38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
From 37780b895199bab991edae6b1eeb91b7b3966bcf Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Thu, 6 Feb 2020 14:50:23 +0100
|
|
Subject: [PATCH 25/25] PAM client: only require UID 0 for private socket
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Some privileged services like e.g. gdm might only call with UID 0 but
|
|
with a different GID. This patch removes the GID 0 requirement to access
|
|
to private PAM socket so that e.g. gdm can use the wait-for-card option.
|
|
|
|
Resolves: https://pagure.io/SSSD/sssd/issue/4159
|
|
|
|
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
---
|
|
src/sss_client/common.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/sss_client/common.c b/src/sss_client/common.c
|
|
index 270ca8b54..902438c86 100644
|
|
--- a/src/sss_client/common.c
|
|
+++ b/src/sss_client/common.c
|
|
@@ -910,8 +910,8 @@ int sss_pam_make_request(enum sss_cli_command cmd,
|
|
goto out;
|
|
}
|
|
|
|
- /* only root shall use the privileged pipe */
|
|
- if (getuid() == 0 && getgid() == 0) {
|
|
+ /* only UID 0 shall use the privileged pipe */
|
|
+ if (getuid() == 0) {
|
|
socket_name = SSS_PAM_PRIV_SOCKET_NAME;
|
|
errno = 0;
|
|
statret = stat(socket_name, &stat_buf);
|
|
--
|
|
2.20.1
|
|
|