isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict the PAM_TTY kludge to Solaris and Linux-PAM.

Browse Source 
Setting PAM_TTY to the empty string causes problems with some modules
on HP-UX so restrict it to systems where it is fixes known issues.
This commit is contained in:
Todd C. Miller
2019-04-08 08:50:03 -06:00
parent 731e796711
commit f0910c01da
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
plugins/sudoers/auth/pam.c
View File

@@ -92,6 +92,7 @@ static int
sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
{
static int pam_status = PAM_SUCCESS;
const char *tty = user_ttypath;
int rc;
debug_decl(sudo_pam_init, SUDOERS_DEBUG_AUTH)
@@ -135,17 +136,22 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
}
#endif
#if defined(__LINUX_PAM__) || defined(__sun__)
/*
* Some versions of pam_lastlog have a bug that
* will cause a crash if PAM_TTY is not set so if
* there is no tty, set PAM_TTY to the empty string.
* Some PAM modules assume PAM_TTY is set and will misbehave (or crash)
* if it is not. Known offenders include pam_lastlog and pam_time.
*/
rc = pam_set_item(pamh, PAM_TTY, user_ttypath ? user_ttypath : "");
if (tty == NULL)
tty = "";
#endif
if (tty != NULL) {
rc = pam_set_item(pamh, PAM_TTY, tty);
if (rc != PAM_SUCCESS) {
const char *errstr = pam_strerror(pamh, rc);
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"pam_set_item(pamh, PAM_TTY, %s): %s",
user_ttypath ? user_ttypath : "", errstr ? errstr : "unknown error");
"pam_set_item(pamh, PAM_TTY, %s): %s", tty,
errstr ? errstr : "unknown error");
}
}
/*