diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | libpam/pam_modutil_priv.c | 17 |
2 files changed, 15 insertions, 4 deletions
@@ -15,6 +15,8 @@ Release 1.5.0 * Removed deprecated pam_tally and pam_tally2 modules, use pam_faillock instead. * pam_env: Reading of the user environment is deprecated and will be removed at some point in the future. +* libpam: pam_modutil_drop_priv() now correctly sets the target user's + supplementary groups, allowing pam_motd to filter messages accordingly Release 1.4.0 * Multiple minor bug fixes and documentation improvements diff --git a/libpam/pam_modutil_priv.c b/libpam/pam_modutil_priv.c index e22fab1a..a463e06a 100644 --- a/libpam/pam_modutil_priv.c +++ b/libpam/pam_modutil_priv.c @@ -107,11 +107,20 @@ int pam_modutil_drop_priv(pam_handle_t *pamh, * We should care to leave process credentials in consistent state. * That is, e.g. if change_gid() succeeded but change_uid() failed, * we should try to restore old gid. + * + * We try to add the supplementary groups on a best-effort + * basis. If it fails, it's not fatal: we fall back to using an + * empty list. */ - if (setgroups(0, NULL)) { - pam_syslog(pamh, LOG_ERR, - "pam_modutil_drop_priv: setgroups failed: %m"); - return cleanup(p); + if (initgroups(pw->pw_name, pw->pw_gid)) { + pam_syslog(pamh, LOG_WARNING, + "pam_modutil_drop_priv: initgroups failed: %m"); + + if (setgroups(0, NULL)) { + pam_syslog(pamh, LOG_ERR, + "pam_modutil_drop_priv: setgroups failed: %m"); + return cleanup(p); + } } if (change_gid(pw->pw_gid, &p->old_gid)) { pam_syslog(pamh, LOG_ERR, |