[pam_ssh/f13] Drop root group privileges properly before executing ssh-agent (#711170)
Dmitry Butskoy
buc at fedoraproject.org
Tue Jun 7 12:49:32 UTC 2011
commit a937450f04e7a4d8c9a588d2f127446ab6bb14c1
Author: Dmitry Butskoy <Dmitry at Butskoy.name>
Date: Tue Jun 7 16:49:07 2011 +0400
Drop root group privileges properly before executing ssh-agent (#711170)
pam_ssh-1.97-setgid.patch | 13 +++++++++++++
pam_ssh-1.97-var_run.patch | 16 +++++++++-------
pam_ssh.spec | 19 +++++++++++++++----
3 files changed, 37 insertions(+), 11 deletions(-)
---
diff --git a/pam_ssh-1.97-setgid.patch b/pam_ssh-1.97-setgid.patch
new file mode 100644
index 0000000..71566f6
--- /dev/null
+++ b/pam_ssh-1.97-setgid.patch
@@ -0,0 +1,13 @@
+diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
+--- pam_ssh-1.97/pam_ssh.c 2011-06-07 16:34:48.000000000 +0400
++++ pam_ssh-1.97-OK/pam_ssh.c 2011-06-07 16:36:07.000000000 +0400
+@@ -688,7 +688,8 @@
+ _exit(EX_OSERR);
+ /* NOTREACHED */
+ case PAM_SUCCESS:
+- if (setuid(pwent->pw_uid) == -1) {
++ if (initgroups(pwent->pw_name, pwent->pw_gid) == -1 ||
++ setgid(pwent->pw_gid) == -1 || setuid(pwent->pw_uid) == -1) {
+ pam_ssh_log(LOG_ERR,
+ "can't drop privileges: %m",
+ pwent->pw_uid);
diff --git a/pam_ssh-1.97-var_run.patch b/pam_ssh-1.97-var_run.patch
index d3b96e5..94342a7 100644
--- a/pam_ssh-1.97-var_run.patch
+++ b/pam_ssh-1.97-var_run.patch
@@ -1,6 +1,6 @@
diff -Nrbu pam_ssh-1.97/pam_ssh.8 pam_ssh-1.97-OK/pam_ssh.8
--- pam_ssh-1.97/pam_ssh.8 2008-05-12 22:57:12.000000000 +0400
-+++ pam_ssh-1.97-OK/pam_ssh.8 2009-07-15 21:39:52.000000000 +0400
++++ pam_ssh-1.97-OK/pam_ssh.8 2010-12-13 19:54:24.000000000 +0300
@@ -148,6 +148,10 @@
SSH2 RSA keys
.It Pa $HOME/.ssh2/id_dsa_*
@@ -14,7 +14,7 @@ diff -Nrbu pam_ssh-1.97/pam_ssh.8 pam_ssh-1.97-OK/pam_ssh.8
.Xr ssh-agent 1 ,
diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
--- pam_ssh-1.97/pam_ssh.c 2008-05-12 22:57:12.000000000 +0400
-+++ pam_ssh-1.97-OK/pam_ssh.c 2009-07-15 21:38:32.000000000 +0400
++++ pam_ssh-1.97-OK/pam_ssh.c 2010-12-13 20:19:36.000000000 +0300
@@ -114,6 +114,7 @@
#define PAM_OPT_NULLOK_NAME "nullok"
#define SEP_KEYFILES ","
@@ -53,19 +53,21 @@ diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
== -1) {
pam_ssh_log(LOG_CRIT, "out of memory");
openpam_restore_cred(pamh);
-@@ -644,7 +643,10 @@
+@@ -644,7 +643,12 @@
}
if (start_agent) {
- if ((env_write = open(per_agent, O_CREAT | O_WRONLY, S_IRUSR | S_IWUSR)) < 0) {
+ openpam_restore_cred(pamh);
++ if (stat(STATE_DIR, &stat_buf) < 0)
++ mkdir(STATE_DIR, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
+ env_write = open(per_agent, O_CREAT | O_WRONLY, S_IRUSR | S_IRGRP | S_IROTH);
+ openpam_borrow_cred(pamh, pwent);
+ if (env_write < 0) {
pam_ssh_log(LOG_ERR, "can't write to %s", per_agent);
