Relevant BUGIDs: rhbz#433459

Purpose of commit: bugfix

Commit summary:
---------------
2008-02-21  Tomas Mraz <t8m@centrum.cz>

        * libpam/pam_audit.c (_pam_audit_writelog): Silence syslog
        message on non-error return.

        * modules/pam_unix/unix_chkpwd.c (main): Proceed as unprivileged
        user when checking password of another user.
        * modules/pam_unix/unix_update.c: Fix comment.

diff --git a/ChangeLog b/ChangeLog
index 3bfd3c6a5572964b822521e511f675a96c07696d..d5cc413c7482b75c05d4b070b54199bdcf27ded3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2008-02-21  Tomas Mraz <t8m@centrum.cz>
+
+       * libpam/pam_audit.c (_pam_audit_writelog): Silence syslog
+       message on non-error return.
+
+       * modules/pam_unix/unix_chkpwd.c (main): Proceed as unprivileged
+       user when checking password of another user.
+       * modules/pam_unix/unix_update.c: Fix comment.
+
 2008-02-18  Dmitry V. Levin  <ldv@altlinux.org>
 
        * libpam/pam_handlers.c (_pam_assemble_line): Fix potential

diff --git a/libpam/pam_audit.c b/libpam/pam_audit.c
index 6fd6a0c1ebc3890046977a24f83f83faed6f2ce5..7f2e0b2c0f4a342c33315a61f63e2200c0da1f74 100644 (file)
--- a/libpam/pam_audit.c
+++ b/libpam/pam_audit.c
@@ -43,18 +43,17 @@ _pam_audit_writelog(pam_handle_t *pamh, int audit_fd, int type,
      best to fix it. */
   errno = -rc;
 
-  if (rc < 0 && errno != old_errno)
-    {
-      old_errno = errno;
-      pam_syslog (pamh, LOG_CRIT, "audit_log_acct_message() failed: %m");
-    }
-
   pamh->audit_state |= PAMAUDIT_LOGGED;
 
-  if (rc == -EPERM && getuid () != 0)
-    return 0;
-  else
-    return rc;
+  if (rc < 0) {
+      if (rc == -EPERM && getuid() != 0)
+          return 0;
+      if (errno != old_errno) {
+          old_errno = errno;
+          pam_syslog (pamh, LOG_CRIT, "audit_log_acct_message() failed: %m");
+      }
+  }
+  return rc;
 }
 
 static int

diff --git a/modules/pam_unix/unix_chkpwd.c b/modules/pam_unix/unix_chkpwd.c
index 11ac3aac6354993691596900c4b7964c2680abff..5f872d27f5d2922a5aaaff05d808fe1c7d9ca31c 100644 (file)
--- a/modules/pam_unix/unix_chkpwd.c
+++ b/modules/pam_unix/unix_chkpwd.c
@@ -101,7 +101,10 @@ int main(int argc, char *argv[])
          /* if the caller specifies the username, verify that user
             matches it */
          if (strcmp(user, argv[1])) {
-           return PAM_AUTH_ERR;
+           user = argv[1];
+           /* no match -> permanently change to the real user and proceed */
+           if (setuid(getuid()) != 0)
+               return PAM_AUTH_ERR;
          }
        }
 

diff --git a/modules/pam_unix/unix_update.c b/modules/pam_unix/unix_update.c
index 595b7f8be34a32ca6ea79287e6888f8ed3da5c38..f54a59cee9138dc03aec38d5d8f87032ce7f503d 100644 (file)
--- a/modules/pam_unix/unix_update.c
+++ b/modules/pam_unix/unix_update.c
@@ -1,11 +1,12 @@
 /*
- * This program is designed to run setuid(root) or with sufficient
- * privilege to read all of the unix password databases. It is designed
- * to provide a mechanism for the current user (defined by this
- * process' uid) to verify their own password.
+ * This program is designed to run with sufficient privilege
+ * to read and write all of the unix password databases.
+ * Its purpose is to allow updating the databases when
+ * SELinux confinement of the caller domain prevents them to
+ * do that themselves.
  *
  * The password is read from the standard input. The exit status of
- * this program indicates whether the user is authenticated or not.
+ * this program indicates whether the password was updated or not.
  *
  * Copyright information is located at the end of the file.
  *