54 lines
1.6 KiB
Diff
54 lines
1.6 KiB
Diff
From 1fd7a5ecb46a02a29ebf42039575b5344307bfbb Mon Sep 17 00:00:00 2001
|
|
From: Alexey Tikhonov <atikhono@redhat.com>
|
|
Date: Wed, 8 Feb 2023 18:58:37 +0100
|
|
Subject: [PATCH 4/4] PAM_SSS: close(sss_cli_sd) should also be protected with
|
|
mutex. Otherwise a thread calling pam_end() can close socket mid pam
|
|
transaction in another thread.
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Bug only manifested on platforms where "lockfree client"
|
|
feature wasn't built.
|
|
|
|
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
(cherry picked from commit bf3f73ea0ee123fe4e7c4bdd2287ac5a5e6d9082)
|
|
---
|
|
src/sss_client/pam_sss.c | 3 +++
|
|
src/sss_client/pam_sss_gss.c | 2 ++
|
|
2 files changed, 5 insertions(+)
|
|
|
|
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
|
|
index afbdef59a..39ad17188 100644
|
|
--- a/src/sss_client/pam_sss.c
|
|
+++ b/src/sss_client/pam_sss.c
|
|
@@ -117,7 +117,10 @@ static void close_fd(pam_handle_t *pamh, void *ptr, int err)
|
|
#endif /* PAM_DATA_REPLACE */
|
|
|
|
D(("Closing the fd"));
|
|
+
|
|
+ sss_pam_lock();
|
|
sss_cli_close_socket();
|
|
+ sss_pam_unlock();
|
|
}
|
|
|
|
struct cert_auth_info {
|
|
diff --git a/src/sss_client/pam_sss_gss.c b/src/sss_client/pam_sss_gss.c
|
|
index 1109ec570..dd578ae5d 100644
|
|
--- a/src/sss_client/pam_sss_gss.c
|
|
+++ b/src/sss_client/pam_sss_gss.c
|
|
@@ -581,7 +581,9 @@ int pam_sm_authenticate(pam_handle_t *pamh,
|
|
}
|
|
|
|
done:
|
|
+ sss_pam_lock();
|
|
sss_cli_close_socket();
|
|
+ sss_pam_unlock();
|
|
free(username);
|
|
free(domain);
|
|
free(target);
|
|
--
|
|
2.37.3
|
|
|