|
|
||
|
|
Index: shadow-4.1.5.1/src/newgrp.c
|
||
|
|
===================================================================
|
||
|
|
--- shadow-4.1.5.1.orig/src/newgrp.c
|
||
|
|
+++ shadow-4.1.5.1/src/newgrp.c
|
||
|
|
@@ -372,6 +372,7 @@ int main (int argc, char **argv)
|
||
|
|
{
|
||
|
|
bool initflag = false;
|
||
|
|
int i;
|
||
|
|
+ bool is_member = false;
|
||
|
|
bool cflag = false;
|
||
|
|
int err = 0;
|
||
|
|
gid_t gid;
|
||
|
|
@@ -610,6 +611,18 @@ int main (int argc, char **argv)
|
||
|
|
goto failure;
|
||
|
|
}
|
||
|
|
|
||
|
|
+#ifdef HAVE_SETGROUPS
|
||
|
|
+ /* when using pam_group, she will not be listed in the groups
|
||
|
|
+ * database. However getgroups() will return the group. So
|
||
|
|
+ * if she is listed there already it is ok to grant membership.
|
||
|
|
+ */
|
||
|
|
+ for (i = 0; i < ngroups; i++) {
|
||
|
|
+ if (grp->gr_gid == grouplist[i]) {
|
||
|
|
+ is_member = true;
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
+#endif /* HAVE_SETGROUPS */
|
||
|
|
/*
|
||
|
|
* For splitted groups (due to limitations of NIS), check all
|
||
|
|
* groups of the same GID like the requested group for
|
||
|
|
@@ -638,7 +651,9 @@ int main (int argc, char **argv)
|
||
|
|
/*
|
||
|
|
* Check if the user is allowed to access this group.
|
||
|
|
*/
|
||
|
|
- check_perms (grp, pwd, group);
|
||
|
|
+ if (!is_member) {
|
||
|
|
+ check_perms (grp, pwd, group);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
/*
|
||
|
|
* all successful validations pass through this point. The group id
|