diff options
| author | Casper H.S. Dik <Casper.Dik@Sun.COM> | 2009-06-05 09:55:17 +0200 |
|---|---|---|
| committer | Casper H.S. Dik <Casper.Dik@Sun.COM> | 2009-06-05 09:55:17 +0200 |
| commit | 982b4ad2dc6b5ed2a2c8c1670e94ecf1fe63fc56 (patch) | |
| tree | 3077df62cad552b23dca4e8f69efc223a857bdf1 /usr/src/lib/pam_modules/unix_cred | |
| parent | c7402f0767d7a0360fabd0bd449c6baf9b282074 (diff) | |
| download | illumos-joyent-982b4ad2dc6b5ed2a2c8c1670e94ecf1fe63fc56.tar.gz | |
PSARC 2007/072 PRIV_AWARE_RESET
6452447 Need the ability to limit each and every privilege on login
Diffstat (limited to 'usr/src/lib/pam_modules/unix_cred')
| -rw-r--r-- | usr/src/lib/pam_modules/unix_cred/unix_cred.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/usr/src/lib/pam_modules/unix_cred/unix_cred.c b/usr/src/lib/pam_modules/unix_cred/unix_cred.c index 5230394f50..d862b2f652 100644 --- a/usr/src/lib/pam_modules/unix_cred/unix_cred.c +++ b/usr/src/lib/pam_modules/unix_cred/unix_cred.c @@ -596,18 +596,23 @@ adt_done: } if (!priv_issubset(lim, tset)) priv_intersect(tset, lim); - /* - * In order not to suprise certain applications, we - * need to retain privilege awareness and thus we must - * also set P and E. - */ - if (setppriv(PRIV_SET, PRIV_LIMIT, lim) != 0 || - setppriv(PRIV_SET, PRIV_PERMITTED, lim) != 0) { + if (setppriv(PRIV_SET, PRIV_LIMIT, lim) != 0) { syslog(LOG_AUTH | LOG_ERR, "pam_setcred: setppriv(limitpriv) failed: %m"); ret = PAM_CRED_ERR; + goto out; } + /* + * In order not to surprise certain applications, we + * need to get rid of privilege awareness and thus we must + * set this flag which will cause a reset on set*uid(). + */ + (void) setpflags(PRIV_AWARE_RESET, 1); } + /* + * This may fail but we do not care as this will be reset later + * when the uids are set to their final values. + */ (void) setpflags(PRIV_AWARE, 0); out: |