rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-02-22 00:54:30 +01:00
Code Issues Projects Releases Wiki Activity

authorize_user_token: Don't drop privs for system-wide file.

Browse Source
This commit is contained in:
Fredrik Thulin 2011-12-13 16:56:04 +01:00
parent 29f8a00713
commit 263012f725
1 changed files with 24 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
pam_yubico.c
View File

@ -206,45 +206,50 @@ authorize_user_token (struct cfg *cfg,
pam_handle_t *pamh) pam_handle_t *pamh)
{ {
int retval; int retval;
struct passwd *p;
p = getpwnam (username);
if (p == NULL) {
DBG (("getpwnam: %s", strerror(errno)));
return 0;
}
if (drop_privileges(p, pamh) < 0) {
D (("could not drop privileges"));
return 0;
}
if (cfg->auth_file) if (cfg->auth_file)
{ {
/* Administrator had configured the file and specified is name /* Administrator had configured the file and specified is name
as an argument for this module. as an argument for this module.
*/ */
DBG (("Using system-wide auth_file %s", cfg->auth_file));
retval = check_user_token (cfg, cfg->auth_file, username, otp_id); retval = check_user_token (cfg, cfg->auth_file, username, otp_id);
} }
else else
{ {
char *userfile = NULL; char *userfile = NULL;
struct passwd *p;
p = getpwnam (username);
if (p == NULL) {
DBG (("getpwnam: %s", strerror(errno)));
return 0;
}
/* Getting file from user home directory /* Getting file from user home directory
..... i.e. ~/.yubico/authorized_yubikeys ..... i.e. ~/.yubico/authorized_yubikeys
*/ */
if (! get_user_cfgfile_path (NULL, "authorized_yubikeys", username, &userfile)) if (! get_user_cfgfile_path (NULL, "authorized_yubikeys", username, &userfile)) {
D (("Failed figuring out per-user cfgfile"));
return 0; return 0;
}
DBG (("Dropping privileges"));
if (drop_privileges(p, pamh) < 0) {
D (("could not drop privileges"));
return 0;
}
retval = check_user_token (cfg, userfile, username, otp_id); retval = check_user_token (cfg, userfile, username, otp_id);
free (userfile); if (restore_privileges(pamh) < 0)
} {
DBG (("could not restore privileges"));
return 0;
}
if (restore_privileges(pamh) < 0) free (userfile);
{
DBG (("could not restore privileges"));
return 0;
} }
return retval; return retval;