Fix privilege dropping logiclightdm-0.9.6

3 files changed, 23 insertions, 11 deletions

diff --git a/src/dmrc.c b/src/dmrc.c
index 0b34edc2..916fa8d6 100644
--- a/src/dmrc.c
+++ b/src/dmrc.c
@@ -81,12 +81,17 @@ dmrc_save (GKeyFile *dmrc_file, const gchar *username)
     /* Update the users .dmrc */
     if (user)
     {
+        gboolean drop_privileges;
+
         path = g_build_filename (user_get_home_directory (user), ".dmrc", NULL);
 
         /* Guard against privilege escalation through symlinks, etc. */
-        privileges_drop (user);
+        drop_privileges = geteuid () == 0;
+        if (drop_privileges)
+            privileges_drop (user);
         g_file_set_contents (path, data, length, NULL);
-        privileges_reclaim ();
+        if (drop_privileges)
+            privileges_reclaim ();
 
         g_free (path);
     }
diff --git a/src/privileges.c b/src/privileges.c
index 98a615a5..1f87b4f2 100644
--- a/src/privileges.c
+++ b/src/privileges.c
@@ -17,8 +17,7 @@
 void
 privileges_drop (User *user)
 {
-    if (geteuid () != 0 || user == NULL)
-        return;
+    g_return_if_fail (user != NULL);
 
     g_debug ("Dropping privileges to uid %i", user_get_uid (user));
     g_assert (setresgid (user_get_gid (user), user_get_gid (user), -1) == 0);
@@ -28,9 +27,6 @@ privileges_drop (User *user)
 void
 privileges_reclaim (void)
 {
-    if (geteuid () != 0)
-        return;
-  
     g_debug ("Restoring privileges");
     g_assert (setresuid (0, 0, -1) == 0);
     g_assert (setresgid (0, 0, -1) == 0);  
diff --git a/src/xsession.c b/src/xsession.c
index 283a29fe..e8b76b88 100644
--- a/src/xsession.c
+++ b/src/xsession.c
@@ -89,10 +89,15 @@ xsession_start (Session *session)
         xsession->priv->authority_file = g_file_new_for_path (path);
         if (xsession->priv->authority_in_system_dir)
         {
+            gboolean drop_privileges;
+
             g_debug ("Adding session authority to %s", path);
-            privileges_drop (session_get_user (SESSION (session)));
+            drop_privileges = geteuid () == 0;
+            if (drop_privileges)
+                privileges_drop (session_get_user (SESSION (session)));
             write_authority (xsession);
-            privileges_reclaim ();
+            if (drop_privileges)
+                privileges_reclaim ();
         }
         else
             g_debug ("Adding session authority to %s (written in session process)", path);
@@ -109,10 +114,16 @@ xsession_remove_authority (XSession *session)
 {
     if (session->priv->authority_file)
     {
+        gboolean drop_privileges;
+      
         g_debug ("Removing session authority from %s", g_file_get_path (session->priv->authority_file));
-        privileges_drop (session_get_user (SESSION (session)));
+      
+        drop_privileges = geteuid () == 0;
+        if (drop_privileges)
+            privileges_drop (session_get_user (SESSION (session)));
         xauth_write (session->priv->authority, XAUTH_WRITE_MODE_REMOVE, session->priv->authority_file, NULL);
-        privileges_reclaim ();
+        if (drop_privileges)
+            privileges_reclaim ();
         g_object_unref (session->priv->authority_file);
         session->priv->authority_file = NULL;
     }