mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-03 15:55:40 +00:00
Code Issues Releases Wiki Activity

The fix for bug #843 was incomplete and caused pam_end() to be called early.

Browse Source 
sudo_pam_approval() must not set the global pam status to an error
value if it returns AUTH_SUCCESS.  Otherwise, sudo_pam_cleanup()
will call pam_end() before sudo_pam_begin_session().  This resulted
in a NULL PAM handle being used in sudo_pam_begin_session().
This commit is contained in:
Todd C. Miller
2018-12-07 09:51:34 -07:00
parent e91e5ee820
commit 4125808a85
1 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
plugins/sudoers/auth/pam.c
View File

@@ -210,59 +210,68 @@ int
sudo_pam_approval(struct passwd *pw, sudo_auth *auth, bool exempt) sudo_pam_approval(struct passwd *pw, sudo_auth *auth, bool exempt)
{ {
const char *s; const char *s;
int rc, status = AUTH_SUCCESS;
int *pam_status = (int *) auth->data; int *pam_status = (int *) auth->data;
debug_decl(sudo_pam_approval, SUDOERS_DEBUG_AUTH) debug_decl(sudo_pam_approval, SUDOERS_DEBUG_AUTH)
*pam_status = pam_acct_mgmt(pamh, PAM_SILENT); rc = pam_acct_mgmt(pamh, PAM_SILENT);
switch (*pam_status) { switch (rc) {
case PAM_SUCCESS: case PAM_SUCCESS:
debug_return_int(AUTH_SUCCESS); break;
case PAM_AUTH_ERR: case PAM_AUTH_ERR:
log_warningx(0, N_("account validation failure, " log_warningx(0, N_("account validation failure, "
"is your account locked?")); "is your account locked?"));
debug_return_int(AUTH_FATAL); status = AUTH_FATAL;
break;
case PAM_NEW_AUTHTOK_REQD: case PAM_NEW_AUTHTOK_REQD:
/* Ignore if user is exempt from password restrictions. */ /* Ignore if user is exempt from password restrictions. */
if (exempt) if (exempt)
debug_return_int(AUTH_SUCCESS); break;
/* New password required, try to change it. */ /* New password required, try to change it. */
log_warningx(0, N_("Account or password is " log_warningx(0, N_("Account or password is "
"expired, reset your password and try again")); "expired, reset your password and try again"));
*pam_status = pam_chauthtok(pamh, rc = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
PAM_CHANGE_EXPIRED_AUTHTOK); if (rc == PAM_SUCCESS)
if (*pam_status == PAM_SUCCESS) break;
debug_return_int(AUTH_SUCCESS); if ((s = pam_strerror(pamh, rc)) == NULL)
if ((s = pam_strerror(pamh, *pam_status)) == NULL)
s = "unknown error"; s = "unknown error";
log_warningx(0, log_warningx(0,
N_("unable to change expired password: %s"), s); N_("unable to change expired password: %s"), s);
debug_return_int(AUTH_FAILURE); status = AUTH_FAILURE;
break;
case PAM_AUTHTOK_EXPIRED: case PAM_AUTHTOK_EXPIRED:
/* Ignore if user is exempt from password restrictions. */ /* Ignore if user is exempt from password restrictions. */
if (exempt) if (exempt)
debug_return_int(AUTH_SUCCESS); break;
/* Password expired, cannot be updated by user. */ /* Password expired, cannot be updated by user. */
log_warningx(0, log_warningx(0,
N_("Password expired, contact your system administrator")); N_("Password expired, contact your system administrator"));
debug_return_int(AUTH_FATAL); status = AUTH_FATAL;
break;
case PAM_ACCT_EXPIRED: case PAM_ACCT_EXPIRED:
log_warningx(0, log_warningx(0,
N_("Account expired or PAM config lacks an \"account\" " N_("Account expired or PAM config lacks an \"account\" "
"section for sudo, contact your system administrator")); "section for sudo, contact your system administrator"));
debug_return_int(AUTH_FATAL); status = AUTH_FATAL;
break;
case PAM_AUTHINFO_UNAVAIL: case PAM_AUTHINFO_UNAVAIL:
case PAM_MAXTRIES: case PAM_MAXTRIES:
case PAM_PERM_DENIED: case PAM_PERM_DENIED:
s = pam_strerror(pamh, *pam_status); s = pam_strerror(pamh, rc);
log_warningx(0, N_("PAM account management error: %s"), log_warningx(0, N_("PAM account management error: %s"),
s ? s : "unknown error"); s ? s : "unknown error");
debug_return_int(AUTH_FAILURE); status = AUTH_FAILURE;
break;
default: default:
s = pam_strerror(pamh, *pam_status); s = pam_strerror(pamh, rc);
log_warningx(0, N_("PAM account management error: %s"), log_warningx(0, N_("PAM account management error: %s"),
s ? s : "unknown error"); s ? s : "unknown error");
debug_return_int(AUTH_FATAL); status = AUTH_FATAL;
break;
} }
/* Ignore errors if user is exempt from password restrictions. */
*pam_status = exempt ? PAM_SUCCESS : rc;
debug_return_int(status);
} }
int int