From 1b72f138e33e17465c3cdf232233a0b013ebccbc Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Wed, 5 Jan 2022 10:59:27 -0700 Subject: [PATCH] Remove PAM_TTY workaround for old, buggy PAM modules. In the past, some PAM modules assumed that PAM_TTY was set and would misbehave (or crash) if not. This was primarily obsolete versions of Linux-PAM, so it should now be safe to remove this. Setting PAM_TTY to an empty string can cause its own set of issues. GitHub issue #74 --- plugins/sudoers/auth/pam.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c index 48eb5fcb9..316f6930c 100644 --- a/plugins/sudoers/auth/pam.c +++ b/plugins/sudoers/auth/pam.c @@ -245,16 +245,7 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet) "pam_set_item(pamh, PAM_RHOST, %s): %s", user_host, errstr); } } - -#if defined(__LINUX_PAM__) || defined(__sun__) - /* - * Some PAM modules assume PAM_TTY is set and will misbehave (or crash) - * if it is not. Known offenders include pam_lastlog and pam_time. - */ - if (ttypath == NULL) - ttypath = ""; -#endif - if (ttypath != NULL) { // -V547 + if (ttypath != NULL) { rc = pam_set_item(pamh, PAM_TTY, ttypath); if (rc != PAM_SUCCESS) { errstr = sudo_pam_strerror(pamh, rc);