Relevant BUGIDs: 124062

Purpose of commit: new feature

Commit summary:
---------------
add change_uid option to pam_limits, and set real uid only
if this option is present

diff --git a/CHANGELOG b/CHANGELOG
index 0fa94d0f55496977450acfc39806711e2dbdabe9..0b026deeb84139a23ab623e89b5039db394e97e0 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -35,6 +35,8 @@ Where you should replace XXXXX with a bug-id.
 0.73: please submit patches for this section with actual code/doc
       patches!
 
+* add change_uid option to pam_limits, and set real uid only if
+  this option is present (Bug 124062 - baggins)
 * pam_limits - set real uid to the user for who we set limits.
   (Bug 123972 - baggins)
 * removed static variables from pam_limits (thread safe now). (Bug

diff --git a/doc/modules/pam_limits.sgml b/doc/modules/pam_limits.sgml
index f7a2245e7eb607f04f83570f6f68b464d1e812aa..3b30a2c372a50238375d6fa29dc96d1863b88bf2 100644 (file)
--- a/doc/modules/pam_limits.sgml
+++ b/doc/modules/pam_limits.sgml
@@ -74,6 +74,12 @@ verbose logging to <tt/syslog(3)/.
 <item><tt>conf=/path/to/file.conf</tt> -
 indicate an alternative <em/limits/ configuration file to the default.
 
+<item><tt/change_uid/ - 
+change real uid to the user for who the limits are set up.  Use this
+option if you have problems like login not forking a shell for user
+who has no processes. Be warned that something else may break when
+you do this.
+
 </itemize>
 
 <tag><bf>Examples/suggested usage:</bf></tag>

diff --git a/modules/pam_limits/README b/modules/pam_limits/README
index 06a6857a81357ab4f00dd9b38a20839c4780d25c..918e6c912601bde997bc375ea95daa9a76b703a1 100644 (file)
--- a/modules/pam_limits/README
+++ b/modules/pam_limits/README
@@ -68,6 +68,12 @@ ARGUMENTS RECOGNIZED:
     conf=/path/to/file the limits configuration file if different from the
                        one set at compile time.
 
+    change_uid         change real uid to the user for who the limits
+                       are set up.  Use this option if you have problems
+                       like login not forking a shell for user who has
+                       no processes.  Be warned that something else
+                       may break when you do this.
+
 MODULE SERVICES PROVIDED:
        session            _open_session and _close_session (blank)
 

diff --git a/modules/pam_limits/pam_limits.c b/modules/pam_limits/pam_limits.c
index 07dc3556359ddd21923e6cb88e07f799dcb88c8a..34d76bf527d30b622eda32e2d2e71c7987810cb1 100644 (file)
--- a/modules/pam_limits/pam_limits.c
+++ b/modules/pam_limits/pam_limits.c
@@ -91,6 +91,7 @@ static void _pam_log(int err, const char *format, ...)
 /* argument parsing */
 
 #define PAM_DEBUG_ARG       0x0001
+#define PAM_DO_SETREUID     0x0002
 
 static int _pam_parse(int argc, const char **argv, struct pam_limit_s *pl)
 {
@@ -105,6 +106,8 @@ static int _pam_parse(int argc, const char **argv, struct pam_limit_s *pl)
                ctrl |= PAM_DEBUG_ARG;
           else if (!strncmp(*argv,"conf=",5))
                 strcpy(pl->conf_file,*argv+5);
+         else if (!strncmp(*argv,"change_uid",10))
+               ctrl |= PAM_DO_SETREUID;
           else {
                _pam_log(LOG_ERR,"pam_parse: unknown option; %s",*argv);
           }
@@ -564,8 +567,9 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
         _pam_log(LOG_WARNING, "error parsing the configuration file");
         return PAM_IGNORE;
     }
-    
-    setreuid(pwd->pw_uid, -1);
+
+    if (ctrl & PAM_DO_SETREUID)
+       setreuid(pwd->pw_uid, -1);
     retval = setup_limits(pwd->pw_name, ctrl, &pl);
     if (retval & LOGIN_ERR) {
         printf("\nToo many logins for '%s'\n",pwd->pw_name);