isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict the PAM_TTY kludge to Solaris and Linux-PAM.

Browse Source 
Setting PAM_TTY to the empty string causes problems with some modules
on HP-UX so restrict it to systems where it is fixes known issues.
This commit is contained in:
Todd C. Miller
2019-04-08 08:50:03 -06:00
parent 731e796711
commit f0910c01da
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
plugins/sudoers/auth/pam.c
View File

@@ -92,6 +92,7 @@ static int
sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet) sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
{ {
static int pam_status = PAM_SUCCESS; static int pam_status = PAM_SUCCESS;
const char *tty = user_ttypath;
int rc; int rc;
debug_decl(sudo_pam_init, SUDOERS_DEBUG_AUTH) debug_decl(sudo_pam_init, SUDOERS_DEBUG_AUTH)
@@ -135,17 +136,22 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
} }
#endif #endif
#if defined(__LINUX_PAM__) || defined(__sun__)
/* /*
* Some versions of pam_lastlog have a bug that * Some PAM modules assume PAM_TTY is set and will misbehave (or crash)
* will cause a crash if PAM_TTY is not set so if * if it is not. Known offenders include pam_lastlog and pam_time.
* there is no tty, set PAM_TTY to the empty string.
*/ */
rc = pam_set_item(pamh, PAM_TTY, user_ttypath ? user_ttypath : ""); if (tty == NULL)
if (rc != PAM_SUCCESS) { tty = "";
const char *errstr = pam_strerror(pamh, rc); #endif
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, if (tty != NULL) {
"pam_set_item(pamh, PAM_TTY, %s): %s", rc = pam_set_item(pamh, PAM_TTY, tty);
user_ttypath ? user_ttypath : "", errstr ? errstr : "unknown error"); if (rc != PAM_SUCCESS) {
const char *errstr = pam_strerror(pamh, rc);
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"pam_set_item(pamh, PAM_TTY, %s): %s", tty,
errstr ? errstr : "unknown error");
}
} }
/* /*