summaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
authorTomas Mraz <tm@t8m.info>2008-02-21 21:12:30 +0000
committerTomas Mraz <tm@t8m.info>2008-02-21 21:12:30 +0000
commit6ccbba1cf178e9de46347e2f9df76f69aebcec20 (patch)
treed1d8b61899152d201746f7a949208767370af590 /modules
parent9058692366a17701a67d4a5c2eb306acfc778bd6 (diff)
Relevant BUGIDs: rhbz#433459
Purpose of commit: bugfix Commit summary: --------------- 2008-02-21 Tomas Mraz <t8m@centrum.cz> * libpam/pam_audit.c (_pam_audit_writelog): Silence syslog message on non-error return. * modules/pam_unix/unix_chkpwd.c (main): Proceed as unprivileged user when checking password of another user. * modules/pam_unix/unix_update.c: Fix comment.
Diffstat (limited to 'modules')
-rw-r--r--modules/pam_unix/unix_chkpwd.c5
-rw-r--r--modules/pam_unix/unix_update.c11
2 files changed, 10 insertions, 6 deletions
diff --git a/modules/pam_unix/unix_chkpwd.c b/modules/pam_unix/unix_chkpwd.c
index 11ac3aac..5f872d27 100644
--- a/modules/pam_unix/unix_chkpwd.c
+++ b/modules/pam_unix/unix_chkpwd.c
@@ -101,7 +101,10 @@ int main(int argc, char *argv[])
/* if the caller specifies the username, verify that user
matches it */
if (strcmp(user, argv[1])) {
- return PAM_AUTH_ERR;
+ user = argv[1];
+ /* no match -> permanently change to the real user and proceed */
+ if (setuid(getuid()) != 0)
+ return PAM_AUTH_ERR;
}
}
diff --git a/modules/pam_unix/unix_update.c b/modules/pam_unix/unix_update.c
index 595b7f8b..f54a59ce 100644
--- a/modules/pam_unix/unix_update.c
+++ b/modules/pam_unix/unix_update.c
@@ -1,11 +1,12 @@
/*
- * This program is designed to run setuid(root) or with sufficient
- * privilege to read all of the unix password databases. It is designed
- * to provide a mechanism for the current user (defined by this
- * process' uid) to verify their own password.
+ * This program is designed to run with sufficient privilege
+ * to read and write all of the unix password databases.
+ * Its purpose is to allow updating the databases when
+ * SELinux confinement of the caller domain prevents them to
+ * do that themselves.
*
* The password is read from the standard input. The exit status of
- * this program indicates whether the user is authenticated or not.
+ * this program indicates whether the password was updated or not.
*
* Copyright information is located at the end of the file.
*