Katana_mirror/kde-workspace
1
0
Fork 0
mirror of https://bitbucket.org/smil3y/kde-workspace.git synced 2025-02-24 10:52:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

kcheckpass: actually set and restore effective user ID if required

Browse source 
it did not had to be SUID to begin with because neither setuid() nor
seteuid() were used previously in any of the backends, fixes password check
with shadow backend

Signed-off-by: Ivailo Monev <xakepa10@gmail.com>
This commit is contained in:
Ivailo Monev 2021-02-22 06:38:54 +02:00
parent 951ca60c44
commit 9b8fd856be
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
kcheckpass/checkpass_shadow.c
View file

@ -35,6 +35,8 @@
#include <stdlib.h> #include <stdlib.h>
#include <pwd.h> #include <pwd.h>
#include <shadow.h> #include <shadow.h>
#include <unistd.h>
#include <sys/types.h>
AuthReturn Authenticate(const char *method, AuthReturn Authenticate(const char *method,
const char *login, char *(*conv) (ConvRequest, const char *)) const char *login, char *(*conv) (ConvRequest, const char *))
@ -51,14 +53,22 @@ AuthReturn Authenticate(const char *method,
if (!(pw = getpwnam(login))) if (!(pw = getpwnam(login)))
return AuthAbort; return AuthAbort;
uid_t eid = geteuid();
if (eid != 0 && seteuid(0) != 0)
return AuthAbort;
spw = getspnam(login); spw = getspnam(login);
password = spw ? spw->sp_pwdp : pw->pw_passwd; password = spw ? spw->sp_pwdp : pw->pw_passwd;
if (!*password) if (!*password) {
seteuid(eid);
return AuthOk; return AuthOk;
}
if (!(typed_in_password = conv(ConvGetHidden, 0))) if (!(typed_in_password = conv(ConvGetHidden, 0))) {
seteuid(eid);
return AuthAbort; return AuthAbort;
}
#if defined( __linux__ ) && defined( HAVE_PW_ENCRYPT ) #if defined( __linux__ ) && defined( HAVE_PW_ENCRYPT )
crpt_passwd = pw_encrypt(typed_in_password, password); /* (1) */ crpt_passwd = pw_encrypt(typed_in_password, password); /* (1) */
@ -67,10 +77,12 @@ AuthReturn Authenticate(const char *method,
#endif #endif
if (crpt_passwd && !strcmp(password, crpt_passwd )) { if (crpt_passwd && !strcmp(password, crpt_passwd )) {
seteuid(eid);
dispose(typed_in_password); dispose(typed_in_password);
return AuthOk; /* Success */ return AuthOk; /* Success */
} }
dispose(typed_in_password); dispose(typed_in_password);
seteuid(eid);
return AuthBad; /* Password wrong or account locked */ return AuthBad; /* Password wrong or account locked */
} }