diff options
| author | Dmitry V. Levin <ldv@altlinux.org> | 2010-10-03 21:00:53 +0000 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@altlinux.org> | 2010-10-03 21:00:53 +0000 |
| commit | 0b1055f64657dc0bf175f75c23470b2be7630451 (patch) | |
| tree | f5957bb81fcfcf982d122c1d8ebdd4c81be9b73a /modules/pam_env | |
| parent | c388a2730d012b5101d264c83f8db586acd3a70c (diff) | |
Relevant BUGIDs:
Purpose of commit: bugfix
Commit summary:
---------------
2010-10-04 Dmitry V. Levin <ldv@altlinux.org>
* libpam/pam_modutil_priv.c: New file.
* libpam/Makefile.am (libpam_la_SOURCES): Add it.
* libpam/include/security/pam_modutil.h (struct pam_modutil_privs,
PAM_MODUTIL_DEF_PRIVS, pam_modutil_drop_priv,
pam_modutil_regain_priv): New declarations.
* libpam/libpam.map (LIBPAM_MODUTIL_1.1.3): New interface.
* modules/pam_env/pam_env.c (handle_env): Use new pam_modutil interface.
* modules/pam_mail/pam_mail.c (_do_mail): Likewise.
* modules/pam_xauth/pam_xauth.c (check_acl, pam_sm_open_session,
pam_sm_close_session): Likewise.
(pam_sm_open_session): Remove redundant fchown call.
Fixes CVE-2010-3430, CVE-2010-3431.
Diffstat (limited to 'modules/pam_env')
| -rw-r--r-- | modules/pam_env/pam_env.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c index 3a9eebea..8ac8ed33 100644 --- a/modules/pam_env/pam_env.c +++ b/modules/pam_env/pam_env.c @@ -23,7 +23,6 @@ #include <string.h> #include <syslog.h> #include <sys/stat.h> -#include <sys/fsuid.h> #include <sys/types.h> #include <unistd.h> @@ -791,9 +790,15 @@ handle_env (pam_handle_t *pamh, int argc, const char **argv) return PAM_BUF_ERR; } if (stat(envpath, &statbuf) == 0) { - uid_t fsuid = setfsuid(user_entry->pw_uid); - retval = _parse_config_file(pamh, envpath); - setfsuid(fsuid); + PAM_MODUTIL_DEF_PRIVS(privs); + + if (pam_modutil_drop_priv(pamh, &privs, user_entry)) { + retval = PAM_SESSION_ERR; + } else { + retval = _parse_config_file(pamh, envpath); + if (pam_modutil_regain_priv(pamh, &privs)) + retval = PAM_SESSION_ERR; + } if (retval == PAM_IGNORE) retval = PAM_SUCCESS; } |