free(per_agent);
openpam_restore_cred(pamh);
-@@ -880,7 +882,7 @@
+@@ -880,7 +884,7 @@
for (cp = tty_nodir; (cp = strchr(cp, '/')); )
*cp = '_';
@@ -74,7 +76,7 @@ diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
tty_nodir) == -1) {
pam_ssh_log(LOG_CRIT, "out of memory");
free(tty_nodir);
-@@ -899,10 +901,10 @@
+@@ -899,10 +903,10 @@
return retval;
}
@@ -86,7 +88,7 @@ diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
return PAM_SUCCESS;
}
-@@ -932,8 +934,11 @@
+@@ -932,8 +936,11 @@
}
if (pam_get_data(pamh, "ssh_agent_env_session",
@@ -99,7 +101,7 @@ diff -Nrbu pam_ssh-1.97/pam_ssh.c pam_ssh-1.97-OK/pam_ssh.c
/* Retrieve per-agent filename and check link count. If it's
greater than unity, other sessions are still using this
-@@ -948,7 +953,9 @@
+@@ -948,7 +955,9 @@
openpam_restore_cred(pamh);
return PAM_SUCCESS;
}
diff --git a/pam_ssh.spec b/pam_ssh.spec
index 2f01250..811e215 100644
--- a/pam_ssh.spec
+++ b/pam_ssh.spec
@@ -1,16 +1,17 @@
Summary: PAM module for use with SSH keys and ssh-agent
Name: pam_ssh
Version: 1.97
-Release: 4%{?dist}
+Release: 7%{?dist}
Group: System Environment/Base
License: BSD
URL: http://sourceforge.net/projects/pam-ssh/
Source0: http://downloads.sourceforge.net/pam-ssh/pam_ssh-%{version}.tar.bz2
-Patch0: pam_ssh-1.97-var_run.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: pam-devel, openssh-clients, openssl-devel, libtool
Requires: openssh-clients
Conflicts: selinux-policy-targeted < 3.0.8-55
+Patch0: pam_ssh-1.97-var_run.patch
+Patch1: pam_ssh-1.97-setgid.patch
%description
@@ -25,6 +26,7 @@ are set in the session phase.
%prep
%setup -q
%patch0 -p1
+%patch1 -p1
# re-run autoconf utils to libtoolize properly
autoreconf -f -si
@@ -63,16 +65,25 @@ rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root,-)
/%{_lib}/security/*.so
-%dir %{_localstatedir}/run/pam_ssh
+%ghost %dir %{_localstatedir}/run/pam_ssh
%doc AUTHORS NEWS README ChangeLog TODO COPYING
%{_mandir}/*/*
%changelog
-* Wed Jan 5 2011 Dmitry Butskoy <Dmitry at Butskoy.name> - 1.97-4
+* Tue Jun 7 2011 Dmitry Butskoy <Dmitry at Butskoy.name> - 1.97-7
+- Drop root group privileges properly before executing ssh-agent (#711170)
+
+* Tue Feb 08 2011 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.97-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Wed Jan 5 2011 Dmitry Butskoy <Dmitry at Butskoy.name> - 1.97-5
- export only pam_sm_* symbols from the module
(else it could cause cross linking when used under sshd daemon)
+* Mon Dec 13 2010 Dmitry Butskoy <Dmitry at Butskoy.name> - 1.97-4
+- auto-create state dir under /var/run (#656657)
+
* Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> - 1.97-3
- rebuilt with new openssl
More information about the scm-commits
mailing list