isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a PAM_USER mismatch in session open/close. We update PAM_USER

Browse Source 
to the target user immediately before setting resource limits, which
is after the monitor process has forked (so it has the old value).
Also, if the user did not authenticate, there is no pamh in the
monitor so we need to init pam here too.  This means we end up
calling pam_start() twice, which should be fixed, but at least the
session is always properly closed now.
This commit is contained in:
Todd C. Miller
2011-09-27 11:13:44 -04:00
parent 7304bc744e
commit c5f8dc95c6
4 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/sudoers/auth/sudo_auth.c
View File

@@ -274,14 +274,14 @@ int auth_begin_session(struct passwd *pw)
return TRUE;
}
int auth_end_session(void)
int auth_end_session(struct passwd *pw)
{
sudo_auth *auth;
int status;
for (auth = auth_switch; auth->name; auth++) {
if (auth->end_session && !IS_DISABLED(auth)) {
status = (auth->end_session)(auth);
status = (auth->end_session)(pw, auth);
if (status == AUTH_FATAL) { /* XXX log */
return -1; /* assume error msg already printed */
}