rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-01-31 16:52:19 +01:00
Code Issues Projects Releases Wiki Activity

Merge branch 'chalresp_ownership'

Browse Source
This commit is contained in:
Klas Lindfors 2016-04-01 09:35:19 +02:00
commit 2343b25d23
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pam_yubico.c
View File

@ -615,10 +615,14 @@ do_challenge_response(pam_handle_t *pamh, struct cfg *cfg, const char *username)
goto restpriv_out;
}
if (fchmod (fd, S_IRUSR | S_IWUSR) != 0) {
if (fchmod (fd, st.st_mode) != 0) {
DBG (("could not set correct file permissions"));
goto restpriv_out;
}
if (fchown (fd, st.st_uid, st.st_gid) != 0) {
DBG (("could not set correct file ownership"));
goto restpriv_out;
}
f = fdopen(fd, "w");
if (! f) {

12
ykpamcfg.c
View File

@ -145,6 +145,7 @@ do_add_hmac_chalresp(YK_KEY *yk, uint8_t slot, bool verbose, char *output_dir, u
char *fn;
struct passwd *p;
FILE *f = NULL;
struct stat st;
state.iterations = iterations;
state.slot = slot;
@ -162,7 +163,6 @@ do_add_hmac_chalresp(YK_KEY *yk, uint8_t slot, bool verbose, char *output_dir, u
*/
if (!output_dir){
struct stat st;
char fullpath[256];
snprintf(fullpath, 256,"%s/.yubico",p->pw_dir);
@ -190,6 +190,11 @@ do_add_hmac_chalresp(YK_KEY *yk, uint8_t slot, bool verbose, char *output_dir, u
goto out;
}
if (stat(fn, &st) == 0) {
fprintf(stderr, "File %s already exists, refusing to overwrite.\n", fn);
goto out;
}
if (generate_random(state.challenge, CR_CHALLENGE_SIZE)) {
fprintf (stderr, "FAILED getting %i bytes of random data\n", CR_CHALLENGE_SIZE);
goto out;
@ -240,6 +245,11 @@ do_add_hmac_chalresp(YK_KEY *yk, uint8_t slot, bool verbose, char *output_dir, u
if (! write_chalresp_state (f, &state))
goto out;
if (! chmod (fn, S_IRUSR | S_IWUSR)) {
fprintf (stderr, "Failed setting permissions on new challenge file %s.\n", fn);
goto out;
}
printf ("Stored initial challenge and expected response in '%s'.\n", fn);
*exit_code = 0;