|
1 | | ---- src/session-child.c.orig 2018-02-06 23:31:03 UTC |
| 1 | +--- src/session-child.c.orig 2021-04-12 04:52:50 UTC |
2 | 2 | +++ src/session-child.c |
3 | | -@@ -13,7 +13,6 @@ |
| 3 | +@@ -13,9 +13,11 @@ |
4 | 4 | #include <grp.h> |
5 | 5 | #include <glib.h> |
6 | 6 | #include <security/pam_appl.h> |
7 | 7 | -#include <utmp.h> |
8 | 8 | #include <utmpx.h> |
9 | 9 | #include <sys/mman.h> |
| 10 | ++#if HAVE_SETUSERCONTEXT |
| 11 | ++#include <login_cap.h> |
| 12 | ++#endif |
10 | 13 |
|
11 | | -@@ -192,28 +191,6 @@ read_xauth (void) |
| 14 | + #if HAVE_LIBAUDIT |
| 15 | + #include <libaudit.h> |
| 16 | +@@ -193,28 +195,6 @@ read_xauth (void) |
12 | 17 | return x_authority_new (x_authority_family, x_authority_address, x_authority_address_length, x_authority_number, x_authority_name, x_authority_data, x_authority_data_length); |
13 | 18 | } |
14 | 19 |
|
|
37 | 42 | #if HAVE_LIBAUDIT |
38 | 43 | static void |
39 | 44 | audit_event (int type, const gchar *username, uid_t uid, const gchar *remote_host_name, const gchar *tty, gboolean success) |
40 | | -@@ -363,7 +340,6 @@ session_child_run (int argc, char **argv) |
| 45 | +@@ -364,7 +344,6 @@ session_child_run (int argc, char **argv) |
41 | 46 | ut.ut_tv.tv_sec = tv.tv_sec; |
42 | 47 | ut.ut_tv.tv_usec = tv.tv_usec; |
43 | 48 |
|
44 | 49 | - updwtmpx ("/var/log/btmp", &ut); |
45 | 50 |
|
46 | 51 | #if HAVE_LIBAUDIT |
47 | 52 | audit_event (AUDIT_USER_LOGIN, username, -1, remote_host_name, tty, FALSE); |
48 | | -@@ -393,7 +369,7 @@ session_child_run (int argc, char **argv) |
| 53 | +@@ -394,7 +373,7 @@ session_child_run (int argc, char **argv) |
49 | 54 | else |
50 | 55 | { |
51 | 56 | /* Set POSIX variables */ |
52 | 57 | - pam_putenv (pam_handle, "PATH=/usr/local/bin:/usr/bin:/bin"); |
53 | | -+ pam_putenv (pam_handle, "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:~/bin"); |
| 58 | ++ pam_putenv (pam_handle, "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"); |
54 | 59 | pam_putenv (pam_handle, g_strdup_printf ("USER=%s", username)); |
55 | 60 | pam_putenv (pam_handle, g_strdup_printf ("LOGNAME=%s", username)); |
56 | 61 | pam_putenv (pam_handle, g_strdup_printf ("HOME=%s", user_get_home_directory (user))); |
57 | | -@@ -708,7 +684,6 @@ session_child_run (int argc, char **argv) |
| 62 | +@@ -636,7 +615,29 @@ session_child_run (int argc, char **argv) |
| 63 | + /* Make this process its own session */ |
| 64 | + if (setsid () < 0) |
| 65 | + _exit (errno); |
| 66 | +- |
| 67 | ++#if HAVE_SETUSERCONTEXT |
| 68 | ++ /* Setup user context |
| 69 | ++ * Reset the current environment to what is in the PAM context, |
| 70 | ++ * then setusercontext will add to it as necessary as there is no |
| 71 | ++ * option for setusercontext to add to a PAM context. |
| 72 | ++ */ |
| 73 | ++ extern char **environ; |
| 74 | ++ environ = pam_getenvlist (pam_handle); |
| 75 | ++ struct passwd* pwd = getpwnam (username); |
| 76 | ++ if (pwd) { |
| 77 | ++ if (setusercontext (NULL, pwd, pwd->pw_uid, LOGIN_SETALL) < 0) { |
| 78 | ++ int _errno = errno; |
| 79 | ++ fprintf(stderr, "setusercontext for \"%s\" (%d) failed: %s\n", |
| 80 | ++ username, user_get_uid (user), strerror (errno)); |
| 81 | ++ _exit (_errno); |
| 82 | ++ } |
| 83 | ++ endpwent(); |
| 84 | ++ } else { |
| 85 | ++ fprintf (stderr, "getpwname for \"%s\" failed: %s\n", |
| 86 | ++ username, strerror (errno)); |
| 87 | ++ _exit (ENOENT); |
| 88 | ++ } |
| 89 | ++#else |
| 90 | + /* Change to this user */ |
| 91 | + if (getuid () == 0) |
| 92 | + { |
| 93 | +@@ -646,6 +647,7 @@ session_child_run (int argc, char **argv) |
| 94 | + if (setuid (uid) != 0) |
| 95 | + _exit (errno); |
| 96 | + } |
| 97 | ++#endif |
| 98 | + |
| 99 | + /* Change working directory */ |
| 100 | + /* NOTE: This must be done after the permissions are changed because NFS filesystems can |
| 101 | +@@ -668,7 +670,13 @@ session_child_run (int argc, char **argv) |
| 102 | + signal (SIGPIPE, SIG_DFL); |
| 103 | + |
| 104 | + /* Run the command */ |
| 105 | +- execve (command_argv[0], command_argv, pam_getenvlist (pam_handle)); |
| 106 | ++ execve (command_argv[0], command_argv, |
| 107 | ++#if HAVE_SETUSERCONTEXT |
| 108 | ++ environ |
| 109 | ++#else |
| 110 | ++ pam_getenvlist (pam_handle) |
| 111 | ++#endif |
| 112 | ++ ); |
| 113 | + _exit (EXIT_FAILURE); |
| 114 | + } |
| 115 | + |
| 116 | +@@ -709,7 +717,6 @@ session_child_run (int argc, char **argv) |
58 | 117 | if (!pututxline (&ut)) |
59 | 118 | g_printerr ("Failed to write utmpx: %s\n", strerror (errno)); |
60 | 119 | endutxent (); |
61 | 120 | - updwtmpx ("/var/log/wtmp", &ut); |
62 | 121 |
|
63 | 122 | #if HAVE_LIBAUDIT |
64 | 123 | audit_event (AUDIT_USER_LOGIN, username, uid, remote_host_name, tty, TRUE); |
65 | | -@@ -749,7 +724,6 @@ session_child_run (int argc, char **argv) |
| 124 | +@@ -750,7 +757,6 @@ session_child_run (int argc, char **argv) |
66 | 125 | if (!pututxline (&ut)) |
67 | 126 | g_printerr ("Failed to write utmpx: %s\n", strerror (errno)); |
68 | 127 | endutxent (); |
|
0 commit comments