52 lines
1.8 KiB
Diff
52 lines
1.8 KiB
Diff
From 4660286e9cdff6d95b49295674b96f83af10ea36 Mon Sep 17 00:00:00 2001
|
|
From: "Andrew G. Morgan" <morgan@kernel.org>
|
|
Date: Sat, 27 Nov 2021 21:00:22 -0800
|
|
Subject: [PATCH] Complete Linux-PAM compliance for forked child in su and
|
|
login.
|
|
|
|
As documented here:
|
|
|
|
http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end
|
|
|
|
The child that is about to exec*() the user shell is supposed to pam_end()
|
|
with PAM_DATA_SILENT. This gives the modules a last chance to do a minor
|
|
cleanup of the module state before the user's shell is launched.
|
|
|
|
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
|
|
---
|
|
login-utils/login.c | 3 +++
|
|
login-utils/su-common.c | 3 +++
|
|
2 files changed, 6 insertions(+)
|
|
|
|
diff --git a/login-utils/login.c b/login-utils/login.c
|
|
index 7229692dd..2c146b977 100644
|
|
--- a/login-utils/login.c
|
|
+++ b/login-utils/login.c
|
|
@@ -1533,6 +1533,9 @@ int main(int argc, char **argv)
|
|
|
|
child_argv[child_argc++] = NULL;
|
|
|
|
+ /* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */
|
|
+ (void) pam_end(cxt.pamh, PAM_SUCCESS|PAM_DATA_SILENT);
|
|
+
|
|
execvp(child_argv[0], child_argv + 1);
|
|
|
|
if (!strcmp(child_argv[0], "/bin/sh"))
|
|
diff --git a/login-utils/su-common.c b/login-utils/su-common.c
|
|
index 6b7ddeca7..06282d21a 100644
|
|
--- a/login-utils/su-common.c
|
|
+++ b/login-utils/su-common.c
|
|
@@ -1263,6 +1263,9 @@ int su_main(int argc, char **argv, int mode)
|
|
if (su->simulate_login && chdir(su->pwd->pw_dir) != 0)
|
|
warn(_("warning: cannot change directory to %s"), su->pwd->pw_dir);
|
|
|
|
+ /* http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end */
|
|
+ (void) pam_end(su->pamh, PAM_SUCCESS|PAM_DATA_SILENT);
|
|
+
|
|
if (shell)
|
|
run_shell(su, shell, command, argv + optind, max(0, argc - optind));
|
|
|
|
--
|
|
2.33.0
|
|
